{ "Event": { "published": true, "date": "2026-06-10", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-06-10", "timestamp": 1781136181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "f3bf58de-158f-4dc0-8898-5aca6fa3f51f", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b572ddb1-6498-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1781074246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074246, "uuid": "0163beae-5084-4b0e-ad55-d673789333e1", "comment": "Malware payload (njrat)", "value": "85353855d5d34ff6fd68f43a5f5ea3e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074246, "uuid": "ea6d2eee-9f3a-489c-a2fc-a059bf6dc03f", "comment": "Malware payload (njrat)", "value": "000f85d150af662ada1c4e9208c783ccaaf7283134bce5ff99723d07b3deb90c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074246, "uuid": "8bc99550-d6cf-4045-97bf-bddc04bbba86", "comment": "Malware payload (njrat)", "value": "4b605ca699cd96b81df1edb72d03bc26bf353500", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074246, "uuid": "697eb83e-b4a2-46d3-a6d2-c4cb7fc75eb5", "comment": "Malware payload (njrat)", "value": "4b587abfb4fb48eca6c568af1b845c295dd93e2b57730c905d1f122a64d61cdd5a0ba528e7025f7105c38e46c7c1b353", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074246, "uuid": "cfc43c59-4679-40e1-8257-5354ec3271b6", "value": "T1D225010273940F82E7582A75C1AB073807E3A4837B32E74ABF5C02A55D91765FD86FDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074246, "uuid": "5c3384bb-b772-499b-b7fa-6743316b20c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074246, "uuid": "e42fe4f9-6e96-4400-b747-54155ca9d8be", "value": "24576:I8pw8DAvAXR6V9EU1R+c5EntrIK94eZLtic0CJ:I8pw8UvAXR6nEUf+c5EtrFDZwRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781074246, "uuid": "be6ec69c-5f7f-4fa2-ba52-d60e65a735da", "value": 1035776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781074246, "uuid": "e018ada3-1e6f-437b-a9ab-3cda27992b30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074246, "uuid": "c50d8be4-5f61-4248-9f69-cd1cd5c6f432", "value": "docPO-Q-260603-ASN _ ZBSPR26-007.PDF(849KB).com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd2f49a-64e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105832, "uuid": "b0baef58-9d55-4df8-a4f2-308bb3ed45a7", "comment": "Malware payload (Mirai)", "value": "d46cd1ede8ac50c8b8bed4945bed0888", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105832, "uuid": "1b367f4a-cba6-4670-a371-93fd1eda27ad", "comment": "Malware payload (Mirai)", "value": "006535fe7c58d568c8f59c9fd47e03cceb24556d9e1ddd348319e3caed398a3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105832, "uuid": "d3eeb1d2-6170-4ba9-be1f-8a5df5f3d252", "comment": "Malware payload (Mirai)", "value": "c0672f073603e93470fb122f14ec67c0a161cbc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105832, "uuid": "522ff056-d34f-4f30-9c01-2eda0db04d9d", "comment": "Malware payload (Mirai)", "value": "a3a12c87d1a7b6db8dd90d17ed5de0ef8f2cc876997f1d4c3536b781617ab2301c32edd9ce556e5e76fb4358e73e0dd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105832, "uuid": "b000f7ad-ab6c-4ce7-b71f-4c3d09ead0aa", "value": "T194154B07BF805FEBC49FCE34492EC31610EDE89752C1A62971FC8A9CBA593594EC7498", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105832, "uuid": "7cc507ae-3b92-4356-93a6-cf659cbb9883", "value": "12288:axSw/I+R56nEIQn83A00ayP810/W4dvFCNR6B2em2lyyQ9BdBlhMLlA+7RCw0Poj:7aI65gBsEQw4yFDUXlcpf2/7hEQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105832, "uuid": "726f27cf-f5e6-4598-b871-e1e90df1f513", "value": 909336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105832, "uuid": "aaf21490-8be3-4160-ba92-3a4390039966", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105832, "uuid": "9e6a4c39-3a70-43dd-8e42-0aaf48550fc2", "value": "bot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c1b7cab-6509-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781122710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781122710, "uuid": "9f9bc613-68d7-4021-b0c6-b73addcf6a60", "comment": "Malware payload", "value": "c824c9e128a63f26ea65508a2572e12c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781122710, "uuid": "edd06cfa-032a-493c-8780-ef55d6fadf06", "comment": "Malware payload", "value": "01262fe94f63ae9b41e8a06e45f3bdb4aed3a7a83baaf24610e7d75e0c7fe777", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781122710, "uuid": "2fc76485-3725-4807-8ec7-6b61855a0374", "comment": "Malware payload", "value": "0a1df6da5d3db869b482db0a97cfa38147d207e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781122710, "uuid": "85cbb905-1b8a-405b-a2f1-f4c76a0a0bb8", "comment": "Malware payload", "value": "7d184b7ef1ec114f9eda1720603eb37c25b433e3dd175e20eaa1ae417d3985014c2b7eea4945c52901bcdebd02118a57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781122710, "uuid": "6e75a517-7f1c-41ee-af97-7b0bfd4b5754", "value": "T1D5B39EDFF24B5560C8268BF01BC74BDE3E2363118E17D8E72C1EA23A24756CB590A791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781122710, "uuid": "cf979b17-2b31-4496-8b87-7c0b8161d1aa", "value": "1536:Smalq4ysL++tVhd94Ajto3YeFtQdxFWaFv60H1c1gUI/LWi:SD++tHf4Ajt2lDy+K60H1c1gJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781122710, "uuid": "8b3151eb-69ca-4fdf-b63f-5bbfa8bdd68d", "value": 107672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781122710, "uuid": "2bb28016-f7ed-432a-947c-46fbdc18c637", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781122710, "uuid": "e7253476-8cbb-405e-a1b4-388c39ca4864", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f849135-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1781108864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108864, "uuid": "cba5ef8e-299e-4489-8bfa-c2ce53a5c198", "comment": "Malware payload (MassLogger)", "value": "e448fbf4aacc62cdd17ce0dfe9a28b43", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108864, "uuid": "f4f485c1-1862-4f59-825e-d867648ba41e", "comment": "Malware payload (MassLogger)", "value": "018fe5bd0c2101c546959da962776443c83e5ed6f7c9d5aaf621ddde3e985904", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108864, "uuid": "76f87a57-bf65-49fd-90ef-08f38de85cd7", "comment": "Malware payload (MassLogger)", "value": "f1de43b3408146e65aa1fc459c16aa79801a9fd4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108864, "uuid": "befd002f-e6f9-4673-91b7-9fd39baf77a2", "comment": "Malware payload (MassLogger)", "value": "36eeba3b7a6b729134f69ffccda8a7bcd77696325735e41d23ec59bfd62c8d45274dbc333a9c9e78fd3923d04fe51b14", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108864, "uuid": "85bb164c-dd7a-430c-b493-703e0d3723f2", "value": "T137F4E73DCD54412DE172D729C59A085FF8822A0B623CD84B65CA274FAF739427BD236E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108864, "uuid": "114b82f1-bb06-4aa0-bdbb-bd573a14fd9a", "value": "3072:j6pNdg9EumD06x23CV7u0xGoop+XWfRPTKLElBnB3tIOH2h3z+I+FIffI7YnV8w/:Mjx2yh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108864, "uuid": "5ddcdeb2-d484-40c1-8af6-a0958da1606d", "value": 788344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108864, "uuid": "6b527145-27a1-432b-ad42-b5057f87b705", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108864, "uuid": "01884974-006e-49dd-9c2e-422c175c82c5", "value": "Recibos de pago_2958_2026_06_10.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5327695c-6472-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781057760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057760, "uuid": "972b8275-2e27-411f-a1ae-8148ad91a7d6", "comment": "Malware payload (Mirai)", "value": "d0e707adf6a0bef1956be81e486dce4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057760, "uuid": "8619f866-eb97-43a2-a250-128de7f86fd4", "comment": "Malware payload (Mirai)", "value": "01f17f3ed0270cbed16850896ccf77d0bdb4b7172939706fe808abcf526b04cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057760, "uuid": "2e451aa4-7dc0-4aee-b3ce-01acab14a8f6", "comment": "Malware payload (Mirai)", "value": "499b7a6c801d8d85093d7c38bb3d1f99553c3e3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057760, "uuid": "9ef09d60-a965-4f64-99ff-4049ca9c6bd5", "comment": "Malware payload (Mirai)", "value": "357c0ded67ac313ee55c3733dd08d24a8b3262bf7d89331d63b29a64ae6bef4cb8f57cb157f2fc1c9ee02be13ade734d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781057760, "uuid": "1246b1a7-820d-4936-add9-d98510d3a577", "value": "T16253F148C3A69ECADD0F547B103FCB4E34142948F4B961D1A8D4262AD646F8D24F6EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781057760, "uuid": "1895f1a7-109f-4c5a-ab2a-132c9fee569b", "value": "1536:h5hVkImxwU0uI7K0vagfmi4WUo5025Usnouy8B88:LjX9U0W0v9uivLOaUsoutB88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781057760, "uuid": "c3eff1b5-4f3d-4679-9d99-a5790661c477", "value": 63184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781057760, "uuid": "ed3fcee5-d816-49ad-8794-c591c6dab333", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781057760, "uuid": "b767a7e8-2cce-47de-8d29-45cb5efa0631", "value": "wife.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "814efcb2-6493-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781072011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072011, "uuid": "62f8eddc-9e4c-47eb-8674-0ab2acd3d194", "comment": "Malware payload (Gafgyt)", "value": "10375499b12451e64b3eb0cf4a794832", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072011, "uuid": "7edf8806-2260-43ab-8564-5463408965d0", "comment": "Malware payload (Gafgyt)", "value": "02b7d1888db3b35632e9d3df853eca132edd42ce370d2643eedec848ece5f281", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072011, "uuid": "f594d100-359a-4596-a0d7-022636bd6802", "comment": "Malware payload (Gafgyt)", "value": "c02e580259f734d013e6b132b17cd2849dcd955e", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072011, "uuid": "74320d94-bf47-4486-b0dd-e7ea284be03c", "comment": "Malware payload (Gafgyt)", "value": "97f62c5d77f60061df74e1716ef905ee56f67ebb4ddacde9ed88389b175efb9f18da27010057246ecf13b9a56772965d", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072011, "uuid": "c108c5dd-a07a-4f4b-a0b9-6eeec84421d1", "value": "T104A32A26BD018F53C2C315F3BB9F47887B2667F9D2EF3203E925AFA027564D60926950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072011, "uuid": "1c8c6f66-afe9-4a7d-a68b-d3a127f630a6", "value": "1536:LqusRrhgLj9YwnFapnidqFR9K91fCL8r/OQ/WeUyNj4qG739y5hdppNq:Lqd0/99FYfY9e895d4XbM5hdppNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072011, "uuid": "3bbc1aee-38cb-4676-a86c-d1f531d96a4d", "value": 104272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072011, "uuid": "7e09a37f-f7ad-4ed8-b942-0b32cb2216ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072011, "uuid": "c951b382-8f83-4e36-be54-2e1d319e2268", "value": "FBI.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f49cb6-6494-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781072267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072267, "uuid": "b1a01687-715d-4b2e-9d41-1798fd224035", "comment": "Malware payload (ConnectWise)", "value": "b79239fad2ef36602ff04ff29a6b779e", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072267, "uuid": "18607ea0-8227-432f-9a81-ce5e2a8d8048", "comment": "Malware payload (ConnectWise)", "value": "02eabcc8164ace33666f6de0901cd13510cd8fb1b8deab757ee2d91922770b30", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072267, "uuid": "176628de-ed30-44d0-979c-3138f7899483", "comment": "Malware payload (ConnectWise)", "value": "e669177d8600b54e30dd775289cd8d74e0f546cd", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072267, "uuid": "c386a033-dd16-4553-91e6-b10d6b59104b", "comment": "Malware payload (ConnectWise)", "value": "df4cee3b903d9cc99bec9e966190fcd9f7c0652f410b4bcb14de7a9ecac1ecbd36dbc785a95e5aff96f1de90190eee9c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072267, "uuid": "6f3c7668-7154-4a26-98b9-89b67c89c2b8", "value": "T111646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072267, "uuid": "4f0c38e6-2914-428d-893a-4dfeb41689b8", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072267, "uuid": "c0af0eca-9656-4119-984d-7aa29f538b33", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:h1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072267, "uuid": "8f8bd466-3f45-4a1e-829e-c2d71b838ed8", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072267, "uuid": "bcf6cb3d-5352-41da-855d-25262387ed37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072267, "uuid": "72fb2390-ee13-4752-a2ae-308b789d2b09", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec492822-64c3-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1781092807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781092807, "uuid": "9b97944c-8662-4c20-ade5-07e9dbf314e5", "comment": "Malware payload (ValleyRAT)", "value": "68452227d4859a6148bf486ac68bdf27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781092807, "uuid": "2eccc154-c07f-4fd5-b769-263092e71669", "comment": "Malware payload (ValleyRAT)", "value": "032e1d550d78270eca2815941833c288d09dcbbfb9e8360d30971d5ee013f509", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781092807, "uuid": "b3b8590f-412e-4678-b397-d39a8dea6328", "comment": "Malware payload (ValleyRAT)", "value": "63c620dcfdb59a376923fa8bb4a14e3f45a32453", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781092807, "uuid": "2ee23bd8-743e-40bb-848b-bd417adea582", "comment": "Malware payload (ValleyRAT)", "value": "ea436df08c4f2417d24c3283413972f87b8b7c5a72fdb087073156044ac31fae2b30f203bc6e99542d8515883d9fa7be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781092807, "uuid": "c0861293-db0c-43b6-9e26-0aa730948f00", "value": "T124063A3BB2A8D16DE15EC23EC1A34F15D433B0B55773C2E756A142AA2F069D85F3E221", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781092807, "uuid": "29d2fb0f-1822-4f80-889d-20b7f62a8ccd", "value": "7e99e63d64f89537a8f3c005ef2409e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781092807, "uuid": "ba7b50bb-d61d-45e6-aecc-35d39e4a8b5b", "value": "49152:N9b/2ERs83eklvy0UkfvvdvORjzsa4RTY6oA74+RFWwhrBj22qT0z0lMlIYQTcl7:faEVV79ANjRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781092807, "uuid": "49b6e140-de2d-4576-8c46-db461a48c67c", "value": 3734528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781092807, "uuid": "7746699e-6b26-448b-ba9f-a529e7ddfbe9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781092807, "uuid": "e5e9c681-9538-4351-8eee-14a2df936d08", "value": "DingdTalk_Setup901240.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "febee96b-64a4-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781079523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079523, "uuid": "6950fcf1-6b06-4057-b3e6-fb568acc1c4c", "comment": "Malware payload (RemcosRAT)", "value": "627300872827abb61aeb8847f932a457", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079523, "uuid": "6d9cdf40-cf12-4d99-b4d3-9f2d7418e09b", "comment": "Malware payload (RemcosRAT)", "value": "03c9c346ca945633ade8b74bce48bb4e81b15c46d7f4627d969b850554e9b74c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079523, "uuid": "760b0522-0f37-4fdc-9911-8b4bac1a6c12", "comment": "Malware payload (RemcosRAT)", "value": "1ca572f9ec7543f5054bd9b123cfb6a6ffe810d7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079523, "uuid": "db63455c-6d26-4d8d-be66-d30c403ed783", "comment": "Malware payload (RemcosRAT)", "value": "c868cc60e0961ed497bb39e88df2c4b2b603f2029917a4f03a8a28b431aca7e48458a89912d03c6c6c73fd6b713c4080", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079523, "uuid": "601a6f85-e866-4d73-adf9-0cd88231840d", "value": "T1EB365B17D66F974E18093B51006A5D9AFE89CAFCEF72BBC4E0CF90B610EA1110B855B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079523, "uuid": "bf23ad94-2309-498d-bdb7-1c2af82ed015", "value": "49152:Lx+ZCnvHo8YGHv5LbQMP4zrCIzU4f8eb4NEL3ar/0pKIoxccz9Uelq/Djh3VcAD/:k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079523, "uuid": "7de12f02-da79-487d-8bec-19802f3a126e", "value": 5026531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079523, "uuid": "2743e62c-dbc0-45f7-a3fc-7c2c1f788758", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079523, "uuid": "3ec07d4f-9830-46d6-8396-5877831a4d5b", "value": "Enquiry.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e38c195-64dc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781103198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103198, "uuid": "e13055f1-c7e9-49fe-b122-61ac828a928f", "comment": "Malware payload", "value": "972e40294e7b829fee2e5417924c1799", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103198, "uuid": "ed1b7dd2-5f46-41ec-a5e8-ada234d05272", "comment": "Malware payload", "value": "03d2902a6b740ad84fdbddc169bd111c5d0a759a70a9124269c811e5081f979a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103198, "uuid": "7f908df5-708f-470e-92e5-93b5d4449b2c", "comment": "Malware payload", "value": "71f31295bed845cf92f1d14cb5fd41c7ff785ea4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103198, "uuid": "5efbcbab-815d-4759-872d-f7980ed09bc0", "comment": "Malware payload", "value": "cfa49e1f040627fcb8f99a45844cf6c48188e19c8f5325dc821179f74a07feffdce510809af30ac2086c90b6d3a51ab8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781103198, "uuid": "507fd68c-4ca0-4668-bdbb-0c4490f91c8a", "value": "T184136C6566853C28AE9998371D7E1F0CBDAA83E2310491DDBFCA3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781103198, "uuid": "0bddb875-0b52-47a2-82fd-d7a3cc635d24", "value": "768:PXRWNGxV19GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:plx0co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781103198, "uuid": "14ec1fe7-fc34-4520-b9e2-6c044cbde3b0", "value": 45521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781103198, "uuid": "cad35f28-8860-40d4-9d7f-229004dad2e3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781103198, "uuid": "a8b9ebbd-186c-420c-8c0e-058f67a59eac", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a27dbad-6515-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1781127726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781127726, "uuid": "07c79d44-de98-432d-8130-12a4554a5b31", "comment": "Malware payload (SalatStealer)", "value": "7f0e207d79c0468215e79146bbcf118a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781127726, "uuid": "9eb49ec2-a73b-4535-8a2f-29e3b001fa3c", "comment": "Malware payload (SalatStealer)", "value": "04520ba8357973055e714e7aebcb7f5710ffe74baf0682efb4a0c436e44fbbd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781127726, "uuid": "0684b5f0-a61c-4005-b902-11355e028f75", "comment": "Malware payload (SalatStealer)", "value": "c9383eb5ccd89ce54ae1616c1d2f0cb7669cb7c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781127726, "uuid": "23a7c043-cdd1-4a82-ad02-0516478fec49", "comment": "Malware payload (SalatStealer)", "value": "a62a5d322a5ee18da494f879b3fbe4ccb3f196a28b7a41a2a2b6e0acffbfad3c4085cb6f2f180f151b650e824b10f0f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781127726, "uuid": "2ebd4b64-6a74-4934-8752-1fe52f8adb3e", "value": "T1BDF53311BEC2280CCC98D879F1BBAF79E0AB78A4E97042372754C7D76EF51C9029592D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781127726, "uuid": "b71a1ee4-d631-42ff-96b1-c107756c477d", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781127726, "uuid": "0c425a50-7774-4f3e-ab78-ea8316100414", "value": "98304:5XuNNdxR0TbTxfFOSFaIc238cBKCQaG1W2BX:5+Nzx6DJFOSFPcAJHJG1Wa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781127726, "uuid": "e67db669-cdb4-47d3-ad1d-a6ba2a8be5a8", "value": 3594752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781127726, "uuid": "cc1ead63-80b1-493f-a99b-292a5d354b2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781127726, "uuid": "93291a7c-0e1d-4604-85c0-16e232d0323e", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "847d7f60-64b9-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1781088337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781088337, "uuid": "49614e4d-e363-4d37-8a17-971798c5cea4", "comment": "Malware payload (AsyncRAT)", "value": "edbf6050801a49a4700ed466f3953964", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781088337, "uuid": "11931b84-3497-47ee-9bb4-7d667bc9ae2f", "comment": "Malware payload (AsyncRAT)", "value": "04a93feba4c974ab3c7fe203d68f78bc3b8b395492fdecc0b3fefadfd74dcac4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781088337, "uuid": "73bad06e-dbe8-4ec6-b412-00bcc3cdbea2", "comment": "Malware payload (AsyncRAT)", "value": "e13ad8dfd75146975e5f5dacd0ba86135227c799", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781088337, "uuid": "0cc8a476-638b-4e22-8dac-f9d9af7476fa", "comment": "Malware payload (AsyncRAT)", "value": "940b5b7c0d5745fc1f40b5c53d59dcbe50edfa48a03e9a4bd41fd89340c0c6e299b93a1347814181f4072b66022fdd21", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781088337, "uuid": "a3d625da-babd-4344-bd0f-1eb6e7d88fd7", "value": "T14FD23A0833D98691D2FE4A7D4873C6148376E6974E13DB9A6FC4909E2E237C8CE14BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781088337, "uuid": "54cbaf51-6814-475d-aeff-59d29985a637", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781088337, "uuid": "fa394e7b-7d8d-419c-8b0d-68a3ebb3a84f", "value": "384:4OARLVZsLqm+TD8uoAl6eDOS3H9qbuUs1QxnCJfTKzFdnjJUf99E:xAJULl+TwuoAMKIb7BuKzFE99E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781088337, "uuid": "10ef8b39-1497-4eb8-876e-17dea6d34256", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781088337, "uuid": "6d7e80d0-a862-4cc7-ab6f-11b5312e6a1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781088337, "uuid": "d638beba-f7f5-4ae3-bb06-34da0eb23baf", "value": "hitclub.nagoya_33542079_s_flash-player.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1ad50d-6494-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781072268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072268, "uuid": "b87086d9-2a52-4eb8-b277-39349c409b52", "comment": "Malware payload (ConnectWise)", "value": "98823de847446d0ffb86ee526e52219d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072268, "uuid": "9de60b5f-d482-4467-b705-f831fff0f60b", "comment": "Malware payload (ConnectWise)", "value": "04cf97ba76fc662951f4000368a22ffadcc53084e5e2a5dd6f1d0c9c0240014c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072268, "uuid": "c1d59ce3-e911-43aa-b2ca-e92c088ba749", "comment": "Malware payload (ConnectWise)", "value": "668268a0d5fde7be5d3553d410137ab87b6bc779", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072268, "uuid": "0475aaed-3c40-457c-9169-2c098d7f225f", "comment": "Malware payload (ConnectWise)", "value": "fafe39d8ce3157f33bd07185969cb0a3e8f183626f0b55f381725ade2127fe89cba43454aab6abcb8f2bd0fd69316f47", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072268, "uuid": "af60d64a-7e0f-4860-8e09-bd26ec8b98a1", "value": "T1C446E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072268, "uuid": "aa063960-aedc-4c61-94fa-080fc15bf208", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072268, "uuid": "433fc09a-af83-46f3-bfec-ddae32e6973c", "value": "98304:/zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:/hfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072268, "uuid": "f9509024-f787-4bce-ac47-c8403e23007b", "value": 5642920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072268, "uuid": "68469a6c-0906-42e6-81e0-1f361c841075", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072268, "uuid": "5511a0db-32f6-4694-9251-ba6efcad2635", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b792c6-64d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781101795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101795, "uuid": "5bc0ac55-881e-4107-9e7e-eae1f071d6a5", "comment": "Malware payload (Mirai)", "value": "8013896443ca67bfe9c7381fd9603375", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101795, "uuid": "58ce6256-cb89-42a2-a5c6-22a435201205", "comment": "Malware payload (Mirai)", "value": "05503ce4d259d2ae8508ebdb81b0c238d424d941df3c5aeffdb265de89d221ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101795, "uuid": "bc6d2681-0c59-4540-921b-95e4eb605d89", "comment": "Malware payload (Mirai)", "value": "7989745c878a515af755b87622e4ab4e269abca2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101795, "uuid": "0756f407-d514-4d77-8b74-645f8784a53d", "comment": "Malware payload (Mirai)", "value": "2fd8fb8cb96f01262334971b6511d1da9329cab9f950909a2b78dc9f3f69afd1f546fd989c5bdc6a1b77efe819f87c74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101795, "uuid": "189e9139-3bce-4788-98fd-ba85a2439767", "value": "T1A2C3F8C7F900D9FAF80AE7364853440AB230BBA245919A377257352FED7A1D90477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101795, "uuid": "48f78bb2-c307-4392-8e3f-3e268614f555", "value": "3072:0K7M1pk3kzRgVFjbidLEwOsLERzh6tTyfa/7:9MjkUzR3LdSl8yfM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781101795, "uuid": "87cb0ca9-b9be-4c6f-946e-f3c91697a988", "value": 125996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781101795, "uuid": "60879e8b-4e76-4824-9abc-6a954e2eddc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101795, "uuid": "29019175-8a2a-44b2-8009-833229272756", "value": "zero.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53d63da-64a0-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1781077789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077789, "uuid": "f46b95b8-8599-47dc-ae74-a9e174ac176d", "comment": "Malware payload (NetSupport)", "value": "528655dac7f465c8b070bb6b221edfdf", "object_relation": "md5", "Tag": [ { "name": "151-243-18-118", "colour": "#0A1188", "exportable": true, "hide_tag": false }, { "name": "checkpick-net", "colour": "#C1DBC0", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "southfars-net", "colour": "#AC6030", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077789, "uuid": "dd2ff296-e8d7-4c94-9baf-9a29ca630a63", "comment": "Malware payload (NetSupport)", "value": "05b353ed4f73c37ed2abf4aec0f5cf0d130375580d2991c57780fa37df2f9e90", "object_relation": "sha256", "Tag": [ { "name": "151-243-18-118", "colour": "#0A1188", "exportable": true, "hide_tag": false }, { "name": "checkpick-net", "colour": "#C1DBC0", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "southfars-net", "colour": "#AC6030", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077789, "uuid": "5dff4aa2-e6d5-4589-b38b-c9d1e500cb20", "comment": "Malware payload (NetSupport)", "value": "c21e66fbec4149ca7410bd55fd2db062e3d13b8d", "object_relation": "sha1", "Tag": [ { "name": "151-243-18-118", "colour": "#0A1188", "exportable": true, "hide_tag": false }, { "name": "checkpick-net", "colour": "#C1DBC0", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "southfars-net", "colour": "#AC6030", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077789, "uuid": "a7f13d4b-a28d-4e81-b374-f6fb4ce9c37e", "comment": "Malware payload (NetSupport)", "value": "c9bfea0f46c71410b20d7ca53573df553a281550ae6518ad1b239d5ef547174a84a9020aa2d39a19c435529fec7d4bdc", "object_relation": "sha3-384", "Tag": [ { "name": "151-243-18-118", "colour": "#0A1188", "exportable": true, "hide_tag": false }, { "name": "checkpick-net", "colour": "#C1DBC0", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "southfars-net", "colour": "#AC6030", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077789, "uuid": "f4d08de2-f4a6-4bbd-b35d-a9bcf575f677", "value": "T1E636334A5E0C068BD8DF0EF884591B39C3763C90D2ADF482A5F2475A5C9EB9B43B435B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077789, "uuid": "6b134892-801c-486d-aae0-14deed6dbe37", "value": "98304:xw8MZEoPPwWBUWxknaAItkx4oquRdItuShVy/VYj3b2+30/wB4VO:OZ3PFBU4knaAItkrHSOQy/2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781077789, "uuid": "da92d16f-4a25-4b47-98f7-048f40829f8e", "value": 4879236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781077789, "uuid": "cf197c2f-6ac6-4284-8612-ca434d5c0817", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077789, "uuid": "4a7d9192-aa37-4e60-802e-d5e751ab9398", "value": "05b353ed4f73c37ed2abf4aec0f5cf0d130375580d2991c57780fa37df2f9e90.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c477a2a-64a5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781079626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079626, "uuid": "0bcf1b55-b22d-427c-9ba4-90bad8bd1716", "comment": "Malware payload", "value": "ec150ccfaa1c263eab5c5c74ea456ac7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079626, "uuid": "80460c2b-7145-4096-8208-6bee145f4b34", "comment": "Malware payload", "value": "06e9c47043312490c3fb042cd61a8960f303a48d9c535f1352dc4ee3c4eb2ff5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079626, "uuid": "3d3416a4-2beb-41df-855a-fcfcd96ebd3d", "comment": "Malware payload", "value": "a250fc39b25e69bfda45a4b0791bb09069edd173", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079626, "uuid": "bf041dec-30a8-4090-b37a-eee609fe08a2", "comment": "Malware payload", "value": "a935b15dfa6781d3848878335577af4aa7c688e0526a5294d752a0c58227a5382d975a4f370d6e24a4162b157e2da05c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079626, "uuid": "6af6808b-90c3-4498-8f0c-0465d269928b", "value": "T14605C73DC918412EE531D129C49A056FF9922A4B213CD90760CA7B5FAFA388677C73DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079626, "uuid": "b50149b8-f8e9-4821-a2f8-65336830b58b", "value": "3072:Oioq3rd0mLBgXFTa9s9gupuYQOoXRzm3n/rUVcFqqmDm+U9EMc+88B6sX7TVujFV:jeZW9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079626, "uuid": "9d2de539-8e4e-4fa1-a0e9-42e2939fec3c", "value": 805532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079626, "uuid": "cdb15bd5-766e-4b56-8d55-6e265a34b35d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079626, "uuid": "89a019c1-c1de-48cb-98f5-1cad45103007", "value": "PROFORMA INV RAFEEQ TRADING #270427.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b552001-64a6-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1781080081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080081, "uuid": "a0b50a83-1daf-4d74-bc47-16e4e9a2614c", "comment": "Malware payload (njrat)", "value": "6e3671b269e86ca7b650e604f349a694", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080081, "uuid": "e0a04ef2-2ba8-49d7-bd61-88aa3de031bc", "comment": "Malware payload (njrat)", "value": "07164abc29808496512fd7c9fbb120375bfadff0eedc3c7b4f0d0a1ab5291548", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080081, "uuid": "976ee198-12d1-478f-a028-6bbbe6864315", "comment": "Malware payload (njrat)", "value": "93e247d9d20c945c8f070525ff5d587186870493", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080081, "uuid": "db97a78b-e397-48bf-b03c-f3eeb0dd6951", "comment": "Malware payload (njrat)", "value": "441a97e22dc772bd08fe13b0396cd337104c57bf76aef4056018052462016b23e131154153119e2f939fb68398f1cd4a", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080081, "uuid": "4b4e2f49-1a55-479e-b568-9b0992b2f8d7", "value": "T125A56BBA481D8541EB6A79AEA1F4CD0C2C02D58619277F4FBFD502AC43F25DD82F960E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080081, "uuid": "25e4afdf-c4f5-4b00-ad59-7a59da995618", "value": "3072:G4v4v4v4v4v4v4v4v4v4v4v4v4v4v4v4v4v4v4v4v4v4v4v4v4v4v4v4v4v4v4vY:aJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781080081, "uuid": "f7e6315f-5927-48e8-81e0-f632ed3bdc5c", "value": 2209876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781080081, "uuid": "8841e9a8-d829-48dc-8364-db0c4026d32d", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080081, "uuid": "9da371e4-f9bc-4783-95d5-669cadbd91cc", "value": "RFQ & Description B35O-18342.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d92e64cb-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105659, "uuid": "dd08fb8b-8a9c-4b73-b638-1b02ab84874d", "comment": "Malware payload (Mirai)", "value": "99becfdac525f237d06650f4af7bec97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105659, "uuid": "0adcf835-5576-4314-a3e2-6ee06512197d", "comment": "Malware payload (Mirai)", "value": "077116a9f9e2ce05363b0862d575590c0460ede22cfec2b69177569e03e1fb9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105659, "uuid": "d50f2aa4-e2ac-447f-8ab6-38cb0c8751f9", "comment": "Malware payload (Mirai)", "value": "314ad81010650ecd8bbe786c8cbce89688e08e02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105659, "uuid": "0da82c7e-dbcd-4ad7-bd45-415995450345", "comment": "Malware payload (Mirai)", "value": "73eccf939c1266893f8be3a6d6024aa456570ea38b5faaac27d806a4605cf3f0ee82aaf1e00c67859e5d060a87d198cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105659, "uuid": "996e7ee7-88ce-4b80-afc5-89f85e508153", "value": "T14DC3E81E7E258F7DF2AD833447BB8E31A75923C626E1D585D2ACD6102F6024E141FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105659, "uuid": "34fadbbf-4927-4f4d-8718-305032eee862", "value": "1536:py5aBqP7MSCKrylSUIf1+luP0+tWOlg0yEkv1BvMEWCdWEealLbP+h380j:IaOulLUUogcQ9BvMEWSWC2h380j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105659, "uuid": "88e50616-3870-4b49-822b-8debfbd61e50", "value": 120404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105659, "uuid": "5eb13b1a-fcd0-40a9-9fb8-cdea2bf2838b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105659, "uuid": "5ac901b9-d553-44e3-ba17-e73385553710", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe26b79a-64f8-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1781115600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781115600, "uuid": "0c26321e-9b97-4061-8fc8-aa0e56385246", "comment": "Malware payload (SalatStealer)", "value": "0bd53dc12a5b3f2d71631649dfb8a5cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781115600, "uuid": "4684e1d9-a039-4923-aaaf-f356ab20aa3b", "comment": "Malware payload (SalatStealer)", "value": "0792da04193cb72263cf16ee80af36682a2ddd6113d13b679880ff632fc3e26c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781115600, "uuid": "36a08ae0-07e2-4524-a6ea-0a08a9a6d6c8", "comment": "Malware payload (SalatStealer)", "value": "80fd134fd0e639fc72406580c6938bf1c12d8b88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781115600, "uuid": "1ba57674-d4f2-4b5e-a46a-c286a0fc93f8", "comment": "Malware payload (SalatStealer)", "value": "4a565df2f2c299a1586045131c00e97b35966ec238dee492da30d396e1bd4f9581e097a397ab91ad3626d5e82a77f0d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781115600, "uuid": "619fbad3-0302-448d-b005-b4a5e95e29e6", "value": "T1C3F533573EF8088EEB8893BE7577A4CC77B39321D465579D8C1C51AA370A436248BA3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781115600, "uuid": "bce18621-7e9b-4dd4-b569-365947d139d4", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781115600, "uuid": "17420250-d9f6-404d-bec1-6add6a5b919e", "value": "98304:OgQYefW/Vt73HdBl24vRVE3ZITIgWEIAADmEPB89:OXVfW/Vt73zJViVEX3EPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781115600, "uuid": "46ceb4d9-56c9-4fb2-a759-9192e14f36c1", "value": 3595264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781115600, "uuid": "63bd2b6a-7df9-41bc-bb26-1a82d14eae31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781115600, "uuid": "6995a767-962e-47fb-8db1-19380b4887a6", "value": "Hydra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7206d248-64a6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781080146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080146, "uuid": "47988275-d380-4f53-bc38-0e7a83007b95", "comment": "Malware payload", "value": "84a138259b4e231fc249dc4c710be48c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080146, "uuid": "bc6c7e1e-36cb-43d0-9428-6ba2f815eebb", "comment": "Malware payload", "value": "07c124ba501a019f63bfd06d42dcb96722b7a1c3ec755d539f5b3b75fa7746cd", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080146, "uuid": "2e717485-1b15-45b9-8787-51772813d46b", "comment": "Malware payload", "value": "8e6d8dd59f67b6b8a5093cf8c83a0c358af214a9", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080146, "uuid": "7c51ae52-71d3-4136-8606-9baf3f0fa8d7", "comment": "Malware payload", "value": "1e1976a1ec5639e29b69e118890a57ecf4cc3edbe54455b78396b3ed878a0c0b54ca6cd9be223af37779693258d6574f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080146, "uuid": "1880c694-41d1-4564-a386-bee8e2a3931a", "value": "T1C8B51966F68A10ECD4A9BEF077CE0FA1A53879C585550E9A1DB1240834F3EE9F7B1B04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080146, "uuid": "bfd8f83d-7e1a-412c-9ef4-9645a715cc9a", "value": "1536:QRNCC+lRY13bsfjOAaRjYkeTvXNv8E/PX6WPX6muVxduCKxYW3rELPapJBIBZPhj:QR4Mu3v8eX68X6mMdJdW3rzJBUNhc8O+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781080146, "uuid": "0a7b7fa2-abf5-4010-b747-aee1ac5f7e07", "value": 2328668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781080146, "uuid": "3652da1a-1dc1-4d7c-ae5d-9eb15dd0141b", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080146, "uuid": "0c9ca381-38cc-4341-bbda-002377a7d14b", "value": "lNV-90887598587726.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5740161-64cb-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781096177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096177, "uuid": "293e0987-511e-4927-8df8-a06063b89c25", "comment": "Malware payload (RemcosRAT)", "value": "1b04fe4384bdb6a61970bfe19d760761", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096177, "uuid": "b719d23f-e65e-4c74-855f-8fca62209e54", "comment": "Malware payload (RemcosRAT)", "value": "0936fdc796ab6de67eae0a4dc605c7c7186f9839e6bc9e124a2c9fea7ea66b02", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096177, "uuid": "0b7bfa7f-2b62-455b-afa0-7198a278cb02", "comment": "Malware payload (RemcosRAT)", "value": "99fe6c38f090f9822d92edd5f121e2d933277d5d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096177, "uuid": "93626ba7-35e8-4023-bc60-9edde171d608", "comment": "Malware payload (RemcosRAT)", "value": "ee465af4c1d945edfe5a4a77eccb8bb5f5d43c8c8b68ca37f5b5898af183d4c7641433207a3c88962a85754666088b40", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096177, "uuid": "df0f6404-6ccf-4a38-b269-51452cd0594d", "value": "T11385977FCB184A51EF34A3BC6F5B84D0F57D4C7A28A1540A7836E9C9DF764420A93AB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096177, "uuid": "1996abad-0765-433d-8006-b864779ba673", "value": "384:Oi1SbZw4A3C/DNCeCOoCall9WNLgy/JNu14CO2XJCatggN+XaiVxwNAasKiJQmVV:ry4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096177, "uuid": "4855ff4f-9936-47c3-8967-4d71b88103d5", "value": 1808600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096177, "uuid": "591af387-0f88-41ea-ab9f-2de2d8c8cf5d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096177, "uuid": "d2454b7d-74c5-4185-9d40-14c60e40ce03", "value": "weneedbestthingswithbetterplacestocomebackgoodfor.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ad25fb-64a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781079211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079211, "uuid": "b6cbb5d3-33d8-4ec5-924a-d79bd24d4c48", "comment": "Malware payload (Formbook)", "value": "032671a0f41dbe202b8d58c92d4ccaec", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079211, "uuid": "45da275d-c2b5-4ae0-8507-5ca7e6dc8337", "comment": "Malware payload (Formbook)", "value": "09a6d54e4d535c003a27d3e3501f13cb6758fab0d17285ebe7928571e82538ea", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079211, "uuid": "672239ce-4c7c-4eba-a17d-a5432ea53854", "comment": "Malware payload (Formbook)", "value": "701f8df5e881c2e5299f76190c9c94f2471f9250", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079211, "uuid": "10d691c4-fb1d-46c0-a87c-87d371fc3a4e", "comment": "Malware payload (Formbook)", "value": "1828b0d34f77e6c80d996afe76127b8d4017e1762f6be8cfa31c0e44568145d74880d478849f72d740a1e65545b97d5b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079211, "uuid": "3b82831f-5139-4b4e-947f-e81a688f706d", "value": "T1FF050A2ED868423EF076C21CC596481FB895298B532CED5720C2375F5EA2846B7D37AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079211, "uuid": "0fa57b2c-89cd-4028-9b8f-5b2030dfa50b", "value": "3072:dKv/qD95TluRc4gNMjCh7sfd5KV3n5XwKOwU5CNRMikUBs+LGB+ijN+GTHnX5qBQ:wq54NBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079211, "uuid": "9ec3e3fe-aa82-4e05-b1e9-731a32d2d023", "value": 801096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079211, "uuid": "6d7f784d-485c-4ac3-9e92-87569d56b9c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079211, "uuid": "17cfc793-17f7-4bca-acee-59baf59050d2", "value": "Payment Advice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "036f9dd5-64a4-11f1-a769-42010a9c0008", "comment": "Malware payload (MintsLoader)", "timestamp": 1781079102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079102, "uuid": "baebc321-3bc2-41dc-a9d7-5d71f53c5eb6", "comment": "Malware payload (MintsLoader)", "value": "c4bce92e43065b0a063a7cc15987afe4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MintsLoader", "colour": "#FEC80E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079102, "uuid": "8186a32a-e971-48e2-a590-da8a7bbf3733", "comment": "Malware payload (MintsLoader)", "value": "09ce94e20c8745950a8bb521d77069f05ef2c631ef4ff35a0f915e2c03c032cd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MintsLoader", "colour": "#FEC80E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079102, "uuid": "c1c888f7-0f96-4403-bfa8-a205111a640e", "comment": "Malware payload (MintsLoader)", "value": "aac64ece67cb0f7c65f5361372f2d160d25f2061", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MintsLoader", "colour": "#FEC80E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079102, "uuid": "05f68b42-6eae-4bf1-a53e-1a751d9d87eb", "comment": "Malware payload (MintsLoader)", "value": "123bec393770a77095bf1bad1ae3a195487849bd9993b9d6ce1ebdabc036a83aafd438d4a9ba28ab66defda6c42b7e2e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MintsLoader", "colour": "#FEC80E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079102, "uuid": "f2ef9e4b-0f91-49de-a01b-f54ff5d74f89", "value": "T182A2D971FB8830AB4BB7130796EE5107D339870AE3126168B61E1F894E1705D47BFAB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079102, "uuid": "e7124370-89b5-4167-9c0e-563532f2d45b", "value": "384:fWDzqHkzqxzqHhxzqHZ0mRn6zqHNzqHUQAlAuZWVjnY+p2+ajNYNvgVuW6C46Cvw:fWDuEuxuBxu0utuxnOjNYNvXWN4NvY9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079102, "uuid": "1403e1aa-4bf7-4e94-a52f-8ba3d37777c5", "value": 22584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079102, "uuid": "3f9c0d1a-b63f-421a-b851-6c43837e347e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079102, "uuid": "0d04e508-bae7-41fb-a509-abb939278abe", "value": "09062026_1232_Fattura258352331.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec99c21-64b4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781086019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781086019, "uuid": "f283adac-39b1-472d-8112-74329429bee4", "comment": "Malware payload (Mirai)", "value": "1fa8a2f5788c830ef10d2c49c7b708f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781086019, "uuid": "ff37c4f4-6bbc-4bcd-8f4d-daa3e1fbfe1f", "comment": "Malware payload (Mirai)", "value": "0ab502b2cc1b8d1a349c144a435a78b68c23fea7b7d45dd767167787feaa5d6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781086019, "uuid": "3819c56d-8779-4130-bf9d-477dac8b583c", "comment": "Malware payload (Mirai)", "value": "e6582c68887199b34e532ed094fadaa9ce7b310c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781086019, "uuid": "0b8be0ca-fed1-4a16-9e3f-575031219847", "comment": "Malware payload (Mirai)", "value": "d14e27113c1fbbf4b996d42eead9e4dc32e5084ecb82aa6d57ebfe069f2d3af8d25835a4605e43041454eea1f2f706b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781086019, "uuid": "5d466a67-fcd2-4500-88c7-8fa747ae7f62", "value": "T110541819AE419F02D1D526FAFBAE828933177BB8D3EE7112D9245F60338A49F0F67141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781086019, "uuid": "bd03ef87-f316-4953-8bcc-5542684e3cb6", "value": "6144:VMqWfHKnRjO6tIz4KpKyM1/4MReNHogQNBdzsaeouXM2hf3ceHyifyo1kWDe:96PeIzrKT/4C+FQNBdIaeLM2hf39Hfya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781086019, "uuid": "e588727f-0bc8-4f39-a62b-e8b559f50922", "value": 281304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781086019, "uuid": "9f783765-9958-449c-87bb-694017ffec5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781086019, "uuid": "d8cd0212-51fd-4e42-aa30-cac978f2d195", "value": "kworkerd-blkcg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427ddd65-6499-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781074483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074483, "uuid": "feb4d3e3-5ac9-4af8-84a5-e500dd23a6ed", "comment": "Malware payload (RemcosRAT)", "value": "4db65b2bf539d39e13f923fb1bb535a9", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074483, "uuid": "da20240f-0e3c-4548-9dc1-7a5f6c26d2cd", "comment": "Malware payload (RemcosRAT)", "value": "0ad147bc9acd3b84d8d64889d319b74793109614b51a65b0e4fed6da1868f1e9", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074483, "uuid": "be830b38-4407-412f-90e3-8c83058905f6", "comment": "Malware payload (RemcosRAT)", "value": "1b42ea1526c5d99962249ca9817ec13216dfdae0", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074483, "uuid": "88f2c677-5a74-48ff-9481-d49005d6b15b", "comment": "Malware payload (RemcosRAT)", "value": "138563245fb026914a59f222a6c21f1c1d1af02c907df3872dce92c6a5819c867e4f5ff2dcc5f55838c9dd28414cda8f", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074483, "uuid": "c4423d74-8069-47c1-a2bb-494a556942b5", "value": "T12E23F87475D5917E87A31B910DAB84A234838DAE9033611CF8CEA0D70B185FB57E396E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074483, "uuid": "c7714dc6-0fc4-41b8-ba8c-9b374d767dd7", "value": "192:fzg15Y8Lj8108tyE15LLd8V8I15W8Opk15W15T84:fn8n8a8Z8V8x8OpR84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781074483, "uuid": "2cb196f5-e531-45c8-9b62-667b82f9878c", "value": 48252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781074483, "uuid": "75830906-de01-48e2-a74d-b20413ed3f88", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074483, "uuid": "162efab3-12fd-4433-b908-908eba9d5e7e", "value": "weneedbestsolutionsforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19619a56-64d5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781100184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100184, "uuid": "95e24f02-aea7-4e16-913f-468e8667ab04", "comment": "Malware payload (Mirai)", "value": "65afe6143eec58be8c5e5b9016b88793", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100184, "uuid": "ae41e480-28ea-431c-b061-a5aa72024691", "comment": "Malware payload (Mirai)", "value": "0af91fdae3b0030439a63186a442bf1f4cbd0a3d95f04389ac933b4edf39dc98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100184, "uuid": "b0e438e7-67a6-4610-b3cb-059c74467f45", "comment": "Malware payload (Mirai)", "value": "6adf9bad50eebe89f51c580fb10f1b31f7ba3502", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100184, "uuid": "28f63dcc-89d6-412e-b674-b30df179535e", "comment": "Malware payload (Mirai)", "value": "86b28da39fb4860f3e7ae4d6caec797e447ea5e77120c44c03707b77f16b2252f6a36a3bb9eff93a0f075a9942efc792", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100184, "uuid": "6773de2c-bc65-49c1-959d-353b0e16b804", "value": "T19C937B8FF24B14A0C85286F01BCB9FCE3E6322A19E5394E73D2D167A18B51DB1D06F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100184, "uuid": "6d54a07a-9fb0-4dd3-88f6-3549dd6d973e", "value": "1536:31WvSRtB0cuznJrmyMXAQ5DsH+6qj5N5gBqF/LWY:FWvSRtB0cuznJrFKT52+6a5N5gBqFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781100184, "uuid": "2fb45d23-7334-4e6c-8845-e67e6956e822", "value": 91420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781100184, "uuid": "87e1da74-1114-4a3f-905b-7de576843c92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100184, "uuid": "3f8f92a0-4bda-4467-a5e1-1f3286498869", "value": "CRY.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c8abc9-64cd-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1781096953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096953, "uuid": "f3eb061a-37c1-48d8-a8cb-0bd404deaf1c", "comment": "Malware payload (BlackMatter)", "value": "f8301f19bd2b18a5f51329e743bd1b06", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096953, "uuid": "f3c6f6af-525a-482d-8472-08e38be9ba75", "comment": "Malware payload (BlackMatter)", "value": "0b525c358266f139dc9b8311f71dc0c93fe36939a8ed8aedcc3dbe510e82269d", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096953, "uuid": "e2b69683-0e9c-4ab8-a1ed-741d258ff186", "comment": "Malware payload (BlackMatter)", "value": "6dbbf16ac51a7211c8cc03822a4e5d7c95653a45", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096953, "uuid": "9c0bda9f-6aec-4521-b6e6-b66d07186bb7", "comment": "Malware payload (BlackMatter)", "value": "6a2a08d23308db87d03b2e697448377663cf9fd990b572840ac8a3781a2d2dc21340755122af3834b476ccd96ea73a8b", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096953, "uuid": "ce6fb4f8-5261-49bf-99b8-ff96d230bfca", "value": "T1CDE36D21F212D0B3C83718F13736B572F39A4D6C29A96847EAD80F9DBC648236F45997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096953, "uuid": "b2bd30a6-9b4d-4423-bdd8-cb5ac2773e05", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096953, "uuid": "ce30d285-986d-420d-81de-3b8a69403cac", "value": "3072:W6glyuxE4GsUPnliByocWepgnruaeSx+G6HNaVr:W6gDBGpvEByocWeirbecFQaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096953, "uuid": "58f1027a-a9b9-45c4-9fba-9d55aa5380ef", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096953, "uuid": "3bdd02ab-97b7-45c3-a8eb-60101fa72621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096953, "uuid": "5132d34d-d14c-42a9-8580-b984b55391ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f6fdde-6494-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781072259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072259, "uuid": "1831c478-227a-4aa4-94d1-20e7ae0e7cca", "comment": "Malware payload (ConnectWise)", "value": "d12aaf47b06eb2871df151bcc9f03179", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072259, "uuid": "baf2f8ad-ca51-4da8-9630-be72feb0dc00", "comment": "Malware payload (ConnectWise)", "value": "0b6ee0ce1266e4d0c4efb665b746af863994920293d1afc136a07a1f44e88b43", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072259, "uuid": "b287d34a-0aac-415d-a0af-bb6f721c4522", "comment": "Malware payload (ConnectWise)", "value": "a609ea2a07db62254a07b4fa959eae5d2fb03bc5", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072259, "uuid": "23aafe73-1e85-4490-b976-2fc357092ef0", "comment": "Malware payload (ConnectWise)", "value": "876740a82e3fdebfd1b7016edb9a1deaa1b4ec4e2fdc355c50dd49930170114764ff2fe014647d67323755aef756987b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072259, "uuid": "a747f76e-74d3-4575-b445-dfedb06947f6", "value": "T1D9646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072259, "uuid": "ba3d4593-4342-491f-bd10-2bda300e0b66", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072259, "uuid": "fb743611-9cba-4c4a-a480-21d826bb03d3", "value": "6144:amlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:p1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072259, "uuid": "4098416f-ac09-4a9f-ba0c-bf08dc33ee4e", "value": 312536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072259, "uuid": "97ded317-2b29-4d81-9189-768235a3a114", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072259, "uuid": "5a30cbfd-6d39-40cf-a1c4-ab53f49e3bdc", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f16b91c-64fd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781117507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781117507, "uuid": "2b77261f-f7e7-4adb-a265-93eb0341d82d", "comment": "Malware payload", "value": "3e4dd5cf56f67c45ecd6ae1858a1a714", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781117507, "uuid": "212d61dd-367d-4e07-81e8-2c996e060125", "comment": "Malware payload", "value": "0b760cf4b6c7546306d2325e75b514a521d3759d4ecdf6668442d2938f466782", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781117507, "uuid": "73ec6bdf-ba8d-481c-b3c0-a86078fb6d5f", "comment": "Malware payload", "value": "16b7b780efb7c654cbfaee9f5bde30792f308178", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781117507, "uuid": "b7ecd9c7-c597-4af0-b4d2-78f7c2edeab1", "comment": "Malware payload", "value": "937d27a6047a90de4e626ab1ef94af4b9738599954747e3965ee63b805d3c57bf6a83d98e57fb51557c4994289297bca", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781117507, "uuid": "01b16a1c-3d58-4b75-8f25-c2b301b9415d", "value": "T165824B0FB8424726C1E100B09636967BDA79A87537C408DBF7D48ADE1AA86D5FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781117507, "uuid": "60beee7d-2b1c-452c-bfc1-f63ee6396db7", "value": "31944fc5dd8a4e2a3b0515f33255f586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781117507, "uuid": "70c994d3-0b65-4f88-aeb7-a232acccc340", "value": "192:RmKaqCngTtXWQQzbytjt0CzSATzl/le6f2vKUSiu9zw+ghSpOgbO5qmEd/FN2GJS:e0W/ytwAN/0bu9JgwHcoav8U9ck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781117507, "uuid": "385c90c2-05d1-45c3-b9c1-a9e750e1f21a", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781117507, "uuid": "e26974f4-eddc-44d5-8eb5-6963137ad920", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781117507, "uuid": "9c4cb0c0-3ae0-4bf1-a927-1a3b6ded1fad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8684fa1-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105658, "uuid": "e2b9274d-b9b5-415d-bd2d-1334789d8729", "comment": "Malware payload (Mirai)", "value": "ba2022a7938d1d6d87913fb3bf7f059e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105658, "uuid": "216ffc28-89b3-48a8-9835-cc337352ed30", "comment": "Malware payload (Mirai)", "value": "0ba9367b846bbcbfef57a14ed9971e6909654d94d89063c5587928de2fc25371", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105658, "uuid": "a92a4ca6-6939-4a14-b99e-bc12fde05456", "comment": "Malware payload (Mirai)", "value": "16724d64aaaba89aa77dc20770b4608e8a2dd4ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105658, "uuid": "3e66d90b-4686-405a-a2f7-b39a4acc2626", "comment": "Malware payload (Mirai)", "value": "726f6464b7731b68bbf7aafcbf75b6f6b29d5526fe3d043d1443c589df9f79bd65a237905449167f1f9697a92a657ec5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105658, "uuid": "6a401a5a-6439-49ae-80f9-ac9641c5b25a", "value": "T1A5E2F1D959FDD976CB908C38ED0F8A4A851F33FEC4BE311227A4B26D2B928113DA5147", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105658, "uuid": "bd69d2a4-0654-4aba-95fb-51e1fc6548cf", "value": "768:J8Lm6COq1fewsvXPiP619tj/ft6G5Wzl9q3UELdo:6LJC6vcs9Rftl5Wz4La", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105658, "uuid": "5350385a-0ea2-4777-9b05-95be4347d02f", "value": 31864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105658, "uuid": "95653633-b6c6-4c8f-b1a0-2f19935891db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105658, "uuid": "f01ee590-3bbf-4d23-80da-13f3cd6b48d1", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce604b9c-6495-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781073000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073000, "uuid": "f81f5eeb-ffbd-4bfc-91a2-bfa5dedaafe8", "comment": "Malware payload (Mirai)", "value": "cb9361d73c3b829900812ed98504ea2d", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073000, "uuid": "ba411369-05e8-4ada-bdb2-11c1f1eb7f18", "comment": "Malware payload (Mirai)", "value": "0c711b6745e5b6f40b84ae3d2824a57dffc6a9ab4b668c276b58c1cf259c6b8b", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073000, "uuid": "d66df205-7273-43f9-9a17-156d4ccda3c9", "comment": "Malware payload (Mirai)", "value": "9d08de1563d46fba3fc0fe404288b78fe0f952bf", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073000, "uuid": "c2fd2cde-2866-41db-96ec-0235006ed09e", "comment": "Malware payload (Mirai)", "value": "db8543b0b928c088dad8cfb0707c5c63f56f3b0d37369899c20c7b9976c4201990c4327c34afc26aa1c81bd17ba0bd5f", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781073000, "uuid": "061c3a5d-724e-4b24-aa63-5dbf1a8bb6f0", "value": "T11E762751FE8B44F2E9030D3105ABB22F67325D064F25DBE3EA407F29F97B992493614A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781073000, "uuid": "c9d147db-3437-4fcd-a856-d8e59476a01f", "value": "49152:iYKyTxnciXYFKrKZq9joESon0D3q/79nK+e0kNRPOT4JFvyHydU6kKm8zTsmrIZ7:lJxZCGFSon02k/POsFvuyqcrtEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781073000, "uuid": "f11833d5-3205-4695-803f-dc051f1eddd2", "value": 7278776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781073000, "uuid": "42969bd7-3f5b-400c-8aca-42f573e65e65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781073000, "uuid": "ac63e69a-c2c7-48e6-b4cb-2084c8d18194", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e76c01-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781108877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108877, "uuid": "ce60ac35-59b1-4e3f-8cf6-db866a75af78", "comment": "Malware payload", "value": "8644e9760de23b103d2ebae392eef929", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108877, "uuid": "5abc82e7-76ea-4258-acee-444c4602aff6", "comment": "Malware payload", "value": "0c8113dd15b7f282a6ad0ebe6987f738428caacd905ae9278da912171be92360", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108877, "uuid": "f97a7f01-32d4-498f-9c6f-89b43e2b8aba", "comment": "Malware payload", "value": "1931bd3fab5249c1f078daea1a959454a289d729", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108877, "uuid": "2c4acd3b-398e-430b-b626-2caa7231f742", "comment": "Malware payload", "value": "59818a194f50668ad88ba7b8daa5391b1abe04c60adf782cb091b85893135ecb06fadcbf1dcd52f50b5cd55699cd9388", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108877, "uuid": "31b420c2-6b86-4961-ad94-5b54bd47a7d4", "value": "T13C11559BEC4CF96A4037609302BBD49DEEC02436A493CC2AB45C9D846F33138CA360CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108877, "uuid": "107ef392-a8ce-4775-b334-95a9258c0f07", "value": "24:9A9TzNo+ffvhMyMF9cFWO2JO2eQIsAuPjLA/MkmFCn1QCn9Jkgf7+y:e9m+ffDWOIOKh4ZyCQ/Kb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108877, "uuid": "4ba7b888-520b-48fd-822f-74dfa7db251d", "value": 893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108877, "uuid": "6bb7531c-2269-4ec9-89e4-55f26b58d941", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108877, "uuid": "d86f748c-767a-499f-a655-d6e315b394b9", "value": "sap_vigilante_guardarcomo.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "817237b3-6510-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781125699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781125699, "uuid": "fa3af974-3a35-4661-bfcf-c47630483407", "comment": "Malware payload (Mirai)", "value": "a9e67c809dab7256bd2712dade98adb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781125699, "uuid": "6bd4760d-3944-4973-89b4-53da78456334", "comment": "Malware payload (Mirai)", "value": "0cb14294dd0613b3b06adf1e3532463c14024d8472b9ef8416ad3aa22e018f78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781125699, "uuid": "c2f46849-5a79-4f8d-95e3-16b4e78690d1", "comment": "Malware payload (Mirai)", "value": "dff8eb9eb80340de3b6a94926e0520026a68801a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781125699, "uuid": "f5817563-ebac-4fd9-8546-05e31a5b378e", "comment": "Malware payload (Mirai)", "value": "63a4303a06bd55b60471f673a1beee4d51de74e328213a1262213d60693467c4149fc3417765e9d91d90ba84ae492b52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781125699, "uuid": "4f1e9d44-dfab-493f-84b2-dde409c884ea", "value": "T13BD44A55F880DFA1C6C12976F65D46AC73174BB9C3EB72068A254B343BE786B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781125699, "uuid": "bcd7ace1-c6bc-402c-8e0f-63bce545b1ec", "value": "12288:xZ79WdeM1ztaK/KAptb/5rQk1djpqjeG+aum4gpOSoy0:xlodeQzP/1QYdNnG5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781125699, "uuid": "b44355f1-5dac-4eca-8a3c-0e3dd94155d9", "value": 644396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781125699, "uuid": "e698e95a-9644-4a39-8902-5c2895aaa796", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781125699, "uuid": "b9d06caa-5091-4624-85f7-fb0f40c1b939", "value": "bot_arm32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a16219-64a5-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781079568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079568, "uuid": "3df2738d-a2f0-458a-b0cf-dfbf1e333c90", "comment": "Malware payload (RemcosRAT)", "value": "2e9ed62ed7b38095e25becf03a0e7ec3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079568, "uuid": "9fa7e02c-c05b-44f4-8f35-f475797c636c", "comment": "Malware payload (RemcosRAT)", "value": "0cda40984c73831b5181a9e9ec9e064bd62631436643d5644b49763b029ef131", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079568, "uuid": "b97f10bd-2672-43fb-b449-d3fa5c27f2ed", "comment": "Malware payload (RemcosRAT)", "value": "bda15c0fd868f3fa5faa9159427739bbf08c827a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079568, "uuid": "864d11fe-e5f3-4bcb-8157-3cb7005cf40c", "comment": "Malware payload (RemcosRAT)", "value": "1e15e6146359c17e15f993cf2f72b720d230035b27f489d45d53a0506faffaf5effa0450b79e97d5b96672eeb5ca6d23", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079568, "uuid": "5b661c60-8014-4520-a76e-223f60d38650", "value": "T1E38685310354C671E3586FD626A9B128640D4DCE98F9AB017A9FC7B5027E932E3BB371", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079568, "uuid": "70de4452-d132-42b8-9d51-2eebd617ec05", "value": "196608:4rlFk05ANqi/HACYuBqOv9I8H1HWBJwYclecn74j9IIbkLf1EwPzmW2HM3xr:KS0aNreIewPr2s3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079568, "uuid": "ba02f239-c59f-4e90-adbc-f6fb9850482d", "value": 8604230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079568, "uuid": "30619d6f-5fa4-46a8-bdbb-7be69d7e89f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079568, "uuid": "d66eb40a-2158-42f6-a074-6722a824cd5e", "value": "Contracts Specifications_ Purchase Order.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "282978ac-64ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781082599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082599, "uuid": "16aa61d4-34a2-4e11-a978-787b8e060911", "comment": "Malware payload", "value": "ff42a02caa6854c3ee49be46dfc587d3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082599, "uuid": "e2e69d42-1a07-4631-badb-a1a346201ebe", "comment": "Malware payload", "value": "0d756fd28abacd2eab10ccc0ac24139c9931436e982838535cfd31e4c6bb6f4c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082599, "uuid": "0f5b0469-5f9c-413f-a0c8-46b4484ee1fa", "comment": "Malware payload", "value": "0e774f55110e9367523a7c10ef38da95d29d8d3b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082599, "uuid": "017d66d6-2f48-4c5d-96c4-d6ec2d91bcb5", "comment": "Malware payload", "value": "c193a45b228fceb44de3ba1618cebd207632ba25a1063e726b0ea46a0ec4b056ab98294dc82f17af0dcc2e1d2ca6d336", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082599, "uuid": "4473dcd3-cddd-4922-bd6b-fa99fd119ee7", "value": "T1693196EB0B1A3A9E1405FAA573751408D060D6DE245FD7E4FFC84D7BB2C85583296B0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082599, "uuid": "6e20a5fb-a3e6-475a-979c-08c4400ecd9a", "value": "24:bdn1ZuUFbB16Hj6HQMAgmhD5MRSMxzVLsXB:bd1ZuUnsuTmcPxzMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781082599, "uuid": "b6329a6c-70ea-4885-91a4-01e0d20c679d", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781082599, "uuid": "01c05816-6749-4de1-8868-c8cfd1e9afc6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082599, "uuid": "fee2ffec-89b7-4ae7-9e41-57b3f3cbbbcd", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59abd952-6511-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781126061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126061, "uuid": "06a3138f-5fce-4c1d-99da-3b3f865370e4", "comment": "Malware payload (Mirai)", "value": "1df47a40a184e8e78e5986bcd299b690", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126061, "uuid": "1a9d7f02-2045-4207-9880-f8568e1ff175", "comment": "Malware payload (Mirai)", "value": "0dba7f0009e42740e53f36fba164824c35871eb98d539c9367adb7217bc0865a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126061, "uuid": "d1b3ae1e-f760-4480-9b3c-0fa6a0f41654", "comment": "Malware payload (Mirai)", "value": "a2dda8a1f0d64391e09fdea40e44dbc742ff00af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126061, "uuid": "640408f4-cfa0-4718-91bd-ffbc32b77bc5", "comment": "Malware payload (Mirai)", "value": "ccdbc7692e58e9196a60ca440e18ccc89d705b425fa65e6f4aa04f8984de3c575a9cc7cd2750debb14a4413b1b503d32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126061, "uuid": "13c2882c-a091-4da3-ba2d-03653b4e45b5", "value": "T111935C89EA42E0F1F45201B56967EBB3D633D435203BE986F3692F31DC62650C7193AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126061, "uuid": "ee95a479-3bb9-443b-b0f6-2ec576853bc8", "value": "1536:B6BgimF+AcqRaYu9jGphHwDyUZ7NT8wLiSxu+iKGj000000000000000Q:zN+AXRaYqGzy7RFLrxu+0j0000000008", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781126061, "uuid": "e3aee87d-9c6c-4b0a-875f-ccbc1d8dc146", "value": 96488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781126061, "uuid": "21c203db-271d-47dd-9f1e-ddf43878577e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126061, "uuid": "e34d661c-8923-4a5a-a904-8a6a3b6adb90", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "118731fa-6498-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781073971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073971, "uuid": "9259526e-2e3c-4c47-b13c-2a2257a53b11", "comment": "Malware payload (AgentTesla)", "value": "94e818956717ffbd35b3c540ef90c0c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073971, "uuid": "90a5313a-7b14-49b3-92dc-6add6e9e7e68", "comment": "Malware payload (AgentTesla)", "value": "0dc464798b0546623ed1412a6a5cbdd3697253b5b62e0d5516fa9e18e16e143d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073971, "uuid": "3722e084-376a-4c98-b8de-fbb7164db1ba", "comment": "Malware payload (AgentTesla)", "value": "534722f97768a7e6f23cd7e7446c8a091c15c1e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073971, "uuid": "1041e2ab-e9a1-44c6-93df-d01f4f4bf375", "comment": "Malware payload (AgentTesla)", "value": "d22a587bf8fb69f4ee4877e6535555aa60723acc18327438fe1cad929515e817607c9145b0734e7258546a408c316402", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781073971, "uuid": "7e878d2c-97b9-40da-bdb0-32bd0c50ba26", "value": "T1CA5412213B94D537EE954B302F74936B9BF6CC2161A19E0723417E2B3FB56C2E90E189", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781073971, "uuid": "de98c93b-84b6-41e4-a694-70648182ff5d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781073971, "uuid": "13a55212-f507-45ed-bd3b-037dfab300b3", "value": "6144:XQ606xEXA9HXPGPkHb87fMp5YA3pMvEE4K/Ycl1FGGRYqze7:qXA9H/5b8w0kpSz7/5l1HRYic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781073971, "uuid": "ae79aab3-3a07-4477-a756-572a2955434c", "value": 300576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781073971, "uuid": "1e84a2f7-af68-4af4-b406-4ac0d1311b3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781073971, "uuid": "68f7c95f-d304-4f06-be6c-a4ec4cab890a", "value": "Invoice00220905226.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474efb0d-64d0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781098113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781098113, "uuid": "d1f3d35b-2b15-4ff8-ae8a-090062e0dba6", "comment": "Malware payload (AgentTesla)", "value": "f71b8c17f523d2d96945dd1038adf4aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781098113, "uuid": "ef8e79a0-c165-46c8-b2a2-a8b2f1fc8325", "comment": "Malware payload (AgentTesla)", "value": "0e8c2f67e2cfbc719f3a432f1fca27727bd2a6dc5350780c886b862c8656e508", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781098113, "uuid": "8fddb0d8-855c-44f1-94f7-c47fb640a2bd", "comment": "Malware payload (AgentTesla)", "value": "1b27a89bd07e437447d2abee5c1d4b80d3dbbb74", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781098113, "uuid": "9f720abe-ee86-4ba3-af87-feed739b03d7", "comment": "Malware payload (AgentTesla)", "value": "e3051c52ea1a3a83f745f6aa6f9fe277840cd837ed2aefbaf98624bc24cc2000d62aecf45a6ca5cb3e28f28b376941ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781098113, "uuid": "64baf24e-2411-4d1c-bcf6-ad4403ec2cbc", "value": "T14595333E733489D141A911B30228DC46BAD5DD83BBF873FD9BDBB6C9929412C588F852", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781098113, "uuid": "22e08de4-9d0c-430d-ab13-eda71d2b0166", "value": "49152:7KPvE32UgsIN8ZhFpVPXqIZYeIgwePzA+O6Rvr:OXEhINIhTVSIGeIVeuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781098113, "uuid": "d6cc16f6-b9fe-499a-922f-36d1a503391f", "value": 1917968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781098113, "uuid": "4f9b8573-b02a-4f19-892e-76268828d668", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781098113, "uuid": "84d4fdc7-2749-409e-92ca-086d42a35c02", "value": "RICHIESTA DI INFORMAZIONI SUL PRODOTTO_3247845.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e233801d-6479-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781061007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781061007, "uuid": "cd0147b5-cd47-4fa0-9b3b-e37f78026ae6", "comment": "Malware payload", "value": "21728de0e20700759577794c08574115", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781061007, "uuid": "090deb59-d091-4139-863d-bc6de7c35e7e", "comment": "Malware payload", "value": "0e958e62fde85bc7034b24d3ceca161972d43e2081b3ab4bd11d4ece3ae12e0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781061007, "uuid": "3d262e35-89ce-4e15-849d-1b33db7d9d3b", "comment": "Malware payload", "value": "a58b8f36a0e3d3ead7f5623703753fa3352dd570", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781061007, "uuid": "6ba81716-2cf7-4bf0-b4f4-f426789b6a7c", "comment": "Malware payload", "value": "eae8de737075600096fc32e95958020a45296aae1f8feb1b5aeae23b488b7aff37bdf18249533e97ab8b179f8fec5310", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781061007, "uuid": "a308330c-69b6-4243-ac81-242675b7c792", "value": "T182938D89E982E4F1F45201B1792BE7B38B33D0366027D983E3692F31DC62650D71A3AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781061007, "uuid": "49af0910-3a57-4f40-ad5a-98ab4d4b7924", "value": "1536:V2KCU4jx+EQTeiOmbH+qMMINVAx/1RLh2sSn0NSuGR:TEQqFmbH+qfZ1F0Jn0NMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781061007, "uuid": "4b18a619-6cbe-4f5d-a854-8c48aac7f490", "value": 92616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781061007, "uuid": "5cd66259-3df7-4a40-b925-40c5e778e9ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781061007, "uuid": "ae599f81-71a4-47ff-8317-2372f332cd3f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b18681-64e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105836, "uuid": "de15ae07-cfc6-474c-8dc6-b363d93d0dee", "comment": "Malware payload (Mirai)", "value": "7708e022776a987890d90a725da0486d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105836, "uuid": "45364e05-a1a0-4442-ae0c-79be95ec3951", "comment": "Malware payload (Mirai)", "value": "0ebe3a6f3af74218be409418a03d6f8f470067e746f444d33a9e1d5309086d94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105836, "uuid": "a39e5494-bcef-4561-8dde-d27e767d6e8f", "comment": "Malware payload (Mirai)", "value": "ab0cf138d44f5ddcbf58472a0b517f7bf9c5c876", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105836, "uuid": "37926c33-670c-4b29-a3c0-d2b8592583dd", "comment": "Malware payload (Mirai)", "value": "421a84895d32c245e4ed1514f5cf80f257cbcdc77b94571812714d14d5a79d7d8de9fc562e2d4a03942fdaae9b9217c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105836, "uuid": "00953602-53eb-4437-b4de-deca4b9b8464", "value": "T17F256B4BB2B374BEC197C534479BCA76A932B46401126E7BA5C4C7302E23E641B1EF76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105836, "uuid": "6fde3bb4-f772-45c9-8d31-2ae362798103", "value": "24576:it46RgaUQzGGnxwr6urMolHUDveNt0vxpZQSM:g46Jtxwr6g0DveN0xpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105836, "uuid": "540e0ef8-9320-4d14-ad8d-4b2d927ee2e6", "value": 1015048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105836, "uuid": "ec91c543-2840-48c1-8af0-0d238d8236eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105836, "uuid": "a1496399-380b-4f64-9a75-7ab1723ad12a", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab73f385-64b2-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackShades)", "timestamp": 1781085396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085396, "uuid": "d9fc5211-489d-4cf8-9f3f-7c9eb7ae1540", "comment": "Malware payload (BlackShades)", "value": "ed5c2ea2f4f3dcfc50228346b229f053", "object_relation": "md5", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085396, "uuid": "9e321f24-b96c-4861-afdb-ee09069edc0c", "comment": "Malware payload (BlackShades)", "value": "0f7448bc71f420f7b696550a46541b9b2c9fb3808fd6dfe9b18b456a9f0cfed4", "object_relation": "sha256", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085396, "uuid": "987641fa-fa49-481c-8d26-3c99ceb23941", "comment": "Malware payload (BlackShades)", "value": "1de41352f5f9f1ccf76f01a56fd6c7ef3c74bf35", "object_relation": "sha1", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085396, "uuid": "0f217c4f-bc2b-4a2f-9f4d-fcbdae33b744", "comment": "Malware payload (BlackShades)", "value": "ab8b3916ae41d7e0133326b76cebd0939debb6edfeb54b42d9cea88f275469b453d3072c72004fce2fbae035bf7a9fd3", "object_relation": "sha3-384", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085396, "uuid": "46f2207f-34de-45a4-8bca-ea081b3b6e29", "value": "T1AEA23B04B7D88715E6FE8BB8ACB753444132F2479C13DB9F0CCA506D5A6A6E0CB50EA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085396, "uuid": "ba596836-e498-4bd7-9912-99e6d07b91b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085396, "uuid": "e52a0944-9ffc-4034-a110-bc6da17a0464", "value": "384:Yx64zd9rh29OPLSUTze4LOLSgr+VwTlDCjqOhZwlk90goJmQ4D/:YA4zd9rs9uGUTfLqlcq890a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781085396, "uuid": "3e369074-6a8c-419d-a9cc-4bb3b2bc8765", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781085396, "uuid": "71fa2d16-65c6-426a-8f98-0ac3a437240b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085396, "uuid": "47164ad7-3888-4d12-af6a-30d30f89146c", "value": "2sn7bt.sa.com_4359631f_h_malwarebytes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d68b61cc-6517-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1781128848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781128848, "uuid": "e23f9a84-3406-4509-ba04-d02912860937", "comment": "Malware payload (Stealc)", "value": "73ce591e873038dcf0d28f416b3b09e1", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781128848, "uuid": "06de74e7-6ef9-49ca-9e88-0557e712959d", "comment": "Malware payload (Stealc)", "value": "0f97b6a0c25560d63a863ff043a9556cb730ed6c8b20916eac98e2b969ab5f48", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781128848, "uuid": "833183d9-1b2f-45e2-94f1-211ed10fe5b8", "comment": "Malware payload (Stealc)", "value": "2440cd3feead9363e85aba77efe621b86ab9a346", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781128848, "uuid": "b081f0f2-11fa-4be9-8255-861b259706be", "comment": "Malware payload (Stealc)", "value": "4fa600625a215d782f1c9f89696f1eec27871fc10afeea9e49fe7e922956a99f48d5ed5eec0f1e6fceafa9b19e35254c", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781128848, "uuid": "c0ad4407-b6ca-4e0f-a4e3-ad167e323368", "value": "T193F47D1AF3A502FCD0BBC178CA524552EB72BC565330A69F03E15A6A1F376906F3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781128848, "uuid": "442779b6-c926-4a82-ab30-918f398710a7", "value": "b45095de49856a47334e76102f8e7be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781128848, "uuid": "f4daaa52-a2f9-4fc4-be81-ca3d2ea005cf", "value": "12288:tpS+Eg4TzvpO0K+w0MOaCIoZXyxBlDetAqxSvvJ:tw+WfvMxL09a9ohyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781128848, "uuid": "ec8b2020-0507-4ef6-a85f-6d1fec59ad9f", "value": 784384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781128848, "uuid": "b8853f85-6cbb-40a0-82a7-da81b7383572", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781128848, "uuid": "65f366f9-8217-4437-a51c-33e8cff77002", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf30afe1-6527-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781135707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781135707, "uuid": "8f8e3dd3-a888-4232-b495-4f9457238828", "comment": "Malware payload (RemcosRAT)", "value": "20e50c44d91f9e0bdc4a24ba67e4c667", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781135707, "uuid": "d2567be3-41e6-434c-8ecd-f3ca750ed396", "comment": "Malware payload (RemcosRAT)", "value": "0fa25fe613da2ec00cd97ac83ccf8e5b510a423ff460be030d71cdc48befc06f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781135707, "uuid": "47b7453f-4446-4057-829b-ee73eba0bd98", "comment": "Malware payload (RemcosRAT)", "value": "70fdfa49a7f29d734c824c6103722328f2b93c42", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781135707, "uuid": "654e6934-72e5-418f-bb6a-022c3a3e96e0", "comment": "Malware payload (RemcosRAT)", "value": "7efb6e51e3d0856be019b80eb0364e170f0b4e235510c3a04b585f9bd305d85754477f436169171595af7308537fba41", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781135707, "uuid": "99b744e9-df0a-4b9e-a54b-61130da211f6", "value": "T1B28696700354C672F3589EE626A97168140D4DCF98F9A7057AAEC7B4127E832E37B7B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781135707, "uuid": "296eaada-84a1-4f42-ac9f-8a9026c35b43", "value": "196608:ugaMvMMdENifvYqJeQtsX370eAJayP9Qo2qrglTOyVmou+6hlmY3o1JEZXzeMSTM:xoN2q5Cmgo2RSTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781135707, "uuid": "c46417cb-695b-45db-b692-b31c93b20ac7", "value": 8604230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781135707, "uuid": "ca036310-e312-4675-872f-24fb713e2434", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781135707, "uuid": "e9dde698-60b7-4357-bc9a-25f7f8f0934e", "value": "2026? 2?? ?? ?? ?.JS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e8082e-6494-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781072336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072336, "uuid": "36e9ef2e-6d9c-4b16-aec0-5c2f22577818", "comment": "Malware payload (Mirai)", "value": "b3571ae46aff9df2447d7058bdd3ec0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072336, "uuid": "df212469-cbc6-4b82-919e-5f6a5f99f233", "comment": "Malware payload (Mirai)", "value": "0fe4e0ea3612811174ddce6f0c9d0c6f520e3a69830b95665c075be0cb952886", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072336, "uuid": "499f288b-9893-44a3-bf72-09fa55afd1e9", "comment": "Malware payload (Mirai)", "value": "f7c7dcaa6ad3cddd2c16291cf26cf7d78d7ef4c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072336, "uuid": "a70cdd2b-ce56-4cdc-a81d-39b87da8376d", "comment": "Malware payload (Mirai)", "value": "576e09c008eb713381cb0dc11bee9057d3d7ea779aea29164ce12a52b553210886cfd01972fa4ed36fde811755e6ec9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072336, "uuid": "97dbd3e1-3037-4976-b9c9-618bfce33312", "value": "T162E3B71A9F510FBBCCBFDD3702A9064239CCA55722A43B753674DA38F54A50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072336, "uuid": "f31dc77a-0c11-4048-8041-b2facc8e9f51", "value": "1536:dcxywf0Yu7BNep6KuEDvbJ/5a3/WVcaOi2wmc0eZGb+SVX2Rij7oJ4ROZ6njEgGp:OxyfYuKU1EVcDi2E7yGRi4Jpdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072336, "uuid": "37b8a3fb-741d-4cff-9fd1-cf406594f05b", "value": 148680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072336, "uuid": "9869dbc8-808b-49fe-9e4b-13616512b16d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072336, "uuid": "0daa4ccc-254e-4f81-81c7-29ebfefdfa7d", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa8af9f-6479-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781060780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781060780, "uuid": "da68df62-13ac-43c0-b3a0-a0f5f6575b96", "comment": "Malware payload", "value": "d41518cd9d7aebdbf61987a62d65f018", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781060780, "uuid": "bf4ea01c-7df2-4f29-a2cc-1d914f9358ae", "comment": "Malware payload", "value": "104c5279c9bd3c860e1790515292ba92eba080eaf193bf3407528230d7295990", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781060780, "uuid": "c32d0c60-d8ca-49ab-8e23-364c932165bd", "comment": "Malware payload", "value": "edc901a49829856622bf24d9732235116127cf5f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781060780, "uuid": "c3757a4b-2378-47a6-80ad-e99a1f1705c6", "comment": "Malware payload", "value": "15f8d0ec935764f367aaf32613023bc5199738271ba6f1c5ba94fc093a29fbf7b625fb5c442eeafd0bffe4aac4e11a35", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781060780, "uuid": "ce27c9f6-665e-4b08-b430-1f95e44b7d71", "value": "T1D431C1C592B159B56EE1AC4B726FCC0D318B79CE1CC99F8968CC30F6A68ED50B844B13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781060780, "uuid": "909c9d11-55ae-411b-ad95-2043995c261f", "value": "12:GLF+2gnvEDLkUe5nuLy+IUBLt2GRLlxM+mKLOh8LC+PLoR+OSL12gZDLmRPQ3LHm:sF+hnvEf2tExJt/ZA1Is+TH/7ZftbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781060780, "uuid": "e63f83e4-87a6-4b88-9aa4-33816de1ac43", "value": 1505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781060780, "uuid": "562cdc76-a096-4d18-bc93-44a1a96055e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781060780, "uuid": "75a2c9d4-681e-4145-8009-d1ff55d5a386", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41dd441b-6476-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781059449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059449, "uuid": "f1742ed1-29c3-4033-aaf0-977ba8a56457", "comment": "Malware payload (Mirai)", "value": "217f67d707329468f653cf158202240f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059449, "uuid": "afc3b6d1-c8bf-459b-abe2-501336ae2402", "comment": "Malware payload (Mirai)", "value": "106aa5a10940ed927a8be55db152b3280571e8b249673cd8d849a07f0948ec4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059449, "uuid": "2a507c9e-58c6-4cfc-be59-e26da1e075e9", "comment": "Malware payload (Mirai)", "value": "f286a89f9ed53b5356dbf47f1df2d3393acdd8b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059449, "uuid": "d9817824-efb1-4a63-8d13-48bc688e5389", "comment": "Malware payload (Mirai)", "value": "a15d52cb6dc1889fd2196f75b4d5a0e6c258836c8cd8663ba7f57bf61da3fd2647ecc117f991b1beb99f160ecff02913", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059449, "uuid": "43b25de7-c2d7-41ae-bbd7-53ce7af8099a", "value": "T15B43F1DC7FAEC6BCD97055BBD228C59D552A6DE8D09C32B227428408E1DB05B23EDE43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059449, "uuid": "07b4b23b-7db4-4a9f-a1ef-34842b3c753b", "value": "768:rsCbw6H7Dy9Z3I+knLP4qa046WDNJzrGwhm6toZQHUcurkRKXQM5Jr1JsAOqyb9Z:QCM6bu7Zk8D049miobrSq5fPyMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781059449, "uuid": "538f93b7-ed23-417c-97b5-ecccd40ddf96", "value": 57132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781059449, "uuid": "c7fea1ab-4af0-4182-8fce-fcabc6502bdd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059449, "uuid": "520bb480-cf54-48be-a260-0ccce73b4ef2", "value": "wife.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa2f2a3-6495-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1781073029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073029, "uuid": "b88ec91a-812e-4170-8d86-0f3cb78afa99", "comment": "Malware payload (DDoSAgent)", "value": "c02c5bfa579c1d0052465a182f497f5d", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073029, "uuid": "d71a6939-ca20-4caa-8a56-49a691f00495", "comment": "Malware payload (DDoSAgent)", "value": "10c3c718dfd59998aec9f0d2ec98c0d8105fa9d0155825617b9ce78a18cf4507", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073029, "uuid": "3f933442-b6fe-4626-8a8e-0b95e3a8d049", "comment": "Malware payload (DDoSAgent)", "value": "45b98ffd004ee72bfa0cf340ff265b5e6498f8f8", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073029, "uuid": "4d51f056-f06b-463d-9144-171a1682f723", "comment": "Malware payload (DDoSAgent)", "value": "13f9561a63c1de40cccebb4ebc233c4d1e08ed3fbfdd75458af58f0291b75479f2ce948b40728afd3b179cf44138736e", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781073029, "uuid": "be93d71d-9b27-4c07-ab49-4d91f66d4779", "value": "T16D861A05BDC52BEAC42C4A7444EAC95522F05D140AF14A7A66A4FFE8BCB62397F47CCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781073029, "uuid": "d3850c12-4b65-431b-b1db-a57205eed9de", "value": "49152:slEygMqkUlGWL8YIu3N6myyA8e3pWwbJJ0Z7coiO35kI+1BI+ZcRq5E3:6saq1yy0pWwbJJ0Z7coiHIqd0gE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781073029, "uuid": "7314b5a9-ba88-49f4-a7d2-d8be1433df35", "value": 8126679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781073029, "uuid": "d647b5f3-a321-418e-ae28-79e5da0ef46f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781073029, "uuid": "6f78862d-7e1d-4058-a36c-e454c529c193", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c22c59b-647e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781062822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781062822, "uuid": "4086df15-59ee-4f55-9db0-0a88bf63f89d", "comment": "Malware payload (Mirai)", "value": "17feb1a912b32f318af38916624fabaa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781062822, "uuid": "8c9ff39c-b020-4551-9d9f-d2552850e7ec", "comment": "Malware payload (Mirai)", "value": "11a9a9abebf986f0549e938b4eafac42a8b37e61b32fc8404edeefdfa14a1fed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781062822, "uuid": "4745b71e-f701-454e-83a1-3871d7eb87f0", "comment": "Malware payload (Mirai)", "value": "e8140b0479be5ad5334427d5b0f6f5c1c5fa4756", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781062822, "uuid": "08c6a7d5-84b1-4056-9a7f-4b829cc57850", "comment": "Malware payload (Mirai)", "value": "f8d8e36879be6f1b0f5b9894308c7b0bce623ecd24266bb9f6084a7bc60eae640edb66ceaf3bb32bd7cdb85f79a5a69c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781062822, "uuid": "c03b7112-6b94-4d12-a627-121cb8a1b8e3", "value": "T124C34973CC366F68D624E574B0708B3D2B93A961818B1FAE55B7C2784087D8DF50A7B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781062822, "uuid": "e0ca05e6-4196-4483-8fad-4e278c4dbfbf", "value": "1536:RJYn428ScJ7ldOoGYO8Y0ZCu94akJWYZ96gKi6PWbyQu444n:meJBkxYOoR4zJWKMniu4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781062822, "uuid": "b95bec6d-ecb9-4f29-964b-0976cef007a1", "value": 127252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781062822, "uuid": "a034aa13-8671-49bd-85ce-15cbc0312f19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781062822, "uuid": "5189f727-3222-45fa-b653-e103a8501e93", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d8d154-6494-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781072281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072281, "uuid": "484fd47f-452f-4ff6-914f-054ebfc33a9e", "comment": "Malware payload (ConnectWise)", "value": "0941db839a7348a736297a571595603b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072281, "uuid": "493e371f-51c7-4e57-aa65-3666e4a2fbb0", "comment": "Malware payload (ConnectWise)", "value": "11b73673fda1fdb2d76dff99684800e3a3d81ce1ff3f84126225ff6652bea3bd", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072281, "uuid": "3e62e496-448d-4426-abeb-315938cb849c", "comment": "Malware payload (ConnectWise)", "value": "e7f434540ab04263f2c4318245e9b7345cae86b2", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072281, "uuid": "7035c373-f769-44cc-a87b-5d28dab33002", "comment": "Malware payload (ConnectWise)", "value": "7808ba0e0620f3298918d6dc5843ccfa966567e44d899a6d2862d56933ab218226b247be00679654b785f9c2b8046e85", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072281, "uuid": "f14005c3-a155-4f65-9bf5-faf9385505ab", "value": "T178836C43B5D18876E9720E3118B1D9B4593FBE110E648EAF3398422E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072281, "uuid": "f838ecc4-0197-47ae-bb82-6cb29bdc9010", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072281, "uuid": "a88d06d7-feac-4c9b-b0cf-5081d07381be", "value": "1536:CxoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYl7OJ1:genkyfPAwiMq0RqRfbaWZJYYlW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072281, "uuid": "3bcc5c0c-a8e6-4514-8f41-97c5e9a84832", "value": 83160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072281, "uuid": "72c2e729-270a-415e-a465-75b90f9369eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072281, "uuid": "192ce04a-6753-4d1d-8f4d-082e9e4ead96", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d45cee-64d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781099690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099690, "uuid": "87028f5a-e8ec-4eea-8438-8235b8e7c72b", "comment": "Malware payload", "value": "c4ac1b5aa602945c0e8d8c8148205137", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099690, "uuid": "84a5d8cc-4a88-4b6f-8830-318ace6211a9", "comment": "Malware payload", "value": "11c6c1093456e9eb949778d8fa9987cc7ffbd678fa2d30268f6e6b2ac2a320fb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099690, "uuid": "f7ba0c66-6af2-4064-98b8-bc210133e8d0", "comment": "Malware payload", "value": "791a6ff8f630ac0d1e91a68fb972a31d126866cd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099690, "uuid": "85110bd3-ff47-4f85-9267-999190131fb3", "comment": "Malware payload", "value": "d8ce8290dc1b17f757b27f3216fe96032ceecd734a62033664d8932eba33c02eda32f05ce65c97166be6fb58cce475b4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099690, "uuid": "5fc9e33b-1570-4068-ad1b-962c4070521e", "value": "T1C9314BE4A1D01BF31ED4CE05BB2359BD60AC40CE7F2EA7D8A46908DD67957C3F188259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099690, "uuid": "bc1771cb-9c25-4aee-aa54-5a2f85430ff6", "value": "24:ZBqglRB0G29BCmnBQs1gBDmMBdTCsCBp1k8dBLETB4bmfSVBz0bsFByU5vBDZUw:/jppsCmBJeDmAd+sCjk8DLYjfSrz4ayI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781099690, "uuid": "a25397fd-9aaf-4d9b-bd0e-91b894f3e846", "value": 1449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781099690, "uuid": "86fca795-e6d7-40ee-833a-23bee3c18625", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099690, "uuid": "6d1daeb8-8bed-46f9-a972-3f4c87b8565e", "value": "curl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c68e2d-649d-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1781076238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781076238, "uuid": "1cf4630f-a515-41d3-b491-e3f5d6bf7a98", "comment": "Malware payload (NetSupport)", "value": "e36849f10ff8fddef6d6f614c31aeab7", "object_relation": "md5", "Tag": [ { "name": "89-105-217-188", "colour": "#396330", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "goldmygod-net", "colour": "#A1B61B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781076238, "uuid": "1559fcd0-10b2-49ab-bf62-a8ac038aed97", "comment": "Malware payload (NetSupport)", "value": "11cb8d5e9db7b19c97aaf8e21a8903251ef8b1fae67c0e61b7d499e978543b13", "object_relation": "sha256", "Tag": [ { "name": "89-105-217-188", "colour": "#396330", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "goldmygod-net", "colour": "#A1B61B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781076238, "uuid": "caf7b43b-d777-4f08-ab10-1bbf62c7a146", "comment": "Malware payload (NetSupport)", "value": "c1c94f9c64ceb3d8f78afe3d868f3e517dc70129", "object_relation": "sha1", "Tag": [ { "name": "89-105-217-188", "colour": "#396330", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "goldmygod-net", "colour": "#A1B61B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781076238, "uuid": "4d59a5a4-b7dc-4915-83b4-66c0665a9014", "comment": "Malware payload (NetSupport)", "value": "d549462be27a789d58180f9b733703585093f558b9e383e61a0655825a39c2651a5bc897abc5ae0de53a00bfd9fad536", "object_relation": "sha3-384", "Tag": [ { "name": "89-105-217-188", "colour": "#396330", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "goldmygod-net", "colour": "#A1B61B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781076238, "uuid": "d1b1147e-98b5-41b9-89cc-78cf57f5fde6", "value": "T1A8F5335B5933433FBC9DA3924C368BB53E63B94D8C742F3E1F9285885A41C20B599E72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781076238, "uuid": "9536cfd6-b26b-40ba-8e03-a3d281bdb5f9", "value": "98304:bcdEuQ+woClyB2mKEfpZe5Xq4S/HjWQdrT3NaK:AquQ9oCwBSEfykx/DPlRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781076238, "uuid": "49d453de-f99e-4df5-94aa-a0db4777f9a7", "value": 3562675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781076238, "uuid": "b24f995a-fb79-4c18-a88d-5a8089c0e3ff", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781076238, "uuid": "910c13e7-c5c1-4e6a-831f-b9192f107252", "value": "alex.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09922f84-64a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781078682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781078682, "uuid": "0d1a6a81-9da2-4caf-9b8f-304e7dde1778", "comment": "Malware payload (Mirai)", "value": "a80259bf3421b6093a42536b68d25fe7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781078682, "uuid": "d8ec4b37-2e28-4d25-be97-89cab03f11d1", "comment": "Malware payload (Mirai)", "value": "1291dd48e09d999600dc8b09cc56a11dc19224a2e600d171faccf7d5152bb776", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781078682, "uuid": "c677c56f-6b90-4ff4-8816-2064794af7be", "comment": "Malware payload (Mirai)", "value": "9f4747405c6618e795ceb7f4b7a2ab10b9d4ef98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781078682, "uuid": "a5b30627-3263-4f03-b211-3c0ce0092962", "comment": "Malware payload (Mirai)", "value": "cfa61cef690ae0ed3332bdd66e573901fca8af446faed8c298edb0792d05aae9bd64019a0b23a0bb47b3569d599daa00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781078682, "uuid": "3a4871ed-57f0-4473-8bd0-09c03f887764", "value": "T17EE3C90A9F510EBBDCAFDD3702E90A4139CCA55722A43B763674D528F54E90B4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781078682, "uuid": "12d69de2-4c18-4143-8ac7-d1bb206f7663", "value": "1536:EQxIWag82z9WN3Y7qbh59gZUek1i9Z8L0Q2sT0zwZ3wwyLbuH80Zwo3RxoZKl3gD:Xa72zooahB12sowQyH8Ro3C7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781078682, "uuid": "959c2ee3-95b8-4ddf-824a-e9f9da165594", "value": 152888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781078682, "uuid": "f9e088ac-5c75-4b89-b580-ed7759725a11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781078682, "uuid": "3e22b165-1def-4909-945f-5fee84ceab09", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "411ef80c-6476-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781059448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059448, "uuid": "c8d6072d-3270-452d-83ff-90d1f92f576f", "comment": "Malware payload (Mirai)", "value": "e6f0a435cd3a234731c6e93a6e13492e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059448, "uuid": "fbea7fd3-9781-4b42-9819-1c668c63f91d", "comment": "Malware payload (Mirai)", "value": "135a73138fbb74b4e9fb90d1f5ae286c227848e25747fe57f7f60f53405f0878", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059448, "uuid": "e29642bf-4fad-478b-bd78-9ebb09dce9f8", "comment": "Malware payload (Mirai)", "value": "01c7556b522b96e4208edcfbf962dd62f16be86b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059448, "uuid": "6abbb7f3-945a-4a1e-b3bf-3c6c49f215d0", "comment": "Malware payload (Mirai)", "value": "7654d275fa763c821d794044f6a1bc6f1d129bab0cecf1fa79144fff21ebd2159ff9f1c702ecb1c95677d78c2dd5a24e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059448, "uuid": "0d559bbb-1c34-48ab-88c4-43f0608ba5e2", "value": "T1EFB39ECFF64B5550C82287F00BC34B9E3E23A3518E17D9E72C1EA63A24756DB5E0A791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059448, "uuid": "1aac5195-1723-4000-a60d-6ca79957d033", "value": "1536:2Ye0Ag9h8u/fwgNvSjgjGoH4g2lSTai2dUXuiEXki83WPCOrWMEgyp/LWy:219awGUgNYF8+rdmHi8ZOrWMEgqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781059448, "uuid": "30ddbf8a-e88e-4290-8dbc-8c10c0d9a7b6", "value": 107668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781059448, "uuid": "c5f277d9-0e74-4888-bcec-b62b8134ef8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059448, "uuid": "62ae5383-0431-4125-9567-a62523393542", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89c77e01-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105526, "uuid": "26ec31f5-8732-4a5b-9542-1243a1ccb94d", "comment": "Malware payload (Mirai)", "value": "3cdab5d2df47fcbc3f1af83f18bf4ac0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105526, "uuid": "3765ade2-c1fe-48a4-82e0-6b881c5e1375", "comment": "Malware payload (Mirai)", "value": "136635933487c0897c3ac83a296930dee21379b74e00f32e58d78630729223ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105526, "uuid": "d60bbbbc-f29e-4004-bf26-4d5fce03ac58", "comment": "Malware payload (Mirai)", "value": "f2da20eb56b9d5df9f1f1dfb9e72aa6b275c035e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105526, "uuid": "d425689a-b834-4d84-823f-2041833fc8a1", "comment": "Malware payload (Mirai)", "value": "7fb04495f3f555cd372d397a62339d7a92628e22ce8c83e36b40403b6ce1e816e55aa6d148d7c9e95cd7874c4a459e57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105526, "uuid": "9571129f-fd07-4afe-909d-a86d41c2511d", "value": "T133530946BC818A16C9D413B6FA2E118E33136378E2DF73129E146F6077C696F0E7B912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105526, "uuid": "30a5ec4f-9454-4461-b68d-0a3abd9dcec3", "value": "1536:lZn7uqUHXrWIaxEy24M9u1xEE8czKj8+VBQxXqLhIFibqCxZWXJ:oHXCjSyHI2xgczK5VeQqCxZWXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105526, "uuid": "6ca8072d-c175-4637-b57b-722f4d001fbb", "value": 63268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105526, "uuid": "2bdeccb9-1d9d-4f4d-a423-51f2fec3b5d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105526, "uuid": "7d457579-6d6e-4cc5-9c0d-b6d6256504ca", "value": "miraint.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "045a33e2-649e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781076526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781076526, "uuid": "6981d1a3-e99e-4b93-afa9-9580c841cb24", "comment": "Malware payload", "value": "f2346da8c4070e63b9600fd47ea38995", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781076526, "uuid": "d116cd2e-a687-4fb6-b257-578a675059fa", "comment": "Malware payload", "value": "1370ba86f4c12ff1a8a0dd987b2be79a6ed13f7765e05b9711c544a7a2f288ea", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781076526, "uuid": "a2f2a5d6-3622-45e1-be8f-e86e8261a831", "comment": "Malware payload", "value": "5260483bdf717a5ad80afd6acbc58392bf09b2e2", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781076526, "uuid": "c7cae19d-6200-4ee7-9b29-9ed3fb66f7f6", "comment": "Malware payload", "value": "56db7ca56f6ac8ad092df0501c8d8f4ea7f0b89c1e16aade13261abc190cfa81d4915523a11587fc70e084bd76af804d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781076526, "uuid": "9cfbc571-8483-45db-8e0c-f94d40776112", "value": "T10C96128AF748A92BC477513245BA5331665B8D128F839793A90C371C2DB7AC44F9EFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781076526, "uuid": "5cfca12e-a4af-4ec9-80cd-7bc98cf2e54c", "value": "196608:uWj0RHcjwk77V/5erqdRKFkSr/G3byWF1gNQ8zdm9mhhqJwx/:59j775bdMFJyHFahm9kUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781076526, "uuid": "b85b6285-a86d-4245-bc3e-07f1d268ce53", "value": 9407977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781076526, "uuid": "6815f834-f4dd-43cf-9507-e31156799108", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781076526, "uuid": "5de021a8-d537-487d-b060-8450bb9b909b", "value": "\u0434i\u0430.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "736ecc18-6491-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781071129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071129, "uuid": "99bef2ac-160c-4f22-be40-71b198d22f64", "comment": "Malware payload (Mirai)", "value": "12d81ddf4cd41e91d228bec6b4ca8488", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071129, "uuid": "253bd2a4-313e-4296-94a9-0627b2a55fe5", "comment": "Malware payload (Mirai)", "value": "148d9311c3d877a35d48a6d618b5b1916737e55763b21c86ee4790955be76143", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071129, "uuid": "10bf63b6-e599-4668-a389-cf4af4599e8a", "comment": "Malware payload (Mirai)", "value": "dea6aee1e694d8322b02d0c6407b7d06a9dd6c9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071129, "uuid": "a08a0fb3-50ac-4915-86c1-a1c8fb7ad971", "comment": "Malware payload (Mirai)", "value": "5f4887deb191d23995ff9ec0fadfcec3ebbe726176ebb58dbf0aad32a81a9b3eaf777dd3883296389fb7355fa40a55e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071129, "uuid": "95b6bd5d-bd79-4df4-9c43-e6487dac0d1c", "value": "T1B7A3F885F8509B17C6C762B7FF4E428D7B2A175CD3EE320399156F60379B96A0E3A102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071129, "uuid": "cd42a45d-7393-4a1b-9914-e3d239b83c6d", "value": "1536:KMLJ57LwUCrEWeAzkH/4VHyBTQrDloZOoxq5DB/rltOIwywIlSfhhBTEGsFKoZgx:Ttl3CgWe54UB8r5B5VIokN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781071129, "uuid": "d30ba772-f6d2-44e1-86f8-8dae78371391", "value": 105088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781071129, "uuid": "ab587726-072d-4f22-a01d-77f7a282a2ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071129, "uuid": "b1f5c162-049e-4040-83eb-2de67e2a69df", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b410dcba-6475-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781059212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059212, "uuid": "f400427a-b995-4730-9c6c-3d7ab98307ac", "comment": "Malware payload", "value": "5965c222a06b3aa21ebb132e5364a7eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059212, "uuid": "aae5e537-6feb-4517-b43c-12b5e70b847f", "comment": "Malware payload", "value": "14b20bf497a5d964071087abc2d047b25a222fa69009a276aab9c241281af2b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059212, "uuid": "5be04bcc-5151-4c66-8aee-f9a5d8d9cddd", "comment": "Malware payload", "value": "d97c3783ff80ecd91cbdd2a35b7b87dc6aa60300", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059212, "uuid": "4238ed24-5db5-4437-a506-2ab171374118", "comment": "Malware payload", "value": "a8af7b77d800f2a667052c4f42a09bcae19042d07e01faf62e948c979f4feaa814a1f59177b704dfa6046395bfebdd2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059212, "uuid": "7ee4fe35-e64f-4bd5-a8d7-e412cc81f8ae", "value": "T181E32B05B31D0983E2673EF0373B27D1D3EF9A8131A8F640295FAA8991B2D325585DDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059212, "uuid": "3d628610-2c3e-40d1-b343-565cdbefc0ca", "value": "1536:9nQSA2XFMk3V9pt+t/a/PUrvzbdxAVE3/PSXvAuHznBY97EcwzqP4fgoa5xD89kl:1RFrjQakrXdxPPtuQ/EACkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781059212, "uuid": "72110381-dc5c-49ab-9653-e9a7b5607049", "value": 145016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781059212, "uuid": "c81d0642-c23f-4630-83f6-ce7e08f2ac94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059212, "uuid": "43f7577f-7b34-48c0-aa5a-fe285ce7acf6", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b52f31-646e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781056075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056075, "uuid": "848cd630-f9a7-43ce-a975-7f97965cb460", "comment": "Malware payload (Mirai)", "value": "2b8c1e590402ebbe1873a95356e021c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056075, "uuid": "d558ebd6-7a0d-45fc-b200-ae049cd44d8a", "comment": "Malware payload (Mirai)", "value": "15168af5ae5d3b767283a6f5b4b0e9385845c07fef21adeae259ce9a43223173", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056075, "uuid": "27eace95-347e-4808-8b1f-7c491c265dce", "comment": "Malware payload (Mirai)", "value": "812ffe223bd95041f6b7a26372dbe73958f3b33a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056075, "uuid": "97957f2e-fb74-4003-8ffa-b327846c3b51", "comment": "Malware payload (Mirai)", "value": "ce43a3c7a817bb5de26ac95a0f76211f04b90c4c205394f2dcd6512fb974b3f2c79839259491375d6720e1d5be8f64bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056075, "uuid": "890c349f-3aea-4787-88f6-d4a79de1a1e8", "value": "T193530141C35FC52CF5A2E33C21DD1A6B9E487A2CF46CA7E41AD531A1D08238C79EC798", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056075, "uuid": "cdd4d5a2-598d-4102-b914-e84bea42d18e", "value": "1536:wfm9Kzu1MjU7Fk8HrlZqRrTwI3PJcFH9rnouy8B8K:394u1Eok8Hrl4wU+9zoutB8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781056075, "uuid": "f375b71d-fc3e-4d0e-986b-cf512bb8758a", "value": 62716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781056075, "uuid": "73fb9420-c9bc-459c-99dc-ae82e700b9c1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056075, "uuid": "4805fb62-5afa-49a6-81e2-532b35e9601b", "value": "wife.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275dfe73-6509-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781122541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781122541, "uuid": "a605af63-db99-4a3d-b374-033c96e2da13", "comment": "Malware payload", "value": "5b88bcc90865bf611710a87196263ef1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781122541, "uuid": "0692acf3-9d23-4b84-bbcc-42ea04717c2e", "comment": "Malware payload", "value": "152a8f82993e07eac6b11e35d5534cb38308e03b400afee1fffa8f213d7432af", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781122541, "uuid": "d638dd73-e949-4f51-b49a-556e7d8416f0", "comment": "Malware payload", "value": "8026fdc61880e9e7059cf9b6aecfd6d32fa393f3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781122541, "uuid": "fa40b044-65c6-4f82-9ebd-c3e098a5b8c7", "comment": "Malware payload", "value": "cc629ffa3103f07c7bee69d2b16a0b5aab5a66d00a80197c28bf5427af7206d1df48e7d252365fba5b58b7c58323e063", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781122541, "uuid": "b8f951db-1d04-4c03-8a97-91cc01e7b8d0", "value": "T15B0155DA8009D7A081DAE89E729751907411C3CBA5454FF87EEC403D9BB9A68B01AFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781122541, "uuid": "37dcf79b-bd7a-40d7-a12b-ddcbfe233535", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaVIWtAZIgib3Ivc8IOxqxjbI1YauD:kXCKysE2hi0ziQvZohaVGlibn8/EXgY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781122541, "uuid": "d98f9e3d-9135-403d-a54b-68ec5c20938c", "value": 834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781122541, "uuid": "03d3310e-439a-47f0-bacb-252166345438", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781122541, "uuid": "d4fe65f3-2045-4652-89a7-e5bd860dfa51", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc3866a0-6502-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781119838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781119838, "uuid": "05062007-c11a-4d3c-885a-2c6342e88a7e", "comment": "Malware payload", "value": "ed2245b4101cb00fcae3a1b3abe1de3f", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781119838, "uuid": "ff79376c-12f0-40ab-b8f6-2f8bc32e15d3", "comment": "Malware payload", "value": "15d191fda1c045184d5ff6417fdc0a54a1e6c918302d1013f88c7ae193e7b9fa", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781119838, "uuid": "f645ac21-4c1a-4b82-a285-46493d0e9154", "comment": "Malware payload", "value": "19ab72d067c59aa4dacea49d2fa4e49923005afc", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781119838, "uuid": "d0ad3e43-0144-4381-80d2-bd250f55c895", "comment": "Malware payload", "value": "032fa931ca07bd9ae7101a9918c77f56bc32cb54a6308746164280291a9f66f6ebf98247ed387aa9771a4bf1f62e999b", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781119838, "uuid": "8e35bbb4-410a-4b6d-b2ca-1a567c244661", "value": "T1EC067C07BCA109FAC199B23188A362567B79BC081B7627D72F50B7782F727E02D36355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781119838, "uuid": "e478f990-5289-4997-b67b-1f404f6ee91e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781119838, "uuid": "87944de1-7bb7-4a3d-800b-21c655e83c3d", "value": "49152:GPGFFTbR+fUFLFmmnncZ2qYvMTG1nUfVUYWMFuz0dAZD78Vccv:GK1PmmnnctYvMTMUfVUYhFuzRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781119838, "uuid": "1976cf88-6a2e-49ea-b869-16203ce36946", "value": 3744168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781119838, "uuid": "0bca3d64-cb9e-4583-9a11-86e5bcb74f55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781119838, "uuid": "27c8b862-b7bb-455d-8093-b2a16a306fdf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaaf4526-6511-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781126305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126305, "uuid": "29181491-c882-4925-b9ff-adca98d4a89a", "comment": "Malware payload (Mirai)", "value": "5eb17703a5be82e4f9d26d12365a6387", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126305, "uuid": "0ed2eea0-f216-466f-aa60-1abd95bbc0bb", "comment": "Malware payload (Mirai)", "value": "166046807bb1f4e33c77eff2bc0eead70f1935dcdac9b07845b8aa482e3b2500", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126305, "uuid": "d98e5b46-6a8e-4abc-8e71-d8b2319166dd", "comment": "Malware payload (Mirai)", "value": "7777ec7d62b4185026d57eaf0c461b08df93339c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126305, "uuid": "6c6277f1-4a8f-48d6-9273-0e297032d310", "comment": "Malware payload (Mirai)", "value": "1e8d51dbe5177ffe32022b166f714e02c0f4c7e6d99aa30d5c81123c3b24bf4aaade614e7d22e5041878e6cbc0a98ef9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126305, "uuid": "2328ffe4-c7e3-4bbf-81b4-715103fbe211", "value": "T16C73831ABF654FF7E8ABCC378AA91B0124CC651A21A97F797930D814F24B24F55E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126305, "uuid": "a2dc944e-774e-4d8a-af33-dd71aba196c5", "value": "1536:7p/bgkjaVYjj/V6mI7MZz4ODnu9d6dPRRo1/:7dbgkjaVYHcQZz4eP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781126305, "uuid": "83731d5e-4730-4c73-b36f-c504c3947053", "value": 76476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781126305, "uuid": "5a225642-8e55-454c-a954-45fcf11c4489", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126305, "uuid": "39bfa135-315a-4e89-baf4-d4e2cfabd9a6", "value": "kwari.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7771189-6495-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781072988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072988, "uuid": "266be2d2-f510-446b-8697-9e2099af839d", "comment": "Malware payload", "value": "ae4ca2d4a8299cd4ddc15808a8f170f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072988, "uuid": "837c8486-7394-4e6c-a894-cc1fcbd741a2", "comment": "Malware payload", "value": "16aef209c8d9463374a25d3db41e9e5b67ee656cee96c0b574e43569cc88fdc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072988, "uuid": "d79d44e5-8061-4584-9cdb-9684ce95d653", "comment": "Malware payload", "value": "ff3d134e3b350052e8de18a52d7a796c727abf12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072988, "uuid": "317c4f4f-7200-4a3b-8e7b-8c9d29ceacf1", "comment": "Malware payload", "value": "9802ebb858ad4d10e260d018d247b901fd161f583a6ae2d64628f8470b84cf035fe3502427e2787f6bc20fe8e735e8a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072988, "uuid": "c5471d71-9112-4811-b341-8324f42e053c", "value": "T1D0762A47B8924952C4E43A37BCBE81C432630EBA8BC7565B6D05EE383EBE1D90E35754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072988, "uuid": "8cfd706f-8731-4838-99c8-8a195c02bb32", "value": "49152:sFgK+9YEEJ1z9TBJ8hq+wvUYL/EpbbTrhrI5a+78XoIJ5EAW:jA1z99J8hq+wvUYKia+78JEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072988, "uuid": "1505dc5b-cd1e-4624-b7a4-5d8f7f639c82", "value": 7405752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072988, "uuid": "62e78539-9500-40bc-aa4d-386705092b4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072988, "uuid": "b3f2e72b-aae7-4208-8ab6-1fdf93ffaa90", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb392ae-6492-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1781071738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071738, "uuid": "b13d0669-7085-4e21-a2a1-b08a509c6fbb", "comment": "Malware payload (PhantomStealer)", "value": "883ce026fe1dc09b16abf7265a6f6d11", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071738, "uuid": "81aa3bd2-e084-45ed-b5a0-f2fdc28ba5a5", "comment": "Malware payload (PhantomStealer)", "value": "16ec3929a471fcb26e96c082849bd165e7593b5c0ba6fdcb6fa2563cd8f82aa4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071738, "uuid": "facaee76-26d7-4115-8e86-cef1ebc65fc5", "comment": "Malware payload (PhantomStealer)", "value": "216ece280239678b8e378f9d9f715cde2645c82a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071738, "uuid": "64375e0a-4557-475a-8991-d9860a4461d7", "comment": "Malware payload (PhantomStealer)", "value": "c102c3e5372547cb6ee4bfc78d889d96056666c32b66c15089c30f6755d6ea986929dbbd7e0fa30fa3c7f4404ce41dde", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071738, "uuid": "f730422c-d6ac-4151-9a92-d748b263cf56", "value": "T10C73577477BC8EC4AD141EB2B4840FDE660549F02966E2EF896C76DFE3A8404BC51E1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071738, "uuid": "0eb60fba-3d05-403e-a839-2bf3b682a953", "value": "384:DyDbi9GzicmhcVznCWR5McD/OU7O9Ih8D7SXGTk5dLhyZa3uCwzrYCZx1xg0F9kC:4FbGw57UjYlbMJRjHQMjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781071738, "uuid": "19c2a926-bb31-409b-a29a-781a3641e461", "value": 75400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781071738, "uuid": "b38b5523-3127-4ec6-a03b-729caf4600b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071738, "uuid": "67c643e8-dd6f-4b4a-ab55-891534e01d69", "value": "Factura n\u00ba 108.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9115cd33-6491-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781071179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071179, "uuid": "ba2d9fd9-00b1-48f5-8f41-365863ad1ebd", "comment": "Malware payload", "value": "177f16c56f35f6574319031f6a813546", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071179, "uuid": "48f5e2c9-ebf6-4a6c-8f56-5b9b5557850a", "comment": "Malware payload", "value": "16f48646987a0d14f9ba1e6e097ae280f699aa7e3cde788a11cf0ad00a983b6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071179, "uuid": "a8785010-84ad-4bf3-8e2e-8efe811808f2", "comment": "Malware payload", "value": "0384287d4365af3c154c07e6b41d3c08b0e697f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071179, "uuid": "da4c42f9-f317-47f3-9cb3-5cd498927962", "comment": "Malware payload", "value": "9dea7dc1796815474ac29470e6342513d9a6f63aee8c868697da395f519eed8bad3c2ada77f0eb0cb2e6b40e36bf5990", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071179, "uuid": "dc577473-24c5-4503-b434-885b9290aa35", "value": "T1E11733C913E10485F8AFA13D65D54667D2F271211B31C9AB0BE09E6C2E672E7EE31F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071179, "uuid": "913ee103-bb71-46ef-9edf-8a7dc20cfb84", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071179, "uuid": "110357fe-83a5-4f31-868c-b02bad1154d2", "value": "393216:m2znAP/iXgAt2Jy6xFQ1yNdq1B7nrhOzCQLVJHsouEbpiR:Tznxv2JLx+1yNg1ZtOzDVtnxbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781071179, "uuid": "bb75bc28-7699-43b3-9a36-e581dafb9f0d", "value": 19147996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781071179, "uuid": "6f28cf45-ef69-42e6-8da2-0b5dcd0d6cbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071179, "uuid": "b39835aa-2e0c-4c00-95a5-5fe54d55d200", "value": "177f16c56f35f6574319031f6a813546.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b104f0-64ba-11f1-a769-42010a9c0008", "comment": "Malware payload (LokiRAT)", "timestamp": 1781088841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781088841, "uuid": "51a600c5-4e58-45a8-8a70-c942bca29b2e", "comment": "Malware payload (LokiRAT)", "value": "9a349d66c7314addebfd4b7cdbd455da", "object_relation": "md5", "Tag": [ { "name": "LokiRAT", "colour": "#17B4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781088841, "uuid": "01825fac-afa2-4c0d-85e3-6d3afa994d94", "comment": "Malware payload (LokiRAT)", "value": "170715a4029ae2c2a73837b6611aa0585a887dd00932ec5604fb293ed6ada45a", "object_relation": "sha256", "Tag": [ { "name": "LokiRAT", "colour": "#17B4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781088841, "uuid": "d7afc4e5-149f-448f-b584-60a6141094ed", "comment": "Malware payload (LokiRAT)", "value": "0d0622798947bdcd2af5676f3b5f996123923487", "object_relation": "sha1", "Tag": [ { "name": "LokiRAT", "colour": "#17B4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781088841, "uuid": "6bb34aa9-e1df-46ea-aa05-d3afc7d19643", "comment": "Malware payload (LokiRAT)", "value": "6cf4a6e11a556c6d3f5c9f353f7021549b12ef71fd545171ba873a45a527733d8742b786e7ee0a3b88bdf32732394532", "object_relation": "sha3-384", "Tag": [ { "name": "LokiRAT", "colour": "#17B4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781088841, "uuid": "b0b85dfe-796c-4f9a-8263-2d34e9d7adb4", "value": "T18DB2080ABBDC8606D07E4BBDA8E213840775B7525930DB4E0DFDA0AEB930B848791767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781088841, "uuid": "8f54fc17-a162-4cf5-952a-4260307e5a2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781088841, "uuid": "278ab588-823f-4f81-93df-ca64981d7679", "value": "384:5I4L3udk7LC+7B/05lhAaQDARXvd0XwjWi9fMKADXacyQNHXzKrAomOBsjhIvMTR:PtfmCM2q3ohWMTUdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781088841, "uuid": "dfeffe7f-27dc-48dd-87af-49e5a6666568", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781088841, "uuid": "270d53f9-b5a7-442c-9065-5b7f01750767", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781088841, "uuid": "32573701-279b-46ba-b6c0-42936e92aadd", "value": "hitclub.paris_142c0aff_k_notepad-plus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "095fe3e6-64eb-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1781109606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109606, "uuid": "e6893794-3ee4-440d-a765-a32db6313fec", "comment": "Malware payload (njrat)", "value": "7f1a0a606ea339ce8ae77801b7ace4c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109606, "uuid": "03a2f733-c9e7-42cd-aead-92194ac43f1a", "comment": "Malware payload (njrat)", "value": "176391a93111502bc7f5a02ab8441d2308ed59a9c4503e4d34907f9055480ab0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109606, "uuid": "81294196-a4cb-43c7-8f04-e69892b0de45", "comment": "Malware payload (njrat)", "value": "d58375e78f149e0f959f027195e3d97f55bf0bd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109606, "uuid": "dd0aba5f-33db-4eef-9f50-f604dbb3172c", "comment": "Malware payload (njrat)", "value": "9027cb8cf94b27bf4e50418b8877eaa5e5e2979ab392819a7f939c62bbe259a729f9bd6e98f33220b41f24c633443485", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109606, "uuid": "292e2a4b-a29b-4d96-ba33-f35c2b268827", "value": "T192733A4877F54A12D1BF0DB5897292221B36FC036D26F76D09D174AA5FB36C08A09FB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109606, "uuid": "70d6b74a-822c-40ad-869b-d1274c6de7ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109606, "uuid": "8bfa51d6-a6ae-41d5-ab7c-ed9b6b0135b8", "value": "1536:39Kj+BFUr/DpzS5wpOk3JCK6pFoTDM6fOpd/9nEh9TG3JQR:eQwpOk5CK6GO/9ES3JQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781109606, "uuid": "d071ab61-b6c4-4349-946a-5afd32fb26a7", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781109606, "uuid": "730cc738-dfa2-46b6-b77e-6dd7aaa92e0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109606, "uuid": "ba27742a-8e40-4e88-a9eb-a01a83d18e82", "value": "UnknownClientInstaller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf919e2-64a4-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781079144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079144, "uuid": "82a1593e-002d-4bd9-93d9-039266f98453", "comment": "Malware payload (RemcosRAT)", "value": "c2b2ac2400be6d978d5d0118b3aed516", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079144, "uuid": "4ac80160-7394-47ef-8002-a257648a3cce", "comment": "Malware payload (RemcosRAT)", "value": "17a3b0d05855f3ba9aa4a43c010d7dd75eb1d0b447b8a2b084bd9765d2b3d318", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079144, "uuid": "b3d58446-4364-463f-b315-a4e73aefd737", "comment": "Malware payload (RemcosRAT)", "value": "7e859fb30aa848b929f4898ef80aca15711d04a6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079144, "uuid": "cd99683b-e6a1-4696-b21b-a4d68196ccd5", "comment": "Malware payload (RemcosRAT)", "value": "53e1833642e348b676f39185624b8245b3eb20d7eba036049b544ddfe77b8a9f89969b0fa5607d02faa18302150d3940", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079144, "uuid": "300e9688-2918-417f-a838-49e700ff7a58", "value": "T113F6004B3003F2E7D0599D2549D9BB130BB9573A85BB61E0287CA32661FBF80F6D05E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079144, "uuid": "362f5fd9-07ea-4f8b-889b-02166f36a575", "value": "3072:LDchahVAHgarou+k+VoZZiARBewn+WMfsbYH3NXyVq5TeWwDr5QCynpNXdFrZRxr:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079144, "uuid": "a119bd84-e1d4-4e6f-9da8-bfedcf79c658", "value": 16467726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079144, "uuid": "7d52d778-010b-446c-8e39-909a76218e83", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079144, "uuid": "938a3701-894a-498b-a057-529f9f3b0dad", "value": "task.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84831e2c-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105517, "uuid": "e995b1d0-7370-4c3e-87c5-539de004df82", "comment": "Malware payload (Mirai)", "value": "156dcb9622362885973dc17ff90d9631", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105517, "uuid": "4426cbf2-57e6-4c4f-ba97-bd5de4015274", "comment": "Malware payload (Mirai)", "value": "17a9792665557995f330448e2f8c2b111a7f8512f3419c0642ec5cb78f4fa569", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105517, "uuid": "193229ab-862c-4d28-8390-98a49c202bfc", "comment": "Malware payload (Mirai)", "value": "c304d4ca6ef0cfe0d61a7e16a98b9b26718f410c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105517, "uuid": "cef3bf91-7d4f-4dcc-9431-b987bd9f6df5", "comment": "Malware payload (Mirai)", "value": "ad7fa434056bfa6cf1bace1167e42e307b3a2e8687b25ff0c65969df38025b9a13e107797cdcbce73e60b74d9ebf2f52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105517, "uuid": "8c7fe4a3-de75-4d2c-9e46-8d861329044a", "value": "T142234CC5A547D9FCEC190A712177FF319BF6E83E1158DA83C359AD72E942602E9032AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105517, "uuid": "69f47373-051f-4d8f-b305-5bc15906fbbf", "value": "768:r+WtjNuFWuttPEszMmsdybV/co8NkHeWfd/0g6SDZkWKo:r+cUttPEsImsduV/cC+WV/0g6OZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105517, "uuid": "f07e90ce-220f-4453-81c5-cb853063a72b", "value": 49756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105517, "uuid": "b34349af-d117-46b5-8555-bb10e17292f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105517, "uuid": "83fb1cec-d552-4e54-82c7-6b3ecb2a512f", "value": "miraint.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c11c54f-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1781108832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108832, "uuid": "c97dda75-e0e1-41dc-965b-6b5bdcdc3251", "comment": "Malware payload (PhantomStealer)", "value": "e775f9ca582732ef51595e093672a719", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108832, "uuid": "3eefea1a-1fa0-40d7-a70f-b4a359149b56", "comment": "Malware payload (PhantomStealer)", "value": "17a9fc6fc9aaf20f81dcca2fe9846e01e835ab0250912ee47c8aa8536a359fae", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108832, "uuid": "5dfb7391-46b2-4de3-88ae-70c6a785ef2a", "comment": "Malware payload (PhantomStealer)", "value": "9eef154d74c1128464fabbd9eb4fa3eb9aa7a1c1", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108832, "uuid": "cc76ffab-ab8e-4a8e-9f57-81bd42836ba5", "comment": "Malware payload (PhantomStealer)", "value": "382026672352a8eea13c979990c398b940a56b92fc9ce1545422bdffe327ce7c5e33817b53008d8272cbf1c352e0db89", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108832, "uuid": "dbfe5dbe-fe3b-49b6-9a91-c338757fadf2", "value": "T109C244CD37C2B8604377B47F3D6BA496E1AE0C81A74884C4F726B494F8A4718DA7AE54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108832, "uuid": "eb9c739d-80ee-4e2c-8366-e8b88289737d", "value": "384:XKwGISQwLfy1AnSyXIP+q7y0lGSiby0BlPLgvPyie6Q3z5UMSvxauPNFHknZJFXp:H3S1nXO7y0/Q1auS2P9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108832, "uuid": "810853eb-6640-4eb4-b608-b23a55a7c2b3", "value": 26413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108832, "uuid": "6220ea69-1601-4742-9b30-89d3638ead88", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108832, "uuid": "84a60c3d-410d-416b-a8f0-ea0451c6023f", "value": "TEKL\u0130F FORMU 6003284611 TT Grup No 162389.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5cf40c-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781108856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108856, "uuid": "d7c4de47-8f79-4674-9f5f-bdcf076bea21", "comment": "Malware payload (RemcosRAT)", "value": "01f07ecd8dc73ffb42945d53d197eb35", "object_relation": "md5", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108856, "uuid": "05ba900a-59f2-4754-8c5f-1f086c6341cc", "comment": "Malware payload (RemcosRAT)", "value": "18e34b3552499ece851a3e979f4723cad587fc371f14f6ae341b498d57f56cd4", "object_relation": "sha256", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108856, "uuid": "785d25cf-ce31-4422-b1d3-464af942d9fc", "comment": "Malware payload (RemcosRAT)", "value": "aa22bd43f6d84032c4cb5a5e93542af809353c73", "object_relation": "sha1", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108856, "uuid": "3eb5a403-dd43-453e-abb6-08f096359ca5", "comment": "Malware payload (RemcosRAT)", "value": "205657fadbfd51fbdc82b22cf4738a932d42c7429bcdb3511d1e3f699fbfb7857e6b17b36bca53046280ded9091ae04c", "object_relation": "sha3-384", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108856, "uuid": "2e60d6e6-4b84-4401-b09e-3e82b2fdfd74", "value": "T129E6ED8AADBBC92A5078D6826170C43BCF157A3CD596E90B8077B2CC4B567A1C271FF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108856, "uuid": "616577b5-1f42-4ff7-b1fc-1e5129e2c292", "value": "192:cK/K/K/K/K/K/K/K/K/K/K/K/K/K/K/K/K/K/K/K/K/K/K/K/K/K/K/K/K/K/K/k:ZK1ZVOV9VmAqxMu95tZd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108856, "uuid": "19484ea4-8afb-4d6c-ae69-1a3efaa19ab9", "value": 15012562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108856, "uuid": "be28fc50-e23e-4c96-9e3c-db58fba7383b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108856, "uuid": "e51e04c7-fb83-42e0-99dc-8249b8851971", "value": "FedEx_AWB no 530526.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6586b461-64f4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781113626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781113626, "uuid": "832462b0-ab05-4db2-87ff-113e366213f9", "comment": "Malware payload", "value": "3ceb593c13743af13704b55aafa0012a", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781113626, "uuid": "49c3c78c-a6d7-4aed-bb7f-1945b73deaf3", "comment": "Malware payload", "value": "1a10d4ab0d73298451579db6ac3cf3be39c4d8ada45b0b2f504a4110640a2fc1", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781113626, "uuid": "0dbd9848-f502-42ff-b12a-99215db1a00a", "comment": "Malware payload", "value": "ce51f540e28bfe177f3630dcdb5593e524c227f7", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781113626, "uuid": "4b7a7bb8-4a89-499c-b895-0688920c7cce", "comment": "Malware payload", "value": "c6171cfd54757b072acefb84505895e1c87e86bff2245c2499d55ba4318f39a55c20bc883e546964bf62b1cfa166c496", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781113626, "uuid": "174ae15a-0ce9-471c-a8b6-a9130842e5b0", "value": "T139A4F105B7F500F6D27B8678CA521542DE72FC4617609ADB57800BA61E37BE0AF3E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781113626, "uuid": "f951b9b6-7ee5-4f07-a47f-43c27915f3a9", "value": "bc9ef82c0da7dcffb60805858eeaa4e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781113626, "uuid": "317dbdfe-124e-4e06-9336-46d9a1d673ad", "value": "12288:nmfqEx6+/6dNfkaiJEwB+Q/TRGgQ9TDGhy:nKqExZ2ktJEwn/TRlQ9TChy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781113626, "uuid": "0aadf10d-349c-4bbb-8c15-eebf70475a69", "value": 493568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781113626, "uuid": "39d29746-6d79-4295-bd39-95b75b00dc2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781113626, "uuid": "5f747d22-da36-4223-80f9-f81235d298e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d95a22-64cc-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781096364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096364, "uuid": "dfdd6fcf-65c3-4af5-816b-c90e0f04caf6", "comment": "Malware payload (RemcosRAT)", "value": "a2907093d155a6f8d1116cfef9bdb7be", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096364, "uuid": "147c6fad-90df-4f80-9b9c-960e3f882226", "comment": "Malware payload (RemcosRAT)", "value": "1ad8380a4d62ad5f0ee8f4374025594162b82f572098a382b307ed2942369d13", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096364, "uuid": "e8514d92-62ec-4391-ac9d-ea2bebc81f81", "comment": "Malware payload (RemcosRAT)", "value": "ab8a5676d8b66421bcfe9e8076097b53f5824a28", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096364, "uuid": "1e2b12cd-a3b1-4e03-a819-b75375746e12", "comment": "Malware payload (RemcosRAT)", "value": "16f7a51ad2d3835f9b1ffd4eb417239138f15c187db6edc72e9f7a48221cb3880f51236c70a3e7d97876f9fb045c8bfd", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096364, "uuid": "15c3cfa1-1c71-4630-bc34-b8941c002ec2", "value": "T1A192A6766AD64F75B94B36BD4CD0360076A4CF51073309ECFAA95708A80C47C7BA9E4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096364, "uuid": "abf69cd1-be23-492c-b7d2-d6ab3c4157af", "value": "384:QKJi+1m2Au5GsJrhHjR+7Y0BgpVxxeHYxCiZ:Q0zmtHshDmY061", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096364, "uuid": "dfbbdc6c-ae85-4293-9cda-01fce13c9d44", "value": 20124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096364, "uuid": "966643e1-f8b9-45ce-a689-36e83a9c1364", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096364, "uuid": "aeaad7d7-8b9a-4275-858b-79596d40cc2a", "value": "Hipnesses.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23527ea9-6473-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1781058110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058110, "uuid": "1e1d8157-af47-4de0-81b6-86a613a2d9ce", "comment": "Malware payload (Prometei)", "value": "2fdda9a8a02efd8ec4543c8339766e16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058110, "uuid": "a39fe3ac-6fba-40af-b5e8-14d465ec4622", "comment": "Malware payload (Prometei)", "value": "1bab73e48da0b2008685ab90f1895343c2db118686c10e68bfccf16c42248c77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058110, "uuid": "5cb674b2-dc39-4c77-98ab-e998186aa95b", "comment": "Malware payload (Prometei)", "value": "f8d5f6a8dfb3226856ea2429d35cbe252640ffe2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058110, "uuid": "96ddbb75-9974-4362-ad89-5dcc9771f489", "comment": "Malware payload (Prometei)", "value": "b7d2af9b923dcbeea7190775a106494427b1f79a1eefac4be48c8d96c8dddc652db9b256f917be62277144804f8d7d92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058110, "uuid": "bd5f59ba-b330-4893-a646-bca4d8587126", "value": "T1C067CF7791067CE9E9A94DB4841015816D787C874B78A3C7BAC8B1FA66FB2D08D3E730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058110, "uuid": "e72f53f9-2b0b-4f6a-b96f-ecbefbca1bb3", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQM:cqYUQuVDt0TZEAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781058110, "uuid": "bb5792c4-67b7-441b-97bb-3ab8ae99231e", "value": 30081024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781058110, "uuid": "e0283307-e16c-4ee0-a742-edc035c3a296", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058110, "uuid": "98e658f1-9a34-44f7-911b-cdf11ce802eb", "value": "1bab73e48da0b2008685ab90f1895343c2db118686c10e68bfccf16c42248c77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c2656f-64e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105979, "uuid": "2640d7f1-f893-477e-b1e0-8ac775f76e32", "comment": "Malware payload (Mirai)", "value": "d980b04dc33a0253832382a550ed3ac9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105979, "uuid": "daef419a-f10c-44d2-a09e-8bdc3637b5cf", "comment": "Malware payload (Mirai)", "value": "1be7ec912c3acd4605cd99dcec117151f8d100f0d979cf749863ce54b98c6e3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105979, "uuid": "1e5e0552-72a1-4e78-9e37-653ad0d02b08", "comment": "Malware payload (Mirai)", "value": "1723f8ce24e6f5b2251be032bbcfef20a966082d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105979, "uuid": "80305036-70da-414a-b801-ad1ea53bbd73", "comment": "Malware payload (Mirai)", "value": "8a76a3116bef2b3c55a9e5188ec13a18a1c7be957c45dfd38df3cc6321b3cb870dd981748604a460f4838d91dc06df80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105979, "uuid": "f4887e1f-49e4-4670-ac71-e92792a8c873", "value": "T1DFE32B46F6418A13C5D61777FAAF41493322D794A3DB330699285FF43F86A9F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105979, "uuid": "2ef77d21-53fc-453b-b73f-effd48c7ec58", "value": "3072:FYvMxqixyDJAmUzdBJXu9WRtotmLFQTihvmX0clM/9h4b/kP:yvMxqixyDJAmUzUSotmLFuiIX0aM/9KO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105979, "uuid": "52cdb357-91f0-4503-a155-a7329753f9f4", "value": 143845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105979, "uuid": "fe024597-2f8a-42cd-98c7-7de6a57326b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105979, "uuid": "f7253d44-379e-48e0-b64f-7a3afca337a7", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f09e95bf-64a1-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781078211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781078211, "uuid": "477f0bd9-def8-49ef-9797-da818ed98eac", "comment": "Malware payload (AgentTesla)", "value": "b4c122bbd611bb53014f50ef6f3c07b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781078211, "uuid": "54f97a22-646b-4770-a5c1-ab541a92f93e", "comment": "Malware payload (AgentTesla)", "value": "1c31ace9b99c610efb5dade074a1fa6fbc216b75300eabe0f518b30f177569a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781078211, "uuid": "58252367-18b9-4af5-aea9-5a6384aa0437", "comment": "Malware payload (AgentTesla)", "value": "6e819fcbc2f77a84319c520d75d3c0f5b35444f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781078211, "uuid": "c560d111-1526-43ed-a6be-2bf9923776b9", "comment": "Malware payload (AgentTesla)", "value": "efce261886b201595c76923d9ddea3903e03a537db8b97a490dc467bae13d9c7785f6c885567099c8caf9abc66bb088e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781078211, "uuid": "33dbf7b1-4288-48f9-99d2-fe9cbb843b7b", "value": "T1F86364A87AC7F9704607B17F2D3BB0D5E23E0CC2A7488584F3596459F8A830AD5BEB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781078211, "uuid": "9c4ac782-e3f1-4abc-97f8-0e557764de29", "value": "768:Szzr/T8TPT8tbMq58ddHu0y+nH61adhVG0RKCPcNBFvMD0deQx1MaP6DKRd+Cfi8:Qzr/w+bMCcHTR5UXFhd//yDod+sio7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781078211, "uuid": "a9ed79a5-e247-4fd3-803e-a4c1655b343f", "value": 67716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781078211, "uuid": "d189285c-d4d5-4182-b500-a46657f2bad8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781078211, "uuid": "29cab3ac-ed33-43f5-898c-f8daab58d17e", "value": "CTM_BREAKDOWNpdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff800cfb-64b3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781085967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085967, "uuid": "1633ecde-fa2f-43c2-bba0-caee4f86637d", "comment": "Malware payload (Gafgyt)", "value": "204fb5c28cd7f5153667a56d1e894dab", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085967, "uuid": "4c0d9e1a-05f1-4ed1-afd5-4da62c6a0a59", "comment": "Malware payload (Gafgyt)", "value": "1c38a5f1d5e0767714725b560a0d8fe5e5a2e7601a4791e5d3688e912f035270", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085967, "uuid": "4ef0873c-fc8b-475e-8af1-62b843c809f6", "comment": "Malware payload (Gafgyt)", "value": "1da29c7a06271623129b306a3d9afd386f25bf7d", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085967, "uuid": "4292788c-2bd5-4608-8604-fff08383936f", "comment": "Malware payload (Gafgyt)", "value": "37fd0cb01ef331ba76fd1806aa30bfe3bb8b3fc7d7563de0ee7b43c8c4195ff10cdd36cbbb87166d20367ed62864faa3", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085967, "uuid": "b258134d-02d3-4993-bd4f-18f19a21151c", "value": "T1EC542B32B9761A1BC4C0F47762F78336F1F2AB4618BC895A3F515E8C6B2528031A77B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085967, "uuid": "111e72e7-876e-4251-b03a-48fb73dba5a2", "value": "3072:mBjeiOMG5HkfprRI8xNywazUiZlvL1Chhw60M55QQ3/6++pNtN+mMb6sG77WW0a5:mKiY5Gra8qtDg75R3o3kmMbLq4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781085967, "uuid": "d13fde98-d62f-42c4-8496-9380a6851de4", "value": 294988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781085967, "uuid": "6e8345ad-8ff3-4911-96e4-2a9fd3465a5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085967, "uuid": "002670ed-04a3-4534-b7c9-ec4b4fcbf0e5", "value": "kworkerd-mm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f100819-64d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781101643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101643, "uuid": "6d58a33e-1f4e-4128-a6aa-44d77c6b81b6", "comment": "Malware payload (Mirai)", "value": "77327d12a182ea1284d0da5bcdd65916", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101643, "uuid": "4d0b7590-3f1d-4538-80aa-ae61694be0fd", "comment": "Malware payload (Mirai)", "value": "1c88ae52c4704be58dcde4cfdd64536e3f65de95dcc395e9d11d92bbd1cb26bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101643, "uuid": "048d7658-11bd-4fc1-ae14-2fbc4f69506b", "comment": "Malware payload (Mirai)", "value": "c022f9df16936aa70e1cceb3d9e67701d8dfa69f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101643, "uuid": "17dec890-c35e-4137-b6b2-8d4ca20de34a", "comment": "Malware payload (Mirai)", "value": "5b898ff98d027bfceceec76ee57b52c13d163d4da5b538082869c87a42ef04b6f0f51cf059e7ade63866081aa7783a18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101643, "uuid": "7021d434-69c1-46c2-b46b-650eeb11772f", "value": "T19AF34C47DB418A13C0D62779BB9F424633239BA4E3E733069928AFB43F8679D0E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101643, "uuid": "cf99ccc7-c8ad-4c5d-83dd-9f0cfada16b1", "value": "3072:obdHL5XQNaatYvUIRgMq/GJ///xhXyR1ZM/9ygHz/L:IdHlgNaatYvUYgFGd/JhXyR/M/9ya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781101643, "uuid": "9158c52f-d444-4e7d-b111-138763867ec9", "value": 171755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781101643, "uuid": "5ed2b493-0b70-4ff0-bba5-faa671f39cd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101643, "uuid": "5da7db1a-16fb-4c89-97f2-f4b6fdd7ea77", "value": "lfpxfytvz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeaab4f9-64b5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781086690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781086690, "uuid": "3a1d583d-fe4e-46b1-a5f4-7736bb288d5b", "comment": "Malware payload", "value": "83eb5c5e62af99a84cba2402a6ab33f1", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781086690, "uuid": "e506025d-5b93-4d1c-aa93-ab4126a41831", "comment": "Malware payload", "value": "1ca86dcafd0b6d208c072760919b38b830ca907f8cc3c77401275731d422ce63", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781086690, "uuid": "bef9109e-2f27-4a42-899c-13a420afc7cc", "comment": "Malware payload", "value": "1fec790508c729b257063203d7ac00af101585dc", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781086690, "uuid": "5000793f-3db5-4b1d-900f-a0cb7f314386", "comment": "Malware payload", "value": "cb37581279dacf2a8161721a9ba4c126c2e9206b49eb1f327e5b66a8bbae6a734270a0235f7e80fdf64bfb57c6e42bb2", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781086690, "uuid": "50f9adfd-5692-41fd-bdaa-6f3da4c3447c", "value": "T13A413C101DEB12D8E2774B352BF9B6B74972F861E91AA6FD104045881730ED0E8A1F3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781086690, "uuid": "799a945f-8664-4fb2-9964-a7f5964cb6e5", "value": "48:8iHaatmP7LNkiMp9H3V1bhYlCCDq2hXIuFu:8iH4+iMp9HF1bhYlCt2hvs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781086690, "uuid": "ff182a74-f28e-4a9e-bcb6-19b444eb880a", "value": 2038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781086690, "uuid": "880bb958-1593-4f9b-b5d4-09a5b10a7160", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781086690, "uuid": "a4f0cde0-37a9-46c4-925c-be9c832e279b", "value": "Q3_Report.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "032e4266-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781108736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108736, "uuid": "e7439875-2a70-4c0c-b822-55e025d6869e", "comment": "Malware payload", "value": "e027b223b67245cecd5f86fbcaf76292", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108736, "uuid": "a2f17ab9-1bc2-48ee-a9fb-4ed5c8ab4c7d", "comment": "Malware payload", "value": "1cfc8bce626064e5e5b31d3f83a144819ede05625d5ee0a5a182fe9ed08e4bdc", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108736, "uuid": "e2fcdd43-6def-464b-8d8d-197aada585e6", "comment": "Malware payload", "value": "c8d3ed2add4ed4cf8f477d903654e39771c567b1", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108736, "uuid": "098200ad-1bf4-4c1b-9b1b-94790bedc9ba", "comment": "Malware payload", "value": "f4d4acde8a35335fc33809823ab07913cb5721b850018c5e562b4b86aaa0bec6118c972232ac944d0d70021172abebb2", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108736, "uuid": "e69cc25a-8245-41c4-8144-34bae08240f4", "value": "T19BD5DF873EF2DA3B70030F92908E6FDA4418B7AF893B749789475A7A35F51B3841A147", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108736, "uuid": "7deca69e-02e8-4a57-b4fb-541b8c6d42fe", "value": "96:auxIMAXsInrB9YHCPnnT4UJxKCndb6mLbxoqmY+4xz7xZA4fQxc7NT5unbCy4xNt:pxIoe+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108736, "uuid": "7013fdd6-8163-4923-bb60-e82bc8eb1eae", "value": 2769317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108736, "uuid": "c137f0d6-afb7-4684-9a5c-78b303ae7789", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108736, "uuid": "cf5ce4a9-6ed9-4e0d-9417-896eff2d2654", "value": "Fabrika Sipari\u015f.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1131d8c-6504-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781120732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781120732, "uuid": "58bf9610-1553-4630-8d00-dab04a740944", "comment": "Malware payload (Mirai)", "value": "a183883510145336591217dc7f308ffe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781120732, "uuid": "113284d9-bcbc-49c6-8ef1-7a48aaf80bf7", "comment": "Malware payload (Mirai)", "value": "1d0af10def74a475d4f6d13550223d90ec7a7c9365c1c746cf0b7ee8f751d2bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781120732, "uuid": "ba7ad761-f4a0-421b-a8bd-bbd9df93793f", "comment": "Malware payload (Mirai)", "value": "663ba95785be4debf67b752798691d1a96227034", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781120732, "uuid": "f69f8169-b931-4166-a6e8-ed674a7f91e3", "comment": "Malware payload (Mirai)", "value": "79c93dbb4c1e5caa1a1aa199d4ac4987dc17f06b6110d919d0c20766718b292515d70e016b54fdefc85a7f9d1485f859", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781120732, "uuid": "4695ea17-8b1b-4f8b-8e51-3d57f1eb15eb", "value": "T1A3E34B07B4C0C4FDC8D9C2748FEEA12A9A72F44A5138B15F27D86F262E5EE206F5D650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781120732, "uuid": "29b66a97-01d4-4505-9687-4458e21f18a0", "value": "3072:8j+fot4HdXIfDqIRnKdGVfS2iYAyZFYCffV3MSitfBPVur1TSRS:Kp8IrqI1PxB8VtS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781120732, "uuid": "e8f466b0-ec30-4873-bcc8-a48ec04646b3", "value": 149240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781120732, "uuid": "1ec3200b-c1ee-43b6-993c-829606fc959c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781120732, "uuid": "1ffc6cf9-b3c4-450d-aed7-25f1e6a95db0", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "697a4319-64d3-11f1-a769-42010a9c0008", "comment": "Malware payload (CobaltStrike)", "timestamp": 1781099459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099459, "uuid": "e3ce8f89-c1da-4080-8ac8-f595ceade3bb", "comment": "Malware payload (CobaltStrike)", "value": "89f0d975e1a555a88d4c2e4b57ddc785", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099459, "uuid": "03962f6d-ab25-42f5-9c56-f5d45df96f82", "comment": "Malware payload (CobaltStrike)", "value": "1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099459, "uuid": "8aad67cd-1a67-406f-8678-4f51a16799cc", "comment": "Malware payload (CobaltStrike)", "value": "15dc3739567dc56d63c95c234bfa7c8f7b7a43e6", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099459, "uuid": "f078a944-cde7-424b-ba1e-4beff94e1147", "comment": "Malware payload (CobaltStrike)", "value": "13f6fddd221358bd234edcaab24ba4c02fd2fbf5d02559aff434b87b89f543b760b0896f243895768a9a228d6693aefc", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099459, "uuid": "300d7c88-98a9-4053-a711-538b8701531d", "value": "T134169E46AEED02D8E8AA90B5CD17451FD7B2FC613231875F02607A9BAF773521E1E312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099459, "uuid": "4bf418fd-2682-474c-a5f4-a9a7fcdd7f93", "value": "cc777ffc065cb0fb20d07c0930ac8c9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099459, "uuid": "3d6e845e-2a3e-42ed-9b08-f1eb57b45b69", "value": "49152:yLrDbFivV25tLgZc7qSnZyKAol2Mvc5jRYD8rA/yThDzuSwox2dPSC7puDS+ku0B:yVlnYKAGvyNUI0LKnPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781099459, "uuid": "47a52fa3-72e8-47c1-b3de-53786c10aab4", "value": 4064904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781099459, "uuid": "4ebf7f93-a329-4fc5-be66-9ae89965d69a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099459, "uuid": "2ffc4cac-9073-4489-9735-fdc07b77ff00", "value": "StartApp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4ae04e-6476-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781059574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059574, "uuid": "eadd8de7-44ec-4a3c-a88a-b33202bd63e8", "comment": "Malware payload (Mirai)", "value": "2d29143d277b625b91f3f900f1ce2ff0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059574, "uuid": "de7d85d0-f421-4d25-a50e-9e215eecf2c6", "comment": "Malware payload (Mirai)", "value": "1d78b9ae870ed0c179ccd3548dec77f99430fe5d75f8d0362dcdbb0cf0516ce4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059574, "uuid": "a8cc83ef-a104-4431-8565-0f576c6adf9a", "comment": "Malware payload (Mirai)", "value": "9950bed4777a1a6640b11d61c4049dca6a5f4f21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059574, "uuid": "e61f93eb-0e55-47d6-8612-418772219dce", "comment": "Malware payload (Mirai)", "value": "b7f60b9e8639099611aecf6e245f0831725024b3c361abcfc1941d36e29313a3e15a39396fb237a0a73e45ea6d3e6037", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059574, "uuid": "6729184c-74ed-4739-8f68-097068040c37", "value": "T138D30846FC519F17CAC1627BFF4E4389372A17A8D2EE7203D9246B25378B95B0E36142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059574, "uuid": "cf883094-cb6d-4cf7-b28c-6588b44e374f", "value": "3072:u7ogQvwZ54yCYxrWu5mxa3KWE4Cz8owLRGUp6Zy:uEgQoZ54yCoWu5mY3nE4C4owLA26Zy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781059574, "uuid": "da77fcb9-f67e-406c-8cea-a35849e5bea0", "value": 139596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781059574, "uuid": "50f406a4-27a9-4c54-a1a0-c203457b474e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059574, "uuid": "867defdb-cf18-4b82-9051-39a4c4e40e6a", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ddaf87-64cc-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1781096500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096500, "uuid": "1c02831a-1e95-432c-a3ba-00f611d73177", "comment": "Malware payload (BlackMatter)", "value": "e2fcb567999480521c5f3cc32594f3b4", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096500, "uuid": "33bbcf5a-bd12-4c43-842a-fa5061f5f6a3", "comment": "Malware payload (BlackMatter)", "value": "1e3c621f7be6e0a8c220bdd01f7e242cd66fc666e0f91c43454d50bd06ae0359", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096500, "uuid": "f5f877e8-a3e9-4c84-9de5-297a678c3d62", "comment": "Malware payload (BlackMatter)", "value": "b5d419989afa9a8eb9a8b0f4a02cc5285a7b44e6", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096500, "uuid": "33a8fe68-b077-409d-aef2-a18be4dadd7b", "comment": "Malware payload (BlackMatter)", "value": "330748d2b3e6d55f2f1477696b46d994c20d6b8c3842fbae4ab6bed35cec7dc29b43e0cc9dbfea4b1ed50877ae6b15eb", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096500, "uuid": "abd2fe51-2325-420b-8f2b-bed7d3f43e5d", "value": "T1EAE36D21F213D0B3C83718F12736B572F39E4D6C19A96847EAE80F99BC658232F45997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096500, "uuid": "b8623ab7-21c8-40b0-8391-89a66665bbbd", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096500, "uuid": "bb422fda-c657-4e6e-8e48-a75a5f93c498", "value": "3072:L6glyuxE4GsUPnliByocWepwlxuQETQ5mxmBP:L6gDBGpvEByocWeKmjE8xy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096500, "uuid": "05005fd2-f6eb-4b91-9347-d794f506580a", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096500, "uuid": "6e9758aa-7216-43f5-9bb1-f18901bf4e0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096500, "uuid": "34415f33-7203-4f3d-8bbf-f0e9b7675907", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f1ed17-646f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781056550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056550, "uuid": "26ccb1d3-3259-4463-b1b9-fae80a48988a", "comment": "Malware payload (Mirai)", "value": "6bf7a92623cdad37375d5707eeb67969", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056550, "uuid": "2895c888-83ac-4569-9335-e51cea51260d", "comment": "Malware payload (Mirai)", "value": "1e48f5375f463c349087894e4affecbe49fa41bf06e067f5478701be6be01841", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056550, "uuid": "8736e2e3-8dfb-4365-81ef-2a6a0a8027d8", "comment": "Malware payload (Mirai)", "value": "3589250a5426f932d7d791e942238c00504d476c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056550, "uuid": "00fe1813-90a9-46a9-8543-8434bc82546a", "comment": "Malware payload (Mirai)", "value": "d9a89811cd06362ba6dc0e46b4c95719446969ee74a4ee19212c036f140258e75b7fb5b50971854c05dc9e0e21d1d928", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056550, "uuid": "603e83c8-019f-4bf9-ac66-be9d85b62f07", "value": "T147635C89F6C3D0F2FD5756F665BBE3628773D02A2099EA01C31D9832DD628119B2B35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056550, "uuid": "ba145e08-e4e0-40e5-95cc-88fe40ebcc80", "value": "768:Q+Mr+tqvYEvO+mW3j/NnAvxtEw3HrA8hfd0NLJS3a9E+Ny22pIr:dqFvO+jz/KnEw3LBF6tSuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781056550, "uuid": "7a7ed83c-dedd-4226-a9bc-19fcdff39ff5", "value": 67624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781056550, "uuid": "c9be40ab-6dd9-4186-8964-20e3f2fddf35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056550, "uuid": "d57d4793-efae-4cf1-9c2b-fb1b772952ee", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59966935-6470-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781056912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056912, "uuid": "56b52042-be60-423b-8598-3098f4d6e7f9", "comment": "Malware payload (Mirai)", "value": "d9150437129eea1335abcf7d1d818ff9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056912, "uuid": "3e3e4b22-a3dc-4ce7-afb2-2eb2ab2a6a41", "comment": "Malware payload (Mirai)", "value": "1e9430173f5391011bec7626771629d9980ad417f0c1ea8eafb57129c1dc5a9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056912, "uuid": "77a74e7c-2d9f-4d54-a849-31c8485e455a", "comment": "Malware payload (Mirai)", "value": "217577f6203ffce55bd9fa2781047e33b63652bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056912, "uuid": "14eab5ef-bad3-4978-91d6-15c0ecaf05c4", "comment": "Malware payload (Mirai)", "value": "5487bae456f44255c1baa6048c871c8547c3639c6a942d2e35c632d48b2da257cf7f35769c3a6e0e75ee29ad93cd799a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056912, "uuid": "7e8e9ebb-cd79-4222-af4f-227a4108f65e", "value": "T1E2D329AAF950DB62C6D11A7AFB5D528833630B74C3CD3206DD159F3427EB95B0E3A902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056912, "uuid": "1f62269f-a438-4d84-907e-959591e69656", "value": "3072:sggxNepUKAqX+nNSrkSBTQ1I31MPZi+nWQFc:sgg0AZErkS9Q1IT+nnFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781056912, "uuid": "5451230b-2702-461f-934f-b2207ade3b8c", "value": 132788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781056912, "uuid": "3f1b41c9-b657-4e2f-9efc-9324a6f13f75", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056912, "uuid": "b5e3fd9a-24aa-4041-9591-e48da0d1becb", "value": "wife.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00af0a8d-64b4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781085969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085969, "uuid": "cc8d19f3-b79b-4c0a-be09-b5ccf34605dc", "comment": "Malware payload (Mirai)", "value": "163dc3c273c69dbe6eacbaab99f9dadb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085969, "uuid": "3b69962f-f172-4d40-a9c6-f84510311658", "comment": "Malware payload (Mirai)", "value": "1ed309675454536d576540239401be1d8b47d1ccca7f36dc210dfdf9b38bd9a0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085969, "uuid": "2b6f6707-ca93-4fe8-b68b-7b879fbf97ec", "comment": "Malware payload (Mirai)", "value": "da678814f76f0fdad290714879a51096c58b2cfb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085969, "uuid": "a79bd371-86eb-4dc3-8e5d-b1405d6f1fee", "comment": "Malware payload (Mirai)", "value": "a04abe27cc203a20cb4f937b1d4cbbbe777fc6a5dd65488397d95212b8fad2e8e20baba80ae8c56f7847f92b4db1af9e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085969, "uuid": "5e02da8d-f3da-4309-aeec-9c247753702b", "value": "T137545CC3F940CEAEF80BA6FF0D6349157130EB7548421AB6A2667D96DF3A0C11D32E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085969, "uuid": "cc8c2d24-6dc2-444f-a5b2-ea5b24d3680c", "value": "6144:/TfyNo3FGcdY+8yPoQrEUu0P5KHLaOwC6uN:brNU03NC6uN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781085969, "uuid": "09db34fd-2d8d-4a8b-b3a2-6e8d6bbedf39", "value": 300436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781085969, "uuid": "df077908-2d39-422c-b144-efddb2e3d213", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085969, "uuid": "ab4a5383-a0e1-4d5f-b63b-e346610216c6", "value": "kworkerd-scsi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "545b58cd-64ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781095558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781095558, "uuid": "69785299-0bc8-4e98-a38d-c3a8821e9110", "comment": "Malware payload", "value": "44ede4f1cde6b8f1c6b15390cd5616bf", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781095558, "uuid": "a80522bf-cfd0-4b99-a021-52c63af22def", "comment": "Malware payload", "value": "1ee0b487163280ff193f2f37cc06d94285d2fcf413a06c9c6904ab386eff7ccc", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781095558, "uuid": "a72116cf-220c-457e-b836-d672d2c3d39c", "comment": "Malware payload", "value": "dd937834399fb9826e22fb9725ff8523fb849d76", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781095558, "uuid": "b31568ee-6181-4bb9-83e6-0bfdfc9fd5ff", "comment": "Malware payload", "value": "8d27ff2ab24d2e49db2b4eff2ac412cd1823a7f6f01c7beca60dcbfd287aca98e8ef29932cc234d73a3d9d5706453961", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781095558, "uuid": "cef38a2e-9d2c-48f8-b3ec-6900509d8edf", "value": "T12BA002D34555BC6417CB4EB5A501C8595069A6885B99DB900F66F2CCC00EE9CACC3437", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781095558, "uuid": "c23d2926-a608-4f76-b926-47d3fe7c3d27", "value": "3:iFRARO/6xHtYTEd8xDWHbCI:iFm0/ZE2xKHbCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781095558, "uuid": "4044e4e5-0010-428a-9d77-7e79ceaef190", "value": 68, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781095558, "uuid": "2c5667fd-a3ea-4d3e-8249-84e3d965680e", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781095558, "uuid": "3fc93188-c2b2-44e7-9634-e5ed34ea4283", "value": "1.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74cc4a37-64a0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781077574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077574, "uuid": "2f2972bd-6ebf-46a7-9cbb-509d84d7dd7a", "comment": "Malware payload (AgentTesla)", "value": "80b7f66c4f0904eddbce6cb41f37068b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077574, "uuid": "956106ab-480b-4483-97ec-8579eecd2d05", "comment": "Malware payload (AgentTesla)", "value": "1f641beb2d66a3ffb622b07ff14f2d3a6e914545ea3914d89eb666ab5383e529", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077574, "uuid": "67f20a2b-fe1d-49b7-a9a9-6e71ff87e0ac", "comment": "Malware payload (AgentTesla)", "value": "4699dec6cee1452d190b0c82f7f96c816cd8bb1f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077574, "uuid": "a89f723e-7ddb-40a1-b535-4a100f17c86e", "comment": "Malware payload (AgentTesla)", "value": "69166900a402ed7f0ca405a8c46de27e0d4cae81ffd2395b9c44e8bc9a1fcbbb9b133225ed229ef7ca7bfc5b1629b21e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077574, "uuid": "6c24b500-a7e1-4fc9-85be-cc572c204cfd", "value": "T1E505083DCC15062ED172D629C89A095FF8C25917223CE84750DB3B9BAF63542B7D23AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077574, "uuid": "8dedef55-d62c-4ccf-947f-7b313185f95b", "value": "3072:/w4mevovt/nuKZMZs5jQ8dWbaS6Aa3HOAi/H5ibl09LWYMvn1bpe6V17Th4EPiLE:HDG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781077574, "uuid": "1e177e22-d865-4faa-896d-6dfaa518589f", "value": 795362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781077574, "uuid": "5ef7fa8a-f6b1-498c-9e6d-f6c067fd9d28", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077574, "uuid": "7d85633c-35ec-437a-a8c0-a2aea9d51248", "value": "Total USD $36,477.03.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e08e7247-6492-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781071742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071742, "uuid": "fe2268bf-719d-4aa5-9d74-fadb9b0bd582", "comment": "Malware payload", "value": "1cfc65bf916391dd08196f66bda6653e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071742, "uuid": "69c368b2-0ecc-4307-8fe7-f33c5fc07ef0", "comment": "Malware payload", "value": "1f8f4740d341cedb08d5983b079aa71be643760dd3683c62ee9ffc5268140679", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071742, "uuid": "dbae2d93-517f-4a30-9efd-b9ff8fdd80a8", "comment": "Malware payload", "value": "78beec9f9c16aae711bfcdb7076f97aefe587b95", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071742, "uuid": "04babfd6-8c1f-4329-bd10-28f391c18ef6", "comment": "Malware payload", "value": "4a38786315a2e05ebb6fb1e24d07e875ba7f5aed8f49d096bc97f3fda8730d69280a7896843d7fa24536d9225c7ed91b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071742, "uuid": "180b3be5-13dc-4c8e-b252-8dcdf408e92f", "value": "T13C06D72AABD56C7DCE8A804558F68707C70C086A901B757AFDB328C9A220E4FF545DFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071742, "uuid": "8509934a-c81e-415d-9012-9a46c1ca585c", "value": "1536:g99rs6frfuI6fW949rs66mIxfIff9m9W6s666Js666IJssIusIfqsWsm9WfxfrI5:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781071742, "uuid": "01f667d0-ab56-46f0-8a6f-1b5b8b045e87", "value": 3694470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781071742, "uuid": "810f9782-ede2-455a-850d-9746766e56c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071742, "uuid": "f70fb508-f381-4c00-9559-4c74d3bedef7", "value": "Amacorfq6826.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae34d096-6470-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781057054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057054, "uuid": "95552ca7-0b4b-4001-a8b8-13f03dda913c", "comment": "Malware payload (Mirai)", "value": "b7fee2773d8e21364bcbe0fa21f9c613", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057054, "uuid": "89809459-f56f-4c9b-9bc9-2930e872e353", "comment": "Malware payload (Mirai)", "value": "1ff551e8f438916ede668ea1a388df93ebc9786a9c1e40d1bad7dd35490aa3fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057054, "uuid": "15a76178-6cc9-480c-98bb-67b7c837566d", "comment": "Malware payload (Mirai)", "value": "2db6df63e3c3d4cf3c5e0ac3ed7a9513a5440723", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057054, "uuid": "53388bdb-c7aa-48eb-9836-59fba8e5ac2c", "comment": "Malware payload (Mirai)", "value": "d54b5a10048c9157ad3d940146d7073d5b921603cf4e43a4c1523083da7db95a83eaf16b28719498900400e6bb4e8983", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781057054, "uuid": "bc1e6eaf-4819-446c-a27b-d15e8477987e", "value": "T1DFA3F885F9504B17C6C752BBFF4E428D7B2A1758E3EE320399156F20379B96B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781057054, "uuid": "b135b181-51fd-4947-8335-129c993c207d", "value": "3072:Si4mFfy4qVKj2KwTf4ADUpSSSSSS+I0s:LFy4qEj2Kcf4NpSSSSSS+I0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781057054, "uuid": "b6d82e60-8097-4158-bc80-dba9cca458d3", "value": 101196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781057054, "uuid": "5751e36d-f844-4152-a0ee-e1a56b5372f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781057054, "uuid": "30f0621c-eb0a-46a7-a27e-93b5b80a112e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded6697e-64f9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781115977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781115977, "uuid": "3a50ad51-3976-404b-9774-5b1025dc7590", "comment": "Malware payload", "value": "56a7aa33be5bf39e3e2d16bd541fce32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781115977, "uuid": "0cbaca48-768a-4db6-b4ab-ad2a120dbe26", "comment": "Malware payload", "value": "208de02eff5e40eb46a6cafa857355b8292a7078531db690b6844f5a49445eb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781115977, "uuid": "58543439-54e8-43a7-978b-7480be5f4d16", "comment": "Malware payload", "value": "4753beb0e5094df26123f9b53316da62a0e17fb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781115977, "uuid": "92be92d9-84e5-4839-ad14-7df0861e4815", "comment": "Malware payload", "value": "6d807d9f87da02ebd02cd630ae246a0352e5791513533e07b9e5190786cde20b505e5395c8e666faef06b0e2d9ff8ee0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781115977, "uuid": "b9ef199b-7f92-435c-8c77-bdfe383071d4", "value": "T1254723D296D553F8D3D3CF0492DB239A83C171AB976A851E36C678032421C978E8BD7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781115977, "uuid": "3dc39b8e-72a2-478a-b87f-45294b0ecc65", "value": "7afcef5018ccc5c8d49a8d9339bab7b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781115977, "uuid": "8d203677-41cd-4f56-ae3d-a5bd883f36e5", "value": "393216:0k8xY9C1ZkIMUx1lhgVrBZUv8TFsWJ6/5vTxeSOyZiZYN4r+h5B:0ugMBgETFsQ6/rOuhN4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781115977, "uuid": "27e64634-f182-4d11-b23b-6146a42c7733", "value": 26009096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781115977, "uuid": "1aa0bc72-4398-4937-8c86-b45490b07a60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781115977, "uuid": "3f9b86bc-3c2e-47db-a7e3-f2125ab492e3", "value": "Forza6ModMenu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "271c57b0-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1781108797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108797, "uuid": "461bbef6-ba1f-4400-ac9f-bc15e77518fe", "comment": "Malware payload (VIPKeylogger)", "value": "b58d11170461a901399fecf7bdf37790", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108797, "uuid": "c416e920-d543-4edd-99e0-07c78e30b72f", "comment": "Malware payload (VIPKeylogger)", "value": "210170766b751c666c3d6a9588a7c990a69e8c634a878efc224ff586d6424e94", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108797, "uuid": "52446361-39e8-48ff-91cb-7bf40db52756", "comment": "Malware payload (VIPKeylogger)", "value": "d953832f6321b6ad8ec454ce735e666ea2df03b4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108797, "uuid": "06368c6d-1851-4b7b-9ae0-0b66295efb21", "comment": "Malware payload (VIPKeylogger)", "value": "d9620d25746112f206731aa57ae8250bc93c3f833a0f128692a19e92f8a98b39ff89f37fd1370e9180a74fb7f9af3876", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108797, "uuid": "2403ab66-0a11-4f05-b717-625fe8c97026", "value": "T1BDB57D892666FEA5205E3EBAED3CDC0776D6CD9306F50D5C753E485083C809B421BBBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108797, "uuid": "2d31c721-defe-45ad-8d71-9eddce74666d", "value": "384:MNeybiF0eEmqN8r6RBPhEck0RPluPQxRPgQR2+ZjK7zfOZP1FcO/cPmZ2haZiUUD:bO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108797, "uuid": "88f580c6-4f2e-4dcd-b119-42bc2a97f6c7", "value": 2338157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108797, "uuid": "b08b8fd5-7244-4bc8-b8d0-ec4751f9d4ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108797, "uuid": "4fcfb522-a4a4-41e5-86ee-237b3e16ac69", "value": "PURCHASE ORDER_00234.PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8006c0a7-64d5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781100356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100356, "uuid": "a84cfad7-4602-4f3a-81bd-f4e0f6d4469f", "comment": "Malware payload", "value": "74cd4e80b5938fe1da7efdb2aa41ed75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100356, "uuid": "52c7f050-c059-465c-b924-e03b8ef16252", "comment": "Malware payload", "value": "2138ca3baa19603e412f6c3bf654b22cf94d6fbf7347c1dc4f8565ac11dce5e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100356, "uuid": "d9c25b14-972d-4362-8ebd-166f21ec80e8", "comment": "Malware payload", "value": "ebdfea29624ca009e3a2cce111522442e7837b9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100356, "uuid": "3a841446-e317-4b2a-a2a7-db5c1c27a3aa", "comment": "Malware payload", "value": "dfdb08b606d8c323da7b3a3e1ea33dd0a0e92fcdffd8db3c4c99c5c28fa89b160d42c7a1b82ef106d01482c73187285e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100356, "uuid": "6c4fcefb-3bd8-4788-8d09-7784be743d7a", "value": "T136E2194AFD40AF05D4D4667EFE5F520E33231B68F2EA7201AE105B246B8AD5E0F76905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100356, "uuid": "345ec0e6-ec6c-4b3f-aa95-46f539bbb2da", "value": "768:2Pynesh8ILijHxnkIUZxXRleef7kc+mYMjGh2i+tPSV1HS3:2KnyIL4hlUZxLeG7kc+mYmGh2i+BD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781100356, "uuid": "67b34192-0f1f-4bc0-b438-b134eabb627e", "value": 34076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781100356, "uuid": "4ed2d5ee-52d0-47d4-8f7b-068bc3a7531a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100356, "uuid": "d73b7c35-a69f-4369-b6e3-bc9e86779bc2", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a57af9-6511-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781126316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126316, "uuid": "02e40705-37e9-4c5a-b07b-ab75612638c8", "comment": "Malware payload (Mirai)", "value": "7d1f1b0efa90fa52eb231bd9bf46f47a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126316, "uuid": "4401d64d-d5e1-4703-b262-a8e45eb645bf", "comment": "Malware payload (Mirai)", "value": "216fc7dd5e7efae54b10a1b65a940ac28abf952ed330e745129fbced35bfda1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126316, "uuid": "41d2687e-37a3-4e2a-a5d7-f30705f497c9", "comment": "Malware payload (Mirai)", "value": "865c54dca712c14190c0dca2cbdb8d0497ae9e58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126316, "uuid": "4eabc894-c6e1-4e48-9a3e-1758237b8c4b", "comment": "Malware payload (Mirai)", "value": "704a08a05a0004d76e09a95dfe5caf8a1b8086c48fca1ec29bb974b80df0e2932ee0948e29813cf6d841d8b53592fe6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126316, "uuid": "76be0af7-4c53-436e-8c6c-ad57f442a989", "value": "T126434B0232680E17D5A21EF5353F27F083EEED9121E4F689254FC796463AE33458AE9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126316, "uuid": "03c753fc-4e5e-41ec-a159-2eff908a488f", "value": "768:vETst2s/uhZo7Fgbb1vJdQ/uQ4GgLK5302vyeLr6QjMXjhu6keoSnuNRvVx:2hrb1TY2yB2foSnEdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781126316, "uuid": "800458af-41f5-43ee-9209-c17600fef033", "value": 55604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781126316, "uuid": "3ce18874-db97-4bde-a708-2db311ac3cca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126316, "uuid": "8b5a6136-084f-41b1-8c99-391831375a7c", "value": "kwari.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f58420d-64db-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781102851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781102851, "uuid": "bca7ecb3-faad-4acf-9c9a-aa8d6ea58c37", "comment": "Malware payload", "value": "92c6cb31299d8b65f3cfc4dd0bc06f11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781102851, "uuid": "e64f330e-c472-45cb-b956-c88bc02bb9fd", "comment": "Malware payload", "value": "21c7e568e8247cfde8c3c7f96bd80a1bc256f7181206dedeca231dcb7b2fa1e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781102851, "uuid": "1909ccd1-a212-4131-a70b-2cfb7c81865c", "comment": "Malware payload", "value": "606e2983306fa4218485098478c7085af7e28aaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781102851, "uuid": "add644d0-1cae-4416-8c6a-7b9878328a23", "comment": "Malware payload", "value": "90c757401062a6f42732bc54205780f7e900e8003c27ad662e262c39e09f8b5f2e8e0b9c20bb68e718fc226cc6533fad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781102851, "uuid": "bcb369bb-e420-4ce9-beb4-6b0c22ada18f", "value": "T1D686014BFCE11CB6C0AAA2314966A155BB71BC452F3223C72E50B3B82FB27F09975754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781102851, "uuid": "dcac8b97-8ac1-4f76-acd9-d43d1b7a7c55", "value": "72d8fd7d53a64b79a1028f9534045520", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781102851, "uuid": "8fbb12f0-a67f-4eb3-a328-f935ad78fe79", "value": "98304:q5FrxZuQFHYkU5io4xOVpSrAdNIAL2SKjMVRKtNGvMed0kqDML6chHtnIrXyfnbA:q5PZnlBJATFAgKnGbd0kqEFhHtIuTbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781102851, "uuid": "5e6564cd-28d3-45d6-84b5-7efdd31aeef6", "value": 8278992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781102851, "uuid": "4b51bcb0-0f00-43e9-a591-f09d62136533", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781102851, "uuid": "0866bb30-3ce3-485a-9fac-e19d6a7a40a9", "value": "wingup_ext.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "521cf920-64b8-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1781087823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087823, "uuid": "d14101e2-5862-46d7-a587-e11ff616ddb5", "comment": "Malware payload (PureLogsStealer)", "value": "b686c957acda222cafa523b60ac62bfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087823, "uuid": "138b8efb-f8be-4570-b6c1-eaeb93ce4702", "comment": "Malware payload (PureLogsStealer)", "value": "21ebfef3bccef414a12aae17947949773e6dee6bf283b11d8756ac2ee2509241", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087823, "uuid": "dea342f5-e7d1-425f-8c8e-4513cccae644", "comment": "Malware payload (PureLogsStealer)", "value": "aa250c82a675fbe4792b991c2f8cf983edab5da0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087823, "uuid": "0b4a1fee-5bcb-4082-bbe0-6763ec1dc69a", "comment": "Malware payload (PureLogsStealer)", "value": "ca600cf34d35d0602273be90875d356a8cf55fb195afda0c8a64b5b9a49b192beb9720f48bc8362e7ce4a4b207d7fb90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087823, "uuid": "49a743f5-8a51-4009-8d8e-1e1026ef1205", "value": "T1E2F4AE1B36968E11D2885232D1D7050187F269877A77E70EB68113DB2D033BBEE4B7A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087823, "uuid": "24c636bb-23bb-4303-a918-a1b9923c6d87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087823, "uuid": "476d33ea-8a86-4148-803c-4053ed8941c9", "value": "12288:mBbzbF7Lzk0x+2WX3JmUMbLZsN1Eu6wgFh5CFduij3:Ax+2WX3nCLZs4wgwFduij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781087823, "uuid": "502b0cc1-ca58-4943-854c-96af42383f41", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781087823, "uuid": "e40d0a9f-a0c0-4151-af51-733bc1ada9ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087823, "uuid": "ad66a2b0-b992-419c-836f-f5599e20e55d", "value": "SecuriteInfo.com.Heur.MSIL.Benin.5.11546489", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f0b6b2-64b8-11f1-a769-42010a9c0008", "comment": "Malware payload (LokiRAT)", "timestamp": 1781087988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087988, "uuid": "76c3b969-3983-48ee-8f90-2da0ef6c3990", "comment": "Malware payload (LokiRAT)", "value": "d9934d57e1e37f09b0d09d6f845a14be", "object_relation": "md5", "Tag": [ { "name": "LokiRAT", "colour": "#17B4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087988, "uuid": "b7ebd46b-c9b8-4bb4-9bb5-69dccab44685", "comment": "Malware payload (LokiRAT)", "value": "21ec3bd2644b08eb5dfea8718c98a786f11aaceb041bfa29fa550b70dc763e02", "object_relation": "sha256", "Tag": [ { "name": "LokiRAT", "colour": "#17B4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087988, "uuid": "e0278e14-5032-4368-9073-bafdcfb40220", "comment": "Malware payload (LokiRAT)", "value": "efe937ee2c72d794237e46e52e15948c3c443768", "object_relation": "sha1", "Tag": [ { "name": "LokiRAT", "colour": "#17B4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087988, "uuid": "cf2a0d58-4623-4d26-934a-8582d01df339", "comment": "Malware payload (LokiRAT)", "value": "ac06cdf46e03a44282889c275ad0f8a03e94496ee502a6ec300360eb14ae91b3e2825ff78c79f65ac7322c566f4dca3b", "object_relation": "sha3-384", "Tag": [ { "name": "LokiRAT", "colour": "#17B4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087988, "uuid": "e37ff9d4-0cfb-4f16-ba73-4e7a252f794b", "value": "T11DB2180ABBDC4606C07F5BBDA8A203880772B755AA31DB4E0DFD506EB931B849351B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087988, "uuid": "33ffb6ca-486a-4f7a-89af-57898f44b308", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087988, "uuid": "5ad3a640-a1d0-4e01-9ad1-a5b4fe515f82", "value": "384:xxZ9lLeU0bLi+QqZBv78lRlagjQRH/Ns5KTQqE9fMKADlacyQNbXzKrwomOBsjhe:J9EQTW0qE2ozohWMTddq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781087988, "uuid": "e6505445-71a9-4fb2-a359-a58b0f00b9c3", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781087988, "uuid": "fee1a448-2b00-4591-b7a0-f3714bfeda39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087988, "uuid": "368f1562-0e5d-4a6f-92e3-2ddea0e9278e", "value": "hitclub.nagoya_09e7119e_k_discord-setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d60690-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload (PhoenixStealer)", "timestamp": 1781108818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108818, "uuid": "d0f6a05f-a5df-4704-93a6-14037e050b42", "comment": "Malware payload (PhoenixStealer)", "value": "974b38a09e23d7fda7f493495397376d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108818, "uuid": "828e4d7d-4c11-4058-b039-6a89f4b5cf84", "comment": "Malware payload (PhoenixStealer)", "value": "220a9b6ae51dcfa91fc56516178c62bca535ef8f1db792aa863d442066f50691", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108818, "uuid": "593a13b4-01bd-4602-90c3-2e1dae2186bc", "comment": "Malware payload (PhoenixStealer)", "value": "71b958483d633f279b1d10cd4253792908df9430", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108818, "uuid": "f5be4d66-598c-43a8-8f56-29fcfba4da9d", "comment": "Malware payload (PhoenixStealer)", "value": "d93defeebe7a6bd70de89e3b216cb16643dd0eae3428b048218bdcc7cdc5e5d8d274ccd0a7f36f343bca04e824dc0959", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108818, "uuid": "79aa4a7a-5112-4113-b0da-326398bc792b", "value": "T10C35173DCC19062ED172C62DC49A495FF8C2591B223CE84760D73B5BAF6358277923AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108818, "uuid": "3b9142e2-6ef9-421e-9773-149165931e91", "value": "3072:73wklwPNMEM1cfV3bXDqccF66lOZt4rvtayE2QjleeAlzaI0EDv5mXEVOlc0CK8X:HJjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108818, "uuid": "a96c5fc7-8f8b-4e49-9edb-cd460e255d81", "value": 1161970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108818, "uuid": "53b7ec76-4768-48a4-8f03-90182307c700", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108818, "uuid": "65f7cd57-bfae-411d-80bc-2e7bf7b9b38c", "value": "REQUEST FOR QUOTATION - PO 4560195966.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a319fd-6504-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781120651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781120651, "uuid": "4d51194f-aa13-4dab-9d7b-008f8408a722", "comment": "Malware payload", "value": "441fb26acdb99e77a453989f320524d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781120651, "uuid": "05e5e3c7-fac1-4331-8b98-7e34e3c0a3dc", "comment": "Malware payload", "value": "2230e84336ae833bd9565144ea5a9f78edfd8979b8f402cce80750bc960e6f11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781120651, "uuid": "a4c8bd9e-60aa-4311-b7f2-37c44a4698ce", "comment": "Malware payload", "value": "fb9fc5c9e354f8820a00f093646533bfe18021f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781120651, "uuid": "d4e81c91-24f2-474f-8025-5ec46c477ee1", "comment": "Malware payload", "value": "60b03a435c4a59bb583edf127a96b0721db9f4413d3616a90ac5b855b1884d2d0f6f690cf166ee00711ef5ac72566653", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781120651, "uuid": "71c70d4f-3375-45ed-a6ee-7b3197deace5", "value": "T1E667AD07A3D805A5C467DA34CA559332F771F9624775D18B0AB9C2062E73AB28B3F732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781120651, "uuid": "0907ff71-adb6-4639-9777-ead7b6a261bd", "value": "7ee452d750f91391f49bfa5124344ea6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781120651, "uuid": "96f67153-a4ad-4cc4-975b-d768fcf2fb08", "value": "49152:pbYizX3zuqkPO0TwB2+a7Pz1/brzbPQTUZR1OEbUmgI48Hu:FnMpTguLPQTUZR1OEbUmgI48Hu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781120651, "uuid": "79141325-b3a9-47b9-9b0b-0c6461a2545c", "value": 30096896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781120651, "uuid": "59b0f135-08f7-4496-a295-d73a1727e98b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781120651, "uuid": "c0bd0393-f9ad-4009-ba8b-bbf843dab649", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ee0c05-6493-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781072016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072016, "uuid": "9cca385c-f80e-4f83-914f-c09191354dd8", "comment": "Malware payload (Gafgyt)", "value": "257b414ab5484dbed80357257377cc56", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072016, "uuid": "8dfe7722-8938-4c28-b6ba-a82a6b7626da", "comment": "Malware payload (Gafgyt)", "value": "224e816a941c7311ef77af5cf1b854b99b02f496c17e188d236257cac0836bad", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072016, "uuid": "69267852-6b6d-4dbe-b770-a2bcb2b27a00", "comment": "Malware payload (Gafgyt)", "value": "87746f96b0a143f7510fa55370f56e940004c169", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072016, "uuid": "3d7865f7-ef2a-4c9c-82d4-622606416052", "comment": "Malware payload (Gafgyt)", "value": "c8fc1ec01934ca8fbf1d380a20b75fd838c14a66b648e4544c4b1276841137382b5f61062f24e7b7e85fcf1c910596ff", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072016, "uuid": "b8e4d753-9e8c-4db0-a3bf-4a09e43fead2", "value": "T12CB319037B0E0F83D1573DF02A7F2BF1979ABEE215A4A184651EBDC062718B32595ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072016, "uuid": "80ec0310-8430-4c99-b151-0868dbc37ee5", "value": "3072:itIQYiaM5Gj8iONrEZfODakSFG2wlu5h7pLg:iCQYmDrEZOdYG2B5h9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072016, "uuid": "bef9a445-38cf-4113-9e33-0a5ada29b0a1", "value": 107848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072016, "uuid": "a7815d9d-dde9-4dd9-8c87-0a17dc86f564", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072016, "uuid": "8b3d92bc-8604-45d8-b205-427729cfd9ef", "value": "FBI.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aedc1ea8-64ac-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781082825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082825, "uuid": "c784b26a-26ea-4f78-840e-70e023fc504e", "comment": "Malware payload (Mirai)", "value": "a900a66ec8ec13cc52b459219812736f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082825, "uuid": "741a4a8f-305c-492e-a899-f63c0946d472", "comment": "Malware payload (Mirai)", "value": "22e2aa4da0872bc85c36feccc4935689a216f467d1aae50f1ca24ae726234903", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082825, "uuid": "bb10adf3-eae6-4353-ac9e-3362ebc99c71", "comment": "Malware payload (Mirai)", "value": "912e0ededc7c3d36a090ece883a5d52968fa541e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082825, "uuid": "dbb7031a-512a-462f-bd72-6b1defa65dcc", "comment": "Malware payload (Mirai)", "value": "bb1ece1e5c9557d4fc5369660aabd37bcbaca7d42dccae25a78627c0701d1930f78500868af34bcdaf523c94c1488924", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082825, "uuid": "0642497a-fbeb-4776-933d-fbebeec450df", "value": "T10EC33A07B491C1BDC4DAC1748FAEE61ADA33B4AD1234B11B27D86A372E49E311F1EE54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082825, "uuid": "58eb13ec-67bb-4c5b-abc2-a27ecffc049a", "value": "3072:zb0N7JGdSqKlvU2UNLaMFnFEz7zzwaPEZ:zlluMY3sKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781082825, "uuid": "5e302024-03bd-444f-b9c3-ffaf17f6d78a", "value": 126488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781082825, "uuid": "f1a91b94-ee09-4c59-8739-0fae6fcde652", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082825, "uuid": "5df90b47-7fa4-41a5-9bfa-87f9a98f4fb9", "value": "CRY.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e7cb42-6473-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781058381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058381, "uuid": "c91ecce4-8aa7-4aba-aa62-80a2fcb48c81", "comment": "Malware payload (Mirai)", "value": "4b66956b74bd70f078b61c5e50ddc746", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058381, "uuid": "17963741-d763-43cd-9848-d8c6896cf4ee", "comment": "Malware payload (Mirai)", "value": "22f02d2e7e720571713b69a84b1043d735f497d16ac8e54df0c6e91d12618d4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058381, "uuid": "d47df684-df27-4168-a74d-50e60a3a3abd", "comment": "Malware payload (Mirai)", "value": "c715ec4e285aeb350e800397051bbaa519ca7435", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058381, "uuid": "0ed235c0-e814-4a11-aa7a-5664d8643d7f", "comment": "Malware payload (Mirai)", "value": "00bb0fa50f3eecb67883ad8fae4db641d14f2c784436a031e6ef961322b6fac315744eaf622e00d9c7aa88117336ec33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058381, "uuid": "24690e9c-a4f1-4972-a291-7247179abbf5", "value": "T146B39E9FF64B1550C82147F01BC38B9E3E236311CE57E8E72C5EA23A24756DB5E0A792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058381, "uuid": "71362466-c3e8-4a02-9b13-f96bc37d9b9e", "value": "1536:oHnYYgKhZvAfwgNvlNKKGvtNYlyG6xGiCULI/2nDtDkQg8x/LWb:ofNwwGPKRis3PA/CDtDkQg4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781058381, "uuid": "c37108f0-8bfc-4b2b-961f-89bf5f9c8e6c", "value": 107668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781058381, "uuid": "1a90cd14-5ec1-44c9-9cd6-da52c738c1c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058381, "uuid": "91a6392e-e658-4aab-a3af-0a018418812b", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc8a596a-6520-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781132670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781132670, "uuid": "833be4e5-f6c2-445e-b7a0-ce397908b804", "comment": "Malware payload (Mirai)", "value": "051a6f9b40d16aa10209ed0c9831d7d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781132670, "uuid": "b97ca8ef-a2a0-4dfa-a393-92e481dc98e8", "comment": "Malware payload (Mirai)", "value": "23ca0d1a044830b673f75679ec7ec7c8aa3c4d511831bfed854d141f829563fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781132670, "uuid": "788f8f1a-62ca-44b3-ae50-e04b42583237", "comment": "Malware payload (Mirai)", "value": "1cac17cadd2646b71080a5403421bc1a135e19e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781132670, "uuid": "04c87c42-e5f3-4d53-ba65-81b8f1f2627e", "comment": "Malware payload (Mirai)", "value": "c76868a380c18efab82ea92f3f75f32598a687df8acd2997fcf92930d6617aa2ea408207761267ad9aafea94cbd0b005", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781132670, "uuid": "a51560e3-451c-4a33-a145-88ea6f3d97d3", "value": "T140636109BF611FB7DCAFDC37099A1B4524DD651B61A83B29B930D818B31B24E1AE3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781132670, "uuid": "169efe31-9593-4dd2-82a4-26361330c7d1", "value": "768:H2VhIeinFse5OTIE1nq987htzPyeQ5LVeqeS/eog6uwZ7dNVXirp0iejTgCu/:H2VhIeJeaPlc8Da3zXj/fg6tZ7daegC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781132670, "uuid": "a9e928b9-8fc3-46fc-bbf5-cb4168fd0897", "value": 67744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781132670, "uuid": "2fd1bf30-39b8-45be-8a30-7530d6a89922", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781132670, "uuid": "3d6a6c54-0434-455a-b431-0308c5c93f97", "value": "xd.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "025103d3-6495-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781072657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072657, "uuid": "83ebd6a9-4683-4874-9ad6-9e2a8e150134", "comment": "Malware payload", "value": "c24253aa72007a01026e6246509aa1ce", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072657, "uuid": "d0b6f56a-65c7-43aa-8496-03906ba15c5e", "comment": "Malware payload", "value": "25aed7f9abb99ed7e2b73f24592832e168b364e5eb06bed9b906722f6ab005b9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072657, "uuid": "fb48ce56-a90d-4bdf-b90b-48c74ca4f3a1", "comment": "Malware payload", "value": "5e6041eb70eeeffaede8351ce62b080e266d79cc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072657, "uuid": "c5dd4eeb-9924-4bd0-a7bf-ff2682cd58e3", "comment": "Malware payload", "value": "c920ed17aea0a24f11fefbb879a6915e1cc5f2c09db84bb4497ae6081fe017a67fd75547beb5316244184c38bf4d70f2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072657, "uuid": "659989a6-d7cc-41e4-b0e1-e6e2221fbf44", "value": "T16A313B95705099F899AE4566FCE38425304D124B06001C7DB69FADACFF74D81F1EA299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072657, "uuid": "e560ca33-7e1e-4ea0-ab95-bf8a6d4f5393", "value": "24:Vj19TakaApnq07ndttF13FXFndttF1CpndttF1t9xPndttF19BAvndttod/t8yzT:B1okTf7ndrF3VndrFSndrFrndrFevndC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072657, "uuid": "fae96841-693d-402a-993b-e0f4d5878909", "value": 1503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072657, "uuid": "80cd5305-a591-4d40-8655-4478c08797f6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072657, "uuid": "e54ab9cd-14e0-4489-ae65-c697e865d567", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37118f8f-648f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781070169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781070169, "uuid": "a65ddc14-c96c-4a0a-961a-bca7d7e2a916", "comment": "Malware payload", "value": "d7abf4c35c04f07c82ba9bb44256b6e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781070169, "uuid": "cf9effcd-cb92-4c34-9d6a-43888e52f770", "comment": "Malware payload", "value": "2617cce97aa2e70ac1871b46e4217567702a8c22979d5413ad46c28a150655aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781070169, "uuid": "a71ad1bf-ce32-47ce-8dcb-a0b9ca9f059e", "comment": "Malware payload", "value": "37504830274c77468061b68375ef59a3df72762f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781070169, "uuid": "87fbc711-3979-40cf-87e6-4b3c8d5ccd87", "comment": "Malware payload", "value": "dbcdf65b6ea2c32560248ed2e19326624bc9dbec6379e14c7762a46efcc38e0b6311820a53ba60a780adae57ad7d50c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781070169, "uuid": "b8a6a782-01a8-4060-8333-73f9cce8b87b", "value": "T1E19533C8DF287D2C9CBD24C9F8CD5D9B558A8578840E5E13D02F9B8B26C748529827BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781070169, "uuid": "cdae26c9-e220-4119-9bc9-a7b85f7aaf16", "value": "49152:blM26MU4D2Rm0E1LN7Wh2xzb73u33z2IF1vcnw4hcER1:blMoX0mlb73u3CIFdcGER1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781070169, "uuid": "84540a71-041d-47b4-8a90-4b1594bec8ef", "value": 1960528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781070169, "uuid": "aa674931-4a22-44bd-bb9f-ad313c8ed88e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781070169, "uuid": "f55f9d6a-37e9-434c-9ff5-853c6d063770", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c075a028-6513-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781127093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781127093, "uuid": "834a3cda-c643-45a4-ba6f-2aa3ae8039c8", "comment": "Malware payload", "value": "42f99b78ae7e8209f5c8450c746bb62e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781127093, "uuid": "82290245-f455-4320-a91a-472e6f08240c", "comment": "Malware payload", "value": "263a01a4757a908020ca1a8c639b72db94bfe19ec174d2d5495c80fb007f65c6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781127093, "uuid": "08fc0f3c-2ef3-40aa-b9fe-b288e4079484", "comment": "Malware payload", "value": "fc829395d1ad5537cb4dc247f87948e6421b62a0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781127093, "uuid": "f6e9a851-99a6-4399-8982-c784d9b722df", "comment": "Malware payload", "value": "8270f3855b038e0acac55dc8da283edf362bd67f0c65e4af357fa0f16648186aa4f785c5bf34a204bfb6fe2979291d11", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781127093, "uuid": "76df83d3-3368-48c7-9907-49b51a7d795b", "value": "T14CD097A29323033084628C21F2C37A00B2140B3EACDA835ABA2B98B21F41788F1D02B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781127093, "uuid": "c29e4aa6-169b-4c87-97bb-0ef9fe8d91c4", "value": "6:hTlVFnaKJeepKlmccWgl0DHAulNXYq4HvXDG+NjVsNXYrkJ:VlvaK8epKlmcgl0bPiq4HvXDGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781127093, "uuid": "706e48f1-702e-46ae-8e16-25a7c22fe0eb", "value": 263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781127093, "uuid": "fe74c0b2-24fc-4d70-81e7-a117553c9c21", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781127093, "uuid": "be56f373-0e4b-406f-8644-1ebc7e4e99b2", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08cceba2-64cc-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781096290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096290, "uuid": "8ce532df-e069-417b-b768-4709718aacf1", "comment": "Malware payload (Formbook)", "value": "349f2510c17263d4dfd3a4f76af6de47", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096290, "uuid": "d3586602-599d-4bdf-aa5e-a654241e560b", "comment": "Malware payload (Formbook)", "value": "265d12ace3e4a41c759987720c123a55bd6ec59b87aefe921ddaafa6e89e88a4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096290, "uuid": "bd9d9467-52bb-4ccd-94a3-639d475b01ae", "comment": "Malware payload (Formbook)", "value": "b9eda16a14765ae5113f4bf0c967ad2fc1bebe52", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096290, "uuid": "6f257942-670f-4b3c-9552-dc791e7e245a", "comment": "Malware payload (Formbook)", "value": "cf37ed2fb1807dca5f6ce671661c0e66d1a33c75298c1dc737a574878c52c2b0286207d840ecdfc8ce29dd0bb85f1828", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096290, "uuid": "5e95786f-4272-4f24-a60e-59eab369e88d", "value": "T1589512FE3506679358D5B339BC4AEFAC7242FC01292EF67E291844BE1494FC904B3999", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096290, "uuid": "19894ad5-c3c2-41a4-89d8-52443dbf49a0", "value": "768:eqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqm:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096290, "uuid": "983664ea-08b3-42f7-9c8f-5cd9a39c0426", "value": 2028801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096290, "uuid": "aa5cddac-ab0e-4b02-bb24-2f7d3de09fd8", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096290, "uuid": "3851f6cc-6c9a-4761-9ed9-dfbee10aa189", "value": "Qot220190402606.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac23898-6492-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781071651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071651, "uuid": "9a8406fa-c212-430e-8347-d54f8b3807ff", "comment": "Malware payload", "value": "4ad327b5184f5575963de122cc6265bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071651, "uuid": "ad5bb196-b1d5-4a79-b2db-136f3d4dc68b", "comment": "Malware payload", "value": "26726414e4fb4e5062f0b9d9d99f768396f1df243b8a51155f80c46d904a5f99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071651, "uuid": "85b42f89-3b94-4359-94b4-3a34f60c8c34", "comment": "Malware payload", "value": "7b0ed1e600f83b00b4cf3843e22c57603598c12d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071651, "uuid": "f87df323-c990-4c24-8e7d-34930ef26442", "comment": "Malware payload", "value": "23169e0ffcca3b6d32376bf5ddc614ccc8c97ad4352d206e74395730152d82370d385a00f6e5ece9d4347ea0fe88f2bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071651, "uuid": "d79b8d83-1c66-4b8e-b86b-70cfd7259daf", "value": "T18AB2190AD7B305BCC89DCAB1C26751436EFE38071B90BAEF67A12618BC707D46538E65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071651, "uuid": "616311de-f673-43a9-8a35-e6e0bd4afacb", "value": "50dbb2e4ba4c1d0f3b238539dbdcaca2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071651, "uuid": "e1a48d30-ecec-4ef3-9be2-48541a81002d", "value": "384:/DK7zSsF+zgguJBGxwK4g6VU7fsvPtUxvwgLxIzY9DIXiQlTRru+e8ZYqAAAAAAe:rK7zSNzgguJBwwbTWkvPtoLLxFRUlVej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781071651, "uuid": "cf3c38c0-50e6-4811-863a-cba74cb0cb90", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781071651, "uuid": "1eade64f-8405-4f63-97d0-f849fce6fd68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071651, "uuid": "9919bf5a-ff14-4c1b-8fce-da410505d52d", "value": "XEROX-MT-07062026070706.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4c6c148-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105652, "uuid": "a8af22de-b4f0-49eb-a645-322633dc1ac5", "comment": "Malware payload (Mirai)", "value": "c3b0de39ae8f7c2148b259947c36ff42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105652, "uuid": "80a49d7c-7f11-45c9-b5c4-f17279cbdbf9", "comment": "Malware payload (Mirai)", "value": "26c6c4be76686345af9b90d1dfe0f62bb11ed1874382d7f32c73ce1f492d869d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105652, "uuid": "de30d779-0e1f-4d0a-b414-9e9fc1de16c3", "comment": "Malware payload (Mirai)", "value": "4fe5e065424b8041b2358785b24e3f6502b26a70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105652, "uuid": "a1d80aa6-8985-4154-ad4b-3fd4b92f28f7", "comment": "Malware payload (Mirai)", "value": "f398306464a50a8d4e3f1d563b8d0b78c826f7ceb72cd078f6c04c41e89db8f526c2297825666524624bb6cf23dca68d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105652, "uuid": "1cdad402-7db3-408f-8fc2-dfa07c12675d", "value": "T13CA34B36B874192BC4D4A47E22F74721F5F247D925A8861E7EB20D8EBF206403653BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105652, "uuid": "500cbd29-758a-47e2-b1af-b57a4bc64346", "value": "1536:a7ZpFghRWSbbmLOnzavBUgOl2OpT30kbekbRlM5RAPwTTnt0ozj:bbbmPTO930bkbRl886zj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105652, "uuid": "40ec1e25-04ad-4829-be8a-077c182263ad", "value": 100192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105652, "uuid": "a71df009-2e03-4637-8c2d-95ae8878975a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105652, "uuid": "a557f530-8b6a-4a1e-a03e-f7516dfe849a", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a3d232-6478-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781060395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781060395, "uuid": "68ddda72-2021-401f-b3c2-648d83f7aad6", "comment": "Malware payload (Mirai)", "value": "3e5ba9fb5b0b95c2c0c7fd4e218d666a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781060395, "uuid": "3f46d3e8-9a2b-453b-b438-5917f1e87155", "comment": "Malware payload (Mirai)", "value": "27178e445fe93ad5deea8291e4346900c21c115e00b4bbaeae50d4fcb1b1ed25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781060395, "uuid": "2efebb79-3b88-4ea8-bb94-f37a5217c8a0", "comment": "Malware payload (Mirai)", "value": "ad53ad1cd1492288cb09c882d1691ff711846775", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781060395, "uuid": "c0fc5c86-9aed-476b-a9e6-30e195b02953", "comment": "Malware payload (Mirai)", "value": "d2c67ab2deb8afe8fc6dfb55946d5c90cfd5578589ce6dd42d60ddedbdc956c32adb2b3c2b2dedeeade11c58dc97f9ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781060395, "uuid": "9f6a185b-bd44-410b-8fe6-cce92a1d1d0c", "value": "T135F3F756B8819F16D5C152BAFF1E528E33131B78E2DE72039D246B347B8B86F0E3A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781060395, "uuid": "113ff28b-afb6-4896-8b96-ce2ae5c406dd", "value": "3072:N0gTX25C7JvCcoZXjyZlM128CdjcxagprE43:N08X25IJvCDX+nM1SdjcxaKv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781060395, "uuid": "085aea6a-b710-4e3b-9f1b-d2346bfd9167", "value": 158192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781060395, "uuid": "90f347d7-6e5f-4158-8eea-1f855d0423bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781060395, "uuid": "70a36203-0813-4fbf-bd94-3b4829eb0f7e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41e14aff-6528-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781135900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781135900, "uuid": "69589bc5-9901-43f3-9f57-fd2a3a3acd32", "comment": "Malware payload", "value": "2acd4c3ac4cca5d5366bfa65eb667ddd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781135900, "uuid": "e8cd46b0-51c4-4771-a9c7-3334abefc9ee", "comment": "Malware payload", "value": "2799140b0d69263307f6729ebefd77f32a266ddb3ac91429d823d04208620af1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781135900, "uuid": "1d013f2e-eea4-4ed4-9059-68b9fe8d1e0b", "comment": "Malware payload", "value": "121534b49f5cf4121751ed8ab61896bb1648a26f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781135900, "uuid": "eec52f64-7b96-47ad-84f7-19ed2aabb265", "comment": "Malware payload", "value": "3d7df18f4faac7ba5230178596aa9b933ca72525defa14eb102b68fa1e1d4a54ff76a7814df1a92cde731005ab2a81dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781135900, "uuid": "4d2bd370-4a1a-4991-8bf1-c906bbc727e3", "value": "T1A7E32B05B31D0983E2673EF0373B27D1D3EF9A8131A8F640695FAA899272D321589DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781135900, "uuid": "600ae127-177c-4b41-b981-e9f6fc73989c", "value": "1536:JzU6xfha/OvBoTot/JRFi2UtFzARVxVaqObLPwvFdvAxaXOdq65WaZpqtwLINJoz:D8ZiJ62UtqRVx+PP9xRa7RCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781135900, "uuid": "f889d862-dc91-45e6-8685-b60ccabe2002", "value": 149432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781135900, "uuid": "39eed876-92e4-4c23-bcba-0255a8f6d369", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781135900, "uuid": "c4106e79-0fcf-4196-a9db-012ad0260c89", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a91b98-64a6-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781080127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080127, "uuid": "7ce64177-fc69-4eed-9f20-47e11ba331ed", "comment": "Malware payload (RemcosRAT)", "value": "3a008963387870dec417e1036dbba6ab", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080127, "uuid": "91046d43-d426-4914-a2a5-c7a9f7ce6d46", "comment": "Malware payload (RemcosRAT)", "value": "27c8e25d8a70c6daec82b648f32d2b7eeb0f5f13214e9c2c7a7f1ac9d7507e20", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080127, "uuid": "d915fafd-5fcc-4a37-82be-2d0f05836ff6", "comment": "Malware payload (RemcosRAT)", "value": "1a1e6662f36f182e95fbd4dea538c9713f085acb", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080127, "uuid": "68ed4455-ade3-456c-9f4c-3c6136a50916", "comment": "Malware payload (RemcosRAT)", "value": "d7d3c47b81485f5f7610cebd103c8737a8ca57cc3b3854348945e30e1d2c35f5d541072ac4d2cb9d1defca3fa47d828f", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080127, "uuid": "0cd21cdc-a584-4f6d-b259-788692d345f3", "value": "T111924FA19ECA0751A94B163CDEE83F0477A8CFA1027D14D4F9E42B08B41D47CBB25EAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080127, "uuid": "e3dd3258-4547-48e1-abab-f704c74bc0bf", "value": "192:qQs5a+OvTS8h7Ak3ovsst8sF12idL3+LJFghihdsnWOnjOiPTSCAsjIuO0yCKYLB:qAlvTSvvBF11KuIMxpSwLL2V4RY32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781080127, "uuid": "6fdac59a-ccda-4a54-8b34-0cc96078a2c4", "value": 21024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781080127, "uuid": "12a8bdbe-f75a-4df3-a93d-85c3b29d982a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080127, "uuid": "618faa47-e755-4891-9cbf-a9c7e9186b1e", "value": "Internere.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3821ad66-64f9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781115697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781115697, "uuid": "2855a78a-7737-4a50-861a-162e5d606fdb", "comment": "Malware payload", "value": "0aa7e78ee6377b44bf1e8a266af6c560", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781115697, "uuid": "1d80d113-6864-4847-9fa1-fed1ec51556d", "comment": "Malware payload", "value": "29119d33848a3a3efa1b0b11be3ec606240e47d013c629f5c357f70ab4d77931", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781115697, "uuid": "32c2cd33-3b50-497f-bfde-bbeff697d43e", "comment": "Malware payload", "value": "04e8ba66a6a0866f84306be0bb25e2f5a17b1142", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781115697, "uuid": "feeaeead-eea2-4360-a61b-cd779a643e7c", "comment": "Malware payload", "value": "0d94c8a8c8d6fcb61f1e54f5b0cbd526c07ca0ff5a53b72729effe7b12fc6b7820d2ec755db4746a5e00f16a76cf8644", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781115697, "uuid": "5c2e6847-832f-4734-a2ba-08a900584626", "value": "T140C66B11FADB95F6E903583100ABB37F63315D048B28DB9BEB547B2AF8776A10C66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781115697, "uuid": "1602f1c7-4e64-4a8c-8dcc-37edf07790bb", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781115697, "uuid": "54d7472e-ce38-4acd-b79a-7fe713c07a8f", "value": "98304:ghsaYAe/J7EChHvcFy0FR9/qmr4L3HxmcE5O/:AYAifHe79CWsM5O/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781115697, "uuid": "14aa574b-3d28-454d-8ebd-9eb4c7fa2782", "value": 12572160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781115697, "uuid": "a6b2b46a-8eb5-481f-b325-35d1e848be93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781115697, "uuid": "47a3b4b4-0c59-4498-b35b-39cf48df359c", "value": "Hydra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "365749e4-64cc-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781096367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096367, "uuid": "1c58e809-923c-45fa-b71e-ad38fcae603e", "comment": "Malware payload (RemcosRAT)", "value": "6bde821a2341c99b3d0cbd53e2cf670c", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096367, "uuid": "f38ebb57-0eac-492b-86c9-76e360453701", "comment": "Malware payload (RemcosRAT)", "value": "292568fdf69cebf5ed05e083517f210a0d4d9f94970990968714343a59f7317a", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096367, "uuid": "2304e47e-f91c-473c-a6af-2e8616d9b7f7", "comment": "Malware payload (RemcosRAT)", "value": "b96ce5375fcd68721c19d72b052b105b3b8a893a", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096367, "uuid": "4c34495e-455d-47ed-903f-298c1c4a704d", "comment": "Malware payload (RemcosRAT)", "value": "4988aa16f68704fa172aee796542527db9d6b55766fbd67e2e9d854d19612af8a61b34980c63d324a05f3a74471f1528", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096367, "uuid": "b92d6828-9723-46da-9507-c5b5a5119abb", "value": "T13F85128D8316D8B515B0DA056C2CD908E3AA497F7E481EE34CD044C799F6DAB1BCEF68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096367, "uuid": "9b47363b-c4bc-481f-a760-f068b643319a", "value": "768:zatj4XlaMF/IGPZywsK7Mlaxknkck782fR8WOXTk2jwJyD/Im54Gcegx2c2ccegt:a/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096367, "uuid": "46dbe432-5d78-481d-9bea-6d99f05d6844", "value": 1846252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096367, "uuid": "b1d470c6-ac94-4a31-a051-2e1a82a57414", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096367, "uuid": "4d6befbf-18d2-487b-bb31-0333f411a753", "value": "YA26-1289_Daihatsu.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2648d613-64f2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781112661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781112661, "uuid": "c5741de6-4e71-49bc-9cfe-827c144c1fd4", "comment": "Malware payload", "value": "4480f7d8c83a8483ec03ea4dd6179b95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781112661, "uuid": "e94c18e1-f5d2-417a-a55b-49421c668f7d", "comment": "Malware payload", "value": "2965669bedfa9dada3d7bb77e0d860502ca1f36cf9d2b1edc0bee49fea3bb389", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781112661, "uuid": "7634f251-c1e0-4a7f-8aae-5d1d6c099fde", "comment": "Malware payload", "value": "101ccc3a7197e7a4c40e3167d74cb6106e2d0473", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781112661, "uuid": "16a02ad8-9b61-432f-be0b-8442f2516152", "comment": "Malware payload", "value": "20a2081f16f0b116415d3d4293599a991c9ddbaba0ed44a5e107213476cc55dc469d25e313dc4373b760fcd2ed26ecdb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781112661, "uuid": "7d37c822-dca8-4831-9181-1cf78b08af05", "value": "T18B57CF7792467CEDE9B98DB4C01015816DA8788B4778E3C7BAC870E666EB6D08D3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781112661, "uuid": "4068d59b-575b-4a6d-9abc-9c471c282cbc", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQF:cqYUQuVDt0TZEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781112661, "uuid": "40282b26-0c3f-4aae-ad6e-65c6add96dbf", "value": 28606464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781112661, "uuid": "d09d8d89-22a5-4a5e-9331-9a860ca7ba72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781112661, "uuid": "07f8c329-7c33-458f-a2b7-f88f59cbf2c0", "value": "2965669bedfa9dada3d7bb77e0d860502ca1f36cf9d2b1edc0bee49fea3bb389", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe044fe-64cc-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1781096463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096463, "uuid": "f6748779-7b33-4756-b23f-cb3a7e99b56e", "comment": "Malware payload (BlackMatter)", "value": "0e2e633362c884039a48af3fe148b469", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096463, "uuid": "af1ca188-d553-41e0-8889-088257e7e8cb", "comment": "Malware payload (BlackMatter)", "value": "29aa83fd9f601c6163c0c1b0cd6335c30e726e00337ac1312a7f42d2daffbefb", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096463, "uuid": "cfcfcf32-91a3-4739-9d4f-e811b7030090", "comment": "Malware payload (BlackMatter)", "value": "47306085765724076c0566fa05ca203c3d61f285", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096463, "uuid": "7e5dd6a8-64d4-497e-9e5f-c3ee270f5309", "comment": "Malware payload (BlackMatter)", "value": "eb18a97a47034784e380ac5899ad011ee34faf29068629204d461bb8838fb334da4405272db1cbdaca6abc824550653e", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096463, "uuid": "e0bacdb8-ccae-4e7c-9dac-b06fc5538944", "value": "T1AEE36D21F212D0B3C87718F13736B572F39E8D6C15A96807EAD80F99BCA58132F45997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096463, "uuid": "1af8ab2c-133c-458a-a540-0803356eb355", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096463, "uuid": "427b0da8-0860-4e46-aa9d-cd5b8abd06eb", "value": "3072:/6glyuxE4GsUPnliByocWepsTo/oWe9RQZD:/6gDBGpvEByocWejaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096463, "uuid": "2544c11a-461e-401c-96ce-9aa8b3f90aee", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096463, "uuid": "5b528ec6-d117-446f-96db-cbdd2728aa18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096463, "uuid": "52b5bfaa-95ba-4c1f-9f4e-c5afeaf7599b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad0eca1-64a0-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1781077476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077476, "uuid": "909acae6-594b-4194-8d86-ca9a5582cfc1", "comment": "Malware payload (NetSupport)", "value": "028096a899ddfbb3560165f131dd0357", "object_relation": "md5", "Tag": [ { "name": "103-246-146-217", "colour": "#378C65", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "toomstray-net", "colour": "#7EE650", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077476, "uuid": "57500f16-5423-45fc-b79b-fa96fe3333f6", "comment": "Malware payload (NetSupport)", "value": "29ad3f72bda7e148110426bd5cf95ee91920556aa8713ced2c3d4f4b6cb74322", "object_relation": "sha256", "Tag": [ { "name": "103-246-146-217", "colour": "#378C65", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "toomstray-net", "colour": "#7EE650", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077476, "uuid": "50fa5494-f16c-4a5c-a3f3-4faf1936bfa6", "comment": "Malware payload (NetSupport)", "value": "d1f2e1069080dd96f07b4330bcfa0d3d992869cb", "object_relation": "sha1", "Tag": [ { "name": "103-246-146-217", "colour": "#378C65", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "toomstray-net", "colour": "#7EE650", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077476, "uuid": "ad8607ab-72ac-4f6f-b1cc-000b591b6ba8", "comment": "Malware payload (NetSupport)", "value": "67d8f2f583397271825396ac8ff165c554a654d02d13c873100c877057a6b949fc32cee1f30458b22ccd61019b212f80", "object_relation": "sha3-384", "Tag": [ { "name": "103-246-146-217", "colour": "#378C65", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "toomstray-net", "colour": "#7EE650", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077476, "uuid": "c2c84f88-9d20-4e5e-9085-dd32e40ba6f4", "value": "T157A533D244AF7C5774E2A03D18C2E6FC16E4768666CFA8BE120295A487B8D3C217D3DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077476, "uuid": "bcd6cb24-9bc1-4ca5-bab6-cbc110216575", "value": "49152:pS9nzKLSNa+4CpigFormEZL1Kp+ZP/gNdTo8UrNKKAezeagYI050vE/0tFf:pS9nmCHigXEQcQNdTvUBKTeze850vE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781077476, "uuid": "094ae19f-014e-4da8-b9b2-f052a3c79923", "value": 2229924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781077476, "uuid": "3bda2bec-926a-4c31-871d-387547d65fc4", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077476, "uuid": "2dcb007f-0542-4499-bc09-1ab3e3edc25f", "value": "29ad3f72bda7e148110426bd5cf95ee91920556aa8713ced2c3d4f4b6cb74322.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05742784-64ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781110029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781110029, "uuid": "6847a488-9cb6-44fb-b0d7-948fc3c0b31e", "comment": "Malware payload", "value": "d0f48aa88343900425da40b6f77fcd26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781110029, "uuid": "e9ca7dce-e696-4937-a774-4e0f2ba4b10a", "comment": "Malware payload", "value": "29bc628f95f1e2fcbd72b6ac09517328ca7aaf65e26734693bf407eafd9cd427", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781110029, "uuid": "d7beb994-cbc1-49fa-be91-d193cd276fae", "comment": "Malware payload", "value": "acadb25024c50254e25846c9b773594721cb24a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781110029, "uuid": "1e986c4f-d63d-4869-a687-ce6a6496ff4b", "comment": "Malware payload", "value": "690fdd8a7a738800801a2083c1b23b361a1dd72bae9d450f2847ffc509acf2c96573ab1dae0aecdda79149a5a8ee9d3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781110029, "uuid": "4b9e990b-b4f0-4570-aa68-c596067b943e", "value": "T17D56E147FCE10DB6C0AAA231497261927B61BC482F3523DB2A90B3792FF3BD05979754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781110029, "uuid": "5c2996ab-a9aa-45f6-a2ae-e65e765f1c81", "value": "72d8fd7d53a64b79a1028f9534045520", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781110029, "uuid": "ec41ca8b-c5e7-4a09-9f2b-b8e0c8f4bcda", "value": "98304:yILmGiBBR8itlyAtYJqnP7ZANRkN9y5crciyyIvqVDdkN+a+:yIPg79nyoP7ZANeC5crWqBdVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781110029, "uuid": "5d52a6be-c048-432a-a4e4-f80330a320a7", "value": 6172200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781110029, "uuid": "a50cd27f-cbd3-45a3-b599-637e33c3e5f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781110029, "uuid": "ed5ec999-57a5-4d3d-b055-8e09cdfa33ca", "value": "gup_util.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c6e6dc-6503-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781120196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781120196, "uuid": "2b1c894f-ea53-450a-a41c-031fc30feeb0", "comment": "Malware payload", "value": "a55c16918a0259867b8daf8fd293b799", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781120196, "uuid": "09252fdf-1fdc-47a5-8551-4537959ba872", "comment": "Malware payload", "value": "29c6b5ff445395ac09056bb60860d4b32ed077fb5270ac79366c4d8aba4166ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781120196, "uuid": "fcd06a05-fce5-4719-9a4c-48310822e1d7", "comment": "Malware payload", "value": "5e4157d2ac51f8a2098b43bbd795941383175c99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781120196, "uuid": "4b9322e8-2e2b-4b33-a8f0-521e233bb27c", "comment": "Malware payload", "value": "26b6a3712cf7d80b91d2a975161d7b2cc83cc139992c1641dca7c6bd9af4eb3656e47f9f73f8935b7f492d82e1d975ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781120196, "uuid": "62dd8f36-fc6c-4ebe-9227-db8b3c099099", "value": "T106E30845B8518F67CAC652BBFF4D438C372A1BA8D3EE7203D9156B24378B95B0E36142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781120196, "uuid": "350b3e43-51ed-4588-8b19-3c72490306cb", "value": "3072:Jt2bdR6QL73ywnhJi3rZkV6Ua4sk84ieMqCKjgZeOr:JUbdRLL73ywhJi3rmV614D84iOCKjrOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781120196, "uuid": "7b58a1a1-6af6-4d64-bf88-37db0aea08ca", "value": 145836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781120196, "uuid": "391ddcd9-a0cf-4a46-97ec-c1af2c85dde6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781120196, "uuid": "4ed679cb-abe1-4872-a10f-8ba0616efacd", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4736649a-64df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781104556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781104556, "uuid": "ba859d77-51e2-4d3f-b03c-2e86763bf8ed", "comment": "Malware payload (Mirai)", "value": "f84015f38c2118ce410ffc1e0d5724ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781104556, "uuid": "635130f1-6e85-4cf0-8c13-5b5a483766bd", "comment": "Malware payload (Mirai)", "value": "2adb88086cacf1e8733938697137e5a94fb31e6760b64e0b1ae5f7f5646d71ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781104556, "uuid": "7a1698d9-8da5-4529-9b29-a94d00150a11", "comment": "Malware payload (Mirai)", "value": "1d7751d0fffdc2c6de0ca77a633e4d771d4547d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781104556, "uuid": "4b7b783a-1fc7-45b3-8149-548e065fa37b", "comment": "Malware payload (Mirai)", "value": "080541da3876e9cc1997120af52029f02260959a926f0c21c831a030bdb435f82e4e8d4149cddbab892f856d192dcc2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781104556, "uuid": "b938e823-fa2c-43ac-b112-d5de76319d11", "value": "T1AF8339477A8140FEC49AD03887BE7632D433F8BF4278721A23D4FE2A6D19F601E69565", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781104556, "uuid": "4ca48fb9-9c63-44d9-8af1-e818a645ab71", "value": "1536:kSRMoJF/fQjBHzVHSXFY6uIy70U6e1b/ZN1VU:kSRj/fQjZzVHSXFeIy7Ce1DzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781104556, "uuid": "dc5a01eb-1fe6-41ad-93aa-33acd3ed147f", "value": 87600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781104556, "uuid": "620e00c2-da37-46ff-ae79-db3e878bcf78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781104556, "uuid": "e2271ac4-5afa-479a-be86-11a364df0ccf", "value": "rubcopfkd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29896025-64e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105794, "uuid": "07561dfd-9a0d-4331-a1c4-b1681c738174", "comment": "Malware payload (Mirai)", "value": "8ba4654ac4a3bef7f9c8f797d4fa07cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105794, "uuid": "a33ec475-be9d-4f89-ab80-de7c7d7a53c8", "comment": "Malware payload (Mirai)", "value": "2b98763271633940ff419da8a3d7d4574fa19289f99027abe9d8eb3a0694c652", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105794, "uuid": "a48a6ffe-9023-4680-a4f0-c23d7b6b27a8", "comment": "Malware payload (Mirai)", "value": "17edec19765b7e3c901cb78f2bec0d82da355e10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105794, "uuid": "662951ab-9419-45ac-9972-69a2f61b86ed", "comment": "Malware payload (Mirai)", "value": "ea4ca09c83494dc7f54dacd4463b106cce854ebe25f593289de308f507aae3a1a02445cf31a7282a8cd1be98e9b55121", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105794, "uuid": "089c4684-27e4-4501-85c6-d5f0cd3774f1", "value": "T14FE32B46F6418B13C5D61777FAAF414A3322D794A3DB330699285BF43F86A9F0E13A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105794, "uuid": "7807f26c-573b-4743-9e56-57b5ee2f3c47", "value": "3072:5IvM9qqxuvV8yAzlHJXu9CttQJ2Ed83zGCzTX0clM/9REw/kP:mvM9qqxuvV8yAzuaQJ2EduGQX0aM/9pO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105794, "uuid": "e6252b0f-b463-4f7e-8ed7-1ed73c56a511", "value": 143845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105794, "uuid": "8052db5f-a5f4-49e1-9303-3557ef0d6f2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105794, "uuid": "f3887333-bec2-437b-b528-36a4dd64e81e", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007c330d-64b4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781085969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085969, "uuid": "c3df364c-d59d-47c6-9e41-c03b9b203cb7", "comment": "Malware payload", "value": "62a362d2dc85dacd7974145cb1e3eebe", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085969, "uuid": "10226f9a-2af9-4654-99d4-ea26f66ea02e", "comment": "Malware payload", "value": "2c1a2d2d61f636524ab2bf37b2a5c5c7ea6f2d87b08026c9c19a0ec7cee02615", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085969, "uuid": "bff08cf1-4545-4799-9525-e4e13074748a", "comment": "Malware payload", "value": "d7fa48010455c4417e3a25af5aeb9dffbe2d9ee6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085969, "uuid": "3360fede-7186-48b6-92b9-6592000ec70d", "comment": "Malware payload", "value": "3f88e2b29bdc78c14b987c48e51c64004720e4f617c78ff7a2ece0f1b2eb46dc4fc69c8c357e5f47ad352ee72ae4fab4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085969, "uuid": "d597c73e-d63f-4a25-8644-de356aa3a1b9", "value": "T1A4D30299FA279F23C886DD770ACD0E6125CC780FA9962F493536F4FDF54A98248C2854", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085969, "uuid": "efc75f67-8caf-405c-bd70-dc618daf708d", "value": "3072:VWfHy8/tTA1nDoNTAfXT79kSD/6PVVAVN3:VgR6k1A1kMyPLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781085969, "uuid": "4f123034-70b3-4fc5-bb98-86ed4e84f1fd", "value": 140084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781085969, "uuid": "fa0f2700-8f69-4c86-babe-369e5483eab9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085969, "uuid": "11808992-dc0f-4997-98c5-7206bafe4ad1", "value": "kworkerd-rcu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1d7fe5e-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105674, "uuid": "c34ee56f-fca7-4f38-a09c-296e9c2995bb", "comment": "Malware payload (Mirai)", "value": "9ad2f484ede27e950f6a59de18fd0a1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105674, "uuid": "ee9a1a47-91f2-44de-b10d-c7b26b3696e0", "comment": "Malware payload (Mirai)", "value": "2c43e7c77268229e4dd32d624e320aaf5e0b9fb04162176c2ecaa0ab199dff3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105674, "uuid": "8ca8f562-ff8d-46ff-960b-08b20f65a527", "comment": "Malware payload (Mirai)", "value": "11f096857594fde4b0e48292889057082b3da929", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105674, "uuid": "304b4bb6-1d71-41ec-9502-970273beb024", "comment": "Malware payload (Mirai)", "value": "499fe78b1cb4ea2d6397bfd2b60dbf981b0f5e1038657d8345b925de49a37bc8f9c2f8c3a177cc2cbb218e1afbb2973e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105674, "uuid": "9b61a27e-0ebc-4f66-8d60-f719cedb1a2d", "value": "T167533B99F4029E3DF88FE9BA84160E05B93023D212931B2767ABFDE37D331659D12E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105674, "uuid": "33900a31-2f8e-4320-adb0-8ce0723f694b", "value": "768:me4gpsM204GEkRbjveX7/nQi122EQtBSv3gFHn1eu48B8vB6J7EzNfXQuJpozTy1:mo3EkRbDUoiz6IFn1X48B2SEzNfAuJL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105674, "uuid": "06b1e67f-5fe0-4a51-ab53-dfd3fbe2278b", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105674, "uuid": "147012e0-5d82-474e-bb77-c854e7ac6298", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105674, "uuid": "0a2bbb56-705a-4936-acc3-3024bdc89953", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a6bcfe-64b1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781084929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084929, "uuid": "d9c43cce-9352-4576-b683-fdab658f42d7", "comment": "Malware payload", "value": "051eba0e1e35fa3ee9795d6b9f98c8b9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084929, "uuid": "cda0c771-57a5-42a5-a173-f456f3436128", "comment": "Malware payload", "value": "2c4c16052c800b957945ac94afcab893e52924fc8e348154a106a3f8a31ed490", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084929, "uuid": "b5f743ed-7be2-42dd-8ba1-8b0664646eff", "comment": "Malware payload", "value": "40ffd4a3756518b84bb001e0e9c4aff5643dee53", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084929, "uuid": "7e7e96ba-dfc6-44ef-a726-46ebf980dde8", "comment": "Malware payload", "value": "d0b9fe1dede2c1ce93b1f50d00f99f9ddb98333663297bfeb4e58189488ad5cdd99b20c7c3d9df71b0abba43134854ab", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084929, "uuid": "2b4d354b-a01a-46a4-81ea-e54e8d73f06a", "value": "T1D3A3C700732D9A97CE7D81F44E325211DBF9645B3962DAC83CCE14CA5BF2B280769DA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084929, "uuid": "545c693c-13c7-4bfb-94b3-146f64a7cf82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084929, "uuid": "18a9ad0b-3e1d-43a8-bad0-52e9b5dc2fa3", "value": "3072:zAz/u3sGaRLgPd+MrasRVU6x068xqpB2WkRSaxeJuI2R:zAz/u3sGaRLgPd+MrasRVU6x068xuBVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781084929, "uuid": "7bee6c82-e8b9-4999-941f-1b7718497fd6", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781084929, "uuid": "c1b9888a-61e8-4d30-a64c-ec66ea9757e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084929, "uuid": "d6934c9f-0850-4fb4-a94f-657ee36977e7", "value": "2sn7bt.sa.com_0b2a6318_c_bitdefender.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b7b8f2-650e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781124852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781124852, "uuid": "58219390-ceb0-4fda-9fef-cadb3152891d", "comment": "Malware payload (Mirai)", "value": "1508e0b634536ca1f5725308fddaf735", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781124852, "uuid": "a7d566d1-c989-4d4a-a2d2-1e431861adda", "comment": "Malware payload (Mirai)", "value": "2ca505600e3613d1b23567b70bdf3f73b3683675691a19c089d32dd05b8a5ebf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781124852, "uuid": "e87adfa6-988d-4f73-bee2-bbdcdbeb5218", "comment": "Malware payload (Mirai)", "value": "f1349ba21170e547200ae5e7bf0730fc7857c580", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781124852, "uuid": "4ce57a75-0ffd-4725-bc4d-e2e23088ae7e", "comment": "Malware payload (Mirai)", "value": "6dfd4de1b0000ee6dbdf934f5197413d83c75d6ea3ec687efeecfa276fcbe54cfe9b8693717711a7bc167844b09e06f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781124852, "uuid": "d990a83b-f4fd-48e0-a5ef-43b4ee8cc4b0", "value": "T1FC144B07B5C080FDC4CAC1748BDAB53AAD33B4B91228F16B2BD5AA225E4DE714F1DE45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781124852, "uuid": "7c9e5a73-3274-4dd3-9e8a-0b1e66503283", "value": "3072:ytz+wjM8wtuq0YPjBZ3uG4obbZQ1bsAzAARMjCAKZ:g+wjMCq0YPjBZ3oPDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781124852, "uuid": "6ac2c3e8-93c6-4af6-b150-a8bccf5056db", "value": 191928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781124852, "uuid": "ecffd816-eb26-45f8-9c90-3132116bd3a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781124852, "uuid": "795936da-fd9c-4e56-8cea-fc2e0d05d4fa", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "419354b4-648d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781069327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781069327, "uuid": "7ebe8709-6385-4ffc-b577-ec722983a650", "comment": "Malware payload (Mirai)", "value": "b232502ad2481e268430910e8e30b064", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781069327, "uuid": "f140b481-6814-47cc-9c00-b186735ad190", "comment": "Malware payload (Mirai)", "value": "2d55364434d8fc2252d45c6e388e457da06519fc711171c6d8ef45aae62a03a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781069327, "uuid": "684c747e-c4bf-44c6-8565-1f3742a72839", "comment": "Malware payload (Mirai)", "value": "93b9986c1c61ca1c86a9cc8a5dd37c472ba23757", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781069327, "uuid": "ff04d44e-9172-4cbd-8a22-47a6f8380d3c", "comment": "Malware payload (Mirai)", "value": "088b38c26c3b63161a33e1e42f76a3e63da4278aefea39b2325232a6772ab92ede29225bda31c77161dbec9a9b08e833", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781069327, "uuid": "26af8be6-f250-4b57-aa47-c909c4d411b6", "value": "T149E3995D6E238FADF66C833047B74921976D23DA22E1D684D2ACC1146F2039E645FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781069327, "uuid": "bfb4069f-3a22-488f-8666-aca1047d732b", "value": "1536:Couw8STcc1/zGy/vj/s+hJkxye6FYFjuDdT6ejrL5kJmgl/4:aw8S7gy/vj/s+hJkOFY8AmX5kfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781069327, "uuid": "08d4ba35-2ff2-4010-9116-dca3776b0184", "value": 145736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781069327, "uuid": "c000b115-e206-4651-bfaf-70d3c122c81a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781069327, "uuid": "018a97b5-f372-49c3-9f7f-c3bed72fb0b9", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a3f0f6a-64cc-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1781096481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096481, "uuid": "1aea0cb3-7ab1-4e91-9f02-807c8c88c82a", "comment": "Malware payload (BlackMatter)", "value": "2e6e52fe32f718fb92bfc2308584dc0d", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096481, "uuid": "f3907d12-e148-40eb-a228-06d35d03da8b", "comment": "Malware payload (BlackMatter)", "value": "2d78ccb074929ea9134063306229d29fbd5416b8d2e720e4e91b92822ed49bbd", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096481, "uuid": "7aed68bc-b0bc-4d9f-9c77-b419d3633416", "comment": "Malware payload (BlackMatter)", "value": "2fea1e806e399f50def69553dadb464064fa0e12", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096481, "uuid": "93d7c39c-4d74-4369-be25-62ea4865acf1", "comment": "Malware payload (BlackMatter)", "value": "9ce030851cfbec9a37a6f910b529756da5e3a11518e05862930f8a664747cbe5b5b130c50ccf7aa837f09a5177e04a96", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096481, "uuid": "740ab83b-4a01-48be-943e-7d5bb22a6390", "value": "T10CE36D21B112D0B3C83728F1373675B2F3DE8D2C19A96917EAE80F59BC658236F44997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096481, "uuid": "020c6308-98c0-46ad-b8f5-5ee5c4286e49", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096481, "uuid": "0f37f6ee-9e47-40f1-9af1-1c0cbc2434cb", "value": "3072:r6glyuxE4GsUPnliByocWepfyDHaqfmbZ/5YBahWUQTl:r6gDBGpvEByocWehqHaxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096481, "uuid": "ec326c49-6c94-4c35-b29a-42123fcb9dd0", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096481, "uuid": "ccd3c684-b73a-44d4-90ba-205102b1d6f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096481, "uuid": "c51f082d-a6dd-46a6-a676-e3bd96113364", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bdc35d9-64a4-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781079277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079277, "uuid": "5e0b804b-62ca-425c-b1c7-7669de5ef804", "comment": "Malware payload (AgentTesla)", "value": "744da40e168c748e463829f6a61182ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079277, "uuid": "cf192b8a-7544-4362-8fff-449961d42f16", "comment": "Malware payload (AgentTesla)", "value": "2df1190dd4c32d6010cf67fc04cd3ec0443add412065ef514bf620165591d3cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079277, "uuid": "9b7c8f83-5a8b-4dd8-a823-0d44d701b092", "comment": "Malware payload (AgentTesla)", "value": "c8f51c56de05e8b69e9434d222bd9d7e87493390", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079277, "uuid": "0fb4920b-cb04-447e-a130-83d50b8c7624", "comment": "Malware payload (AgentTesla)", "value": "ba13be73b90a7a2e811fe83591572207a1a462405c1bc0ed82224991d7d7b833c2451c3099252c1a9ac01f284e3fe708", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079277, "uuid": "2904af08-a569-4075-b018-d37e02ee6794", "value": "T11C7664300354D671C1985EA62AA97168140D5DCF98F9FB027E6F9BF5027A832E3BB770", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079277, "uuid": "b50cf41b-6dc1-4155-a6e9-ae580ad582a4", "value": "98304:cGQekkb8e8vYV5qtYOY9ENk3zSvMrzYBMH5NNGqb8XQqTvwZ4p89N8gLsSbYM9Rx:dncYV6H0NcOuTvwS69N7LlLRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079277, "uuid": "f9f5917e-f0b1-4df5-9fa4-129e0660ffbf", "value": 7197030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079277, "uuid": "17184592-9e4f-492b-bda6-39bc70c3e5cf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079277, "uuid": "6c11a862-adb7-40ef-8967-9baaf281fe29", "value": "Purchase Order.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "929cb3b8-64f6-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781114560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781114560, "uuid": "aa1ef80c-9179-4ee1-a564-3e3aa48d9ab3", "comment": "Malware payload (Formbook)", "value": "3c726c68809cf39194e97366c37a25af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781114560, "uuid": "41367b96-994d-44b2-a6aa-1b592f0de8e3", "comment": "Malware payload (Formbook)", "value": "2e190a4c22601d5e6ad4fd8d7bbb441ae4c43d821814b3fdc00bcc145938004b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781114560, "uuid": "0fba9193-ddab-4722-a77d-cb59e68e7e16", "comment": "Malware payload (Formbook)", "value": "3b69caa69cdeb2c471b3b4f76cbf5d1ddd47502d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781114560, "uuid": "21b26b7c-0db9-4d10-9683-426f3dc3b357", "comment": "Malware payload (Formbook)", "value": "727cafdeb81b562076cd3c571feb19ea8f2621ce6bc8dda46afc26152c57302004ce277a925edb0608ddc794b93a36a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781114560, "uuid": "de28873d-d698-4756-ad15-5e350da9830d", "value": "T17435E0115F863A85D6E90FB8C05A2854B3F0D4678366D7AB7FEC41F58DA3F84DE02A12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781114560, "uuid": "f3e2280c-51e4-4a48-bd06-e040d2194a47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781114560, "uuid": "6bc12ebc-5ab4-4003-887d-2fb5d0126669", "value": "24576:rxanF5jgbd3vAtr77eHC4s9hCwCQg+oyfJuz03y+3G6:6vjq3pHC39Eb+oyc2yJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781114560, "uuid": "fba36224-72e0-48e2-b4b5-c5eb1aadd93d", "value": 1157632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781114560, "uuid": "aa61fef5-92cb-47a3-9a04-c0df505369b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781114560, "uuid": "919c273f-fded-4986-8b6e-2f651dc6de8c", "value": "DI-1017-PH1-26_ABBREVIATED_CON.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c70b7f3-64ba-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1781088753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781088753, "uuid": "fded8410-4f8e-4b10-825c-08889ee1108a", "comment": "Malware payload (QuasarRAT)", "value": "4e9d57c8b70e874ec714476e68eb40f6", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781088753, "uuid": "3eba598f-d088-4ca4-889f-e7f2bea27c00", "comment": "Malware payload (QuasarRAT)", "value": "2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781088753, "uuid": "579cbf09-50c2-4e7d-99f3-f71aa097a10d", "comment": "Malware payload (QuasarRAT)", "value": "fbf868095ec6d9d2d78b0923a648956844d52b76", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781088753, "uuid": "6c7b9381-bbb0-40c1-acd9-fac85c47731e", "comment": "Malware payload (QuasarRAT)", "value": "d3878b95d2e59abf82fbfc4cf1eedc37a06d81e92cc6a79259ecaf3521a4a6f1011a0133e76419d02d763b055297c9d5", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781088753, "uuid": "2fe03f06-74ce-420a-a155-30312f391939", "value": "T1D5D3491477E8CA2BE2BF5BB9EC7401010372EA17E676E78E5D8860DD1972781D1817B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781088753, "uuid": "af863fbf-698a-4591-a6e8-ab62eb04b5e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781088753, "uuid": "d1800fe1-3007-4fb2-b36c-4928f2d26832", "value": "3072:0cQOYD7/cEYQ3vonOPaz65snxIzBC1Zpb4GmS6l0fWT66:pYX/cTnGazPzZpb4A0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781088753, "uuid": "fec0c5f7-1c88-4d84-8a7a-6e2e2e3c4d98", "value": 139776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781088753, "uuid": "ec7b2d9a-b828-4b78-90b4-e9ab6249acea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781088753, "uuid": "71a5d77f-5ef2-4d53-ad89-9703d16d9add", "value": "hitclub.paris_113f01ee_q_chrome-update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86820321-6493-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781072020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072020, "uuid": "5a0b61c1-adcc-4490-bbd6-2941baea6118", "comment": "Malware payload (Gafgyt)", "value": "18f278ff9fb29d337cb4d364ab133e87", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072020, "uuid": "f65cb03f-2445-4e44-a725-b339ef467ceb", "comment": "Malware payload (Gafgyt)", "value": "2f2a67b224434650da05cbb6baa05b83435f40fd3a316939538f8fa1836a90dd", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072020, "uuid": "bf5fa0c1-5b77-44aa-ae7a-85e525004377", "comment": "Malware payload (Gafgyt)", "value": "0349cec50f93603baaea7d91bec614444a9ade1a", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072020, "uuid": "306d1368-f87f-4d67-a528-6bd5b998f831", "comment": "Malware payload (Gafgyt)", "value": "0f7c9f1b23d10031c8f1b9169df7865c8353699e3368904f099fac8cc916672790c872f29d6cd0aa5219469878635be0", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072020, "uuid": "f218d398-b4ee-4930-bea3-8787a57a2e39", "value": "T151934923ED125F0AD20BA4F060F58F351F22B8FA89975AD9E065DAE46543CCAB015FF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072020, "uuid": "42412362-5107-458c-9462-c34585bfc362", "value": "1536:mUhGranipXVZsKIdkS/ZD2iI4WCPG68Lze15hsZanmppm:XyawXVZzIBD2iI4Wn6Z15hKampp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072020, "uuid": "7ac9a53a-4dea-477f-b69b-d7df494585c4", "value": 92160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072020, "uuid": "6022f404-1f6f-488f-8aeb-61adbb5b3d8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072020, "uuid": "bef7cebb-e722-409d-a931-f786fd74e4c7", "value": "FBI.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b8aea8-64a6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781080156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080156, "uuid": "aacb3d2a-19c0-458e-8078-80a337c79fc9", "comment": "Malware payload", "value": "93c2f5b208ed84852df53ea475aab2f3", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080156, "uuid": "75a1840b-ec2d-4f1c-907c-37ad0c2a0e46", "comment": "Malware payload", "value": "2f73a285521422b982102ab6755a503efeb36a1719da5b8f3153e094220f5300", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080156, "uuid": "4f3fb937-50f3-4b81-9110-c28bf807291b", "comment": "Malware payload", "value": "9f8cfee6e297430d022d6a8f468454bca5adbfeb", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080156, "uuid": "844e0d25-b6d2-4993-8c04-650242164132", "comment": "Malware payload", "value": "e77a7d77eea167990a2c04dad85d8859022ac8a63b9f87c815f090ad380e93728bd82e1b3835ba5205748ff551b8703a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080156, "uuid": "f2e54fde-4358-48e1-a8c6-4b2e98a85215", "value": "T16CA514E00B52738DCD60770A4DFA163EF69F45E6783BEE9A1A807CC5F19247046CAB46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080156, "uuid": "7df90fb8-57be-4666-985e-c9d951bb0418", "value": "768:M2ksPJ9ktc4oZRQaam/m03e7evWOHwgmQTILQ1YUHOV9RLp/:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781080156, "uuid": "f6783a4e-96d6-49c8-b190-62db4a1f81d6", "value": 2125718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781080156, "uuid": "5058f918-146e-4e13-b2c5-5bc56721c50b", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080156, "uuid": "25644a6a-dce6-4a1a-b7bf-6d593273e716", "value": "PURCHASE ORDER_09383T73_Pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca5d71d-6496-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1781073104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073104, "uuid": "da735345-b937-449f-819f-f1345fe8c1b9", "comment": "Malware payload (DDoSAgent)", "value": "71ac02fac71bcd8273c613a9d5c0621f", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073104, "uuid": "0b869aff-5835-4004-8723-2d1d32143c2a", "comment": "Malware payload (DDoSAgent)", "value": "3046e6b410aa9345be29e71f08dddbe7eda37d55e6aa972d04eb2b5afe6180f6", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073104, "uuid": "c18bd13b-0a30-4acb-b129-87a5a5b4b535", "comment": "Malware payload (DDoSAgent)", "value": "23faa910c70846a3cc18002e663ae060f909a416", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073104, "uuid": "362c3074-0d87-44bd-88ed-a54de0bd1cc6", "comment": "Malware payload (DDoSAgent)", "value": "6658cbdfe9df02c2759d4dec7a27a2b8fc73d047462c916feeeb9eefa7ee9cb90e7f71e2d6a039ee267e8799aad661eb", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781073104, "uuid": "146b55a5-1eaa-4645-abd7-a51ae090c6fc", "value": "T122764B53EC6545E8C0AAD53586639263BB71BC495B3233D33F90B7242F72BD0AA79B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781073104, "uuid": "ef168bcc-645a-4b4c-b34e-14892d18e119", "value": "98304:h/7M/oRKKqatLscC1aeFXjDWeSFJktH0ES:hFqqLsBagDWeWwNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781073104, "uuid": "e70d943c-442a-4cb7-9691-8b8b5b6e0040", "value": 7561508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781073104, "uuid": "804a67e5-5a6d-4b78-8da0-9b3139982920", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781073104, "uuid": "025b44eb-48fd-4ac1-96fc-21b46e31a491", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c8c020-6493-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781072017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072017, "uuid": "31383a14-8320-4442-a63b-0325cc444a46", "comment": "Malware payload (Gafgyt)", "value": "d4b5fbc60077e9f57a652066a2c9f32d", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072017, "uuid": "30e92347-6784-4071-82d0-7b80be042630", "comment": "Malware payload (Gafgyt)", "value": "305c2bde77273c81dff23ee14998ee3333645406f187d9fcccc15745a5e03f82", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072017, "uuid": "a51cdc08-5556-499b-91a4-404998db5dbf", "comment": "Malware payload (Gafgyt)", "value": "5df67e7806c47c10a1386f70bd4819b244d2ce07", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072017, "uuid": "7481a510-e658-4a0e-aea7-5b6f71e44891", "comment": "Malware payload (Gafgyt)", "value": "f2b3e32087a96370a4a91d51ab8ef32b937a3c4afbae860e7ad7d718e9323304747d2cf708493de0c623be0d58bcda12", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072017, "uuid": "d7c701ea-b47f-46b3-a6bb-f305c1ca9920", "value": "T124B30823BA260E27C0D264B622F74731F9B5A7DA18F885077E615DCCAF641C13663BE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072017, "uuid": "eeed9b1c-3fa0-4632-beef-85b41f2d6269", "value": "1536:wp+rVAC1on5pEkdspyeaAo95I1tPCt85rphasJlsr:wpsNo5pEWPeaAoPm1hrphasJlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072017, "uuid": "2c84f310-0e0e-4f9a-a12f-4e168d2f02c4", "value": 112292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072017, "uuid": "b44b5817-1752-4b97-ba15-1d392b95b27d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072017, "uuid": "4f176935-425d-4738-b050-ede77bcaa35e", "value": "FBI.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b00b9bb6-6491-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781071231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071231, "uuid": "b8e450c2-0003-41c9-bfea-ba0b6aeba3d3", "comment": "Malware payload (RemcosRAT)", "value": "1f1b0837902d0c3f4f377962243b1b74", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071231, "uuid": "edab73bf-5598-44c7-becc-11a32704a33c", "comment": "Malware payload (RemcosRAT)", "value": "30938e97d68c36f5e03144985acad4ae01472613db6822975a270a6bd6abf4ad", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071231, "uuid": "fd0694ff-4ac5-4996-8fba-bc3dd420e602", "comment": "Malware payload (RemcosRAT)", "value": "5000c921291ee5dcc042134d7d87ba841042cd3f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071231, "uuid": "dfa7d586-7d64-43f4-868a-aed8faee4473", "comment": "Malware payload (RemcosRAT)", "value": "d5807f60b438ffe433f818dbb113e0ef1ce216ec13df5f994a9d2c83e647f7987126dc2b548f894d1146ac6f266e3bb9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071231, "uuid": "9410a594-4422-4c33-ac0e-f1907d10dbbd", "value": "T18B451EA2DE77DE3ECB758F314AE28205A7745C52C731CB07A5853239BAE9E20BD450C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071231, "uuid": "d8acaa60-be08-40b1-b381-77e0f7d21a98", "value": "12288:yDylH4wSokA8EVZau7yvLw6OrB7xDylH4wSokA8EVZau7yvLw6OrB7mh:p+wwEccdB7I+wwEccdB7mh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781071231, "uuid": "b52e2236-f91f-460c-9be4-0c3d3eb17a48", "value": 1215488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781071231, "uuid": "8079cb9f-5d69-4497-8e86-39aa46284e18", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071231, "uuid": "212008fd-8f0b-4fb8-b6ea-66470961d20e", "value": "MK FMHSRFQ20260609.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "103e41dd-64cc-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1781096303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096303, "uuid": "c3f842e4-b027-4662-b5cb-eaf88949245d", "comment": "Malware payload (XWorm)", "value": "7ed888be6dd7176a1c38e63f428d0258", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096303, "uuid": "88e86ece-987b-42d0-952e-cf054300cec0", "comment": "Malware payload (XWorm)", "value": "314fd50ab6eeb4ce78d0d72719bdeddf8cceebdde6f8c84484ba05486d257b4f", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096303, "uuid": "c21c9c06-2c66-4abc-b285-46b246bf4adb", "comment": "Malware payload (XWorm)", "value": "5dbb283a95de5fc79bcd4c1ecbb16b16f6d00cac", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096303, "uuid": "a5fcdc4d-f076-42c3-8bfd-8fcde9b052c5", "comment": "Malware payload (XWorm)", "value": "dbafb83c8c8634c0018c5939f02047fe4e0e5d312153d091c8e4dc40180d2859519f6ed456f31c60f4b359e012001535", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096303, "uuid": "3210757f-4cc5-485d-bf95-6c776796467d", "value": "T1CB957C055B172C8E53077ACF3424B97117E2CA35E5C268EF16DCE80631AD2119A9EFBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096303, "uuid": "21738ad5-5b60-42e6-9ba1-0b714190de36", "value": "384:Rr3tqmL0qBnuIZgV2Y9AFlI+dLm8WdEFSvY:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096303, "uuid": "a662f1b7-ea29-44b3-a267-c855c3e2d5cb", "value": 1936834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096303, "uuid": "28e9ba3b-0da0-4fc2-aab1-9482065507cf", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096303, "uuid": "85fe2581-63fc-439c-90cc-d4d7fcb6bdfc", "value": "\u03a0\u03c1\u03bf\u03c3\u03c6\u03bf\u03c1\u03ac.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3debc4a-64dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781103449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103449, "uuid": "c6ca23df-acdc-4f7c-8b0a-e6724c60ef87", "comment": "Malware payload (Mirai)", "value": "22a4b370b2619e62205c86e56a097a2c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103449, "uuid": "0ad29504-e872-4a5b-9908-d7a0a9003181", "comment": "Malware payload (Mirai)", "value": "31938401b0b6e02f9e204850f97e246d658fbe0c4ab46ca39672544ff7eb3b30", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103449, "uuid": "445e4499-80de-4f33-bf83-7f4e102c1b7b", "comment": "Malware payload (Mirai)", "value": "53aa6c9d2a39df3fc8e5b1602b8bb505deee465c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103449, "uuid": "4228ecc9-4ffe-48e5-b452-bd842b7ecab9", "comment": "Malware payload (Mirai)", "value": "22dc2fc230b3a8bbb2341a1f24e914dbdc7eeed61a74dc621a52d895c29d650cf7fff198efd9d9db9118308f19a68beb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781103449, "uuid": "819d5ce7-3464-40bd-a8c1-f52da387bf54", "value": "T1D251E186016143FD7D637A6BF9BE4ACC368A9091ADF63904DBCC35A1939CD5036D0AC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781103449, "uuid": "1995dabf-ce4a-49c7-8845-29e1c773737a", "value": "48:iXlIDlCoSelhjb9ltlnl6luloR+lClzl5ljlWpC:iXl+lplp9ltlnl6luloR+lClzl5ljlWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781103449, "uuid": "4cab7949-f931-47f7-8c5d-b7fad049076f", "value": 2723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781103449, "uuid": "26a692dd-28ea-48f8-8f6c-c6599d9dbb65", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781103449, "uuid": "31f41a3b-62d7-4871-9bbb-919b638eb143", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9bb04ce-64ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781083300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781083300, "uuid": "2af6f437-9d64-4fa6-a35d-47ca110ce382", "comment": "Malware payload (Mirai)", "value": "6b129da60a844210d7122985a7f7aa45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781083300, "uuid": "32a136ae-59ae-4212-bad1-7ee2c4dfc846", "comment": "Malware payload (Mirai)", "value": "3266c2978c0ba3d801410e81eb6d95efa18501db8c39d7aaee2cd241ef694fc0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781083300, "uuid": "45257db6-6ad9-49c9-961c-178486908e72", "comment": "Malware payload (Mirai)", "value": "54526cfac01ebba9112b4054a2cfb7c7d279871d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781083300, "uuid": "d388891e-990e-470a-a842-dfed9698e387", "comment": "Malware payload (Mirai)", "value": "01e32afac9ae467a6d387f96b58ebafbff1e210ee9372c0ce714f8e46b7f07604d8c94aad05c4af756d1255502785c0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781083300, "uuid": "d2cc44dd-08ff-4a86-b819-25fcb3da804a", "value": "T1F0D329C7F800D9FAF80AE33648634906B530B7E509915A373267357FED3A1990977E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781083300, "uuid": "dd5af843-e57f-4c72-a440-8f80a14138e0", "value": "3072:LrssONwd0RU8Hm6RxVojbi8LS2lprdyma7EP8:LgNwd0RU16RuLdymKe8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781083300, "uuid": "b7576cae-e80c-4234-91f0-50b93bc8232d", "value": 136736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781083300, "uuid": "df4f8c27-84ef-4641-b866-fa984308959d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781083300, "uuid": "ef769a83-139c-4b12-9d1f-03ced9f70fd4", "value": "CRY.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ba1287-64ab-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781082380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082380, "uuid": "4ba87eac-6836-48cc-b57b-9feaa8367821", "comment": "Malware payload (Mirai)", "value": "22db10254d4b2497b136b9d1e1ff5e2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082380, "uuid": "8ee77f45-56f2-4cb0-b14a-4e6844e3ff42", "comment": "Malware payload (Mirai)", "value": "32cc55a73e1f59bdc8fb190361f8c4e66989e1f8236b47277387242c80f6463d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082380, "uuid": "9695790d-eadf-4e03-96ae-3adf1274bfe7", "comment": "Malware payload (Mirai)", "value": "f127913ba77d610eab8cf5bda89eebf9800b5b16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082380, "uuid": "a42e1efe-af42-472e-8dd4-40f8e8b07d0e", "comment": "Malware payload (Mirai)", "value": "098d6b46e66b3eb8cee766698cc299516996161aa2b226bdc7727b40c1d59b2ead7340a0507d4246e80b3ab6bb2cf5ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082380, "uuid": "27278851-7bdc-44c7-b346-9703b66227a5", "value": "T166F3995E6E228FAEF268873447F78D25A76823D622E1D644D1ACD1141F2039E641FFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082380, "uuid": "029397c6-06e4-49ec-8c0a-7ae2251196b4", "value": "1536:5hm5vmSDDlsUh//cIpTFCo2njt7e6CHDAQxBTZDiQG09Llz0+7TtZ:PSDNFcIpTFCo2njrCHFvzGwJz0+7TL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781082380, "uuid": "64127932-c1cf-40dc-9c64-ca5963bb7e92", "value": 161152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781082380, "uuid": "edb47ebd-153a-4ace-9873-460e9a27f551", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082380, "uuid": "599cffa4-bf36-4a67-8fb0-369e313b8a6d", "value": "CRY.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8906ec70-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105525, "uuid": "c180ab8e-c0e4-4fe0-a455-b9ae5c378417", "comment": "Malware payload (Mirai)", "value": "07cc12e951c6e4d769245c137c0ba406", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105525, "uuid": "38dbbd2c-bec2-42e0-a045-f6d12cec1ad9", "comment": "Malware payload (Mirai)", "value": "3302825467fdbbfac4963c62de66830c9eb86fb8ab8bd5806d2cba86dfbd94bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105525, "uuid": "c5f426ec-50aa-430a-82b5-814436aad142", "comment": "Malware payload (Mirai)", "value": "d63331bfc91511894a0855074b45a2f2d6568a7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105525, "uuid": "a61319e8-19f8-4d76-ba5b-c68df66459b4", "comment": "Malware payload (Mirai)", "value": "d386b2aab70e1154af50802f73e38f3810df87d55dfb1c2b4bccde741ba9df8d7d3d9acf8b7c2b541c242c616df759e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105525, "uuid": "21f91ec6-0b6d-4d17-83f7-1a2e1ade64d0", "value": "T117331881BC819903CAD82376FA6E01CD332663A9D1DF7257AD226F1137DA82F0D7B552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105525, "uuid": "bce5061f-2bdb-4152-860b-accc3f64fe89", "value": "768:dQIslWuoA3Aq2I7pgEMBR32hi4qdcp5IDTcWT5BS8D/oiOZUxBNwSxmgBq6AA5E:vsIXoAS9k/4qCfDWT5BJD8ZExB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105525, "uuid": "d865cc3d-1e5b-4d9d-96e2-36695f633340", "value": 54088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105525, "uuid": "7200cb04-5793-4fe6-958d-3cf4238d1ef5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105525, "uuid": "c51035a4-ceff-453a-a754-c2d16b69a6ca", "value": "miraint.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f7aa70-6474-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781058725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058725, "uuid": "4b800005-a993-427a-8497-e22296c39c34", "comment": "Malware payload", "value": "1d464e11ef141ca50c814f1f7ad9d78e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058725, "uuid": "533f6d81-1d03-450a-9282-b1b229c6f701", "comment": "Malware payload", "value": "33143446e45c742f7ca9d0dafb0a1b16f8ce9e529385200ccce6bdbb859e1ab0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058725, "uuid": "a7d4f944-8ff6-48c4-ba07-44d6de7a1bc0", "comment": "Malware payload", "value": "425600acf9ad174b414dda3aa49d1d6f70f1af3e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058725, "uuid": "2f9d84fe-ea65-4abd-bec1-e1b3254e4e23", "comment": "Malware payload", "value": "461c100d191d32aad48674329d2bdf9a67c6457aec58074b170a6564af12d69263ed9d4a7730007827e755b3db1a9f1a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058725, "uuid": "18f83e5d-1855-456c-8769-c655e9f07ac2", "value": "T1CC31739B4B1D3A9D8901AAA672652548D094FADE205FE778FF8C0CBFA1881483255F4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058725, "uuid": "440984b8-306e-4af6-9ee6-b0f9f098b645", "value": "12:57Brr7XgejHKezKqSCYRudrRuwyZryohBrrhxIyGtCLrCg9Wco6s8rrsptVT7rV4:5JXbxfUoe4grx1w0ixddGwhhTf9OrDzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781058725, "uuid": "8c7f1877-7bda-49d3-a9eb-44f11d39c978", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781058725, "uuid": "b85b5d56-49f1-47ed-8568-be0cc72dba87", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058725, "uuid": "daa9779e-3da9-443d-9c76-1af050c7f6a6", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c0b442-64b9-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackShades)", "timestamp": 1781088130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781088130, "uuid": "c7fdd500-1e52-403f-ba15-a62512749e6d", "comment": "Malware payload (BlackShades)", "value": "cbb44cbda24c6c4eeba5e1e15e7970eb", "object_relation": "md5", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781088130, "uuid": "67a5dda1-05a8-4340-9d6c-4cd5ffd18c7c", "comment": "Malware payload (BlackShades)", "value": "336cee203c92efe8a8067f9c3ad71e3d7fd2d7231e6bce8381d5ec0243bf1e60", "object_relation": "sha256", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781088130, "uuid": "4bda72e4-97f1-4de2-aba2-a12b18839239", "comment": "Malware payload (BlackShades)", "value": "f0ebbf55a3a7a2397a3a65d875a0950029a3e119", "object_relation": "sha1", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781088130, "uuid": "ca5620db-a3c5-4573-83c7-4b598b97939a", "comment": "Malware payload (BlackShades)", "value": "7b93919bfcefa8edb0eef0c3788600403fedbee76362735eb733fd03faea41e61b3d99da6c331516c8346655bc79e43e", "object_relation": "sha3-384", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781088130, "uuid": "507f5318-9d42-44e4-bbb9-bbf7137c7186", "value": "T127A24B05F7D88315E6FE8BB8ACB747444132F2479913DB9F0CCA506D6E267E08B50AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781088130, "uuid": "379b68c9-763a-49d1-90b0-cde4d4aa0cbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781088130, "uuid": "b3ae19df-4d51-43b9-ac22-2550cc57df0e", "value": "384:SBa4zd9rh29OPLS+Dze4LOLSgrrVwTlDCjfOhZwlU90goJgA3:SQ4zd9rs9uG+DfLqqcfc90z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781088130, "uuid": "05a32d83-f64a-4b45-aaa9-d063ed27c73d", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781088130, "uuid": "31e060f5-01dd-4d19-a403-bbdbe3e10f37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781088130, "uuid": "949737a7-b3e8-453c-b363-23d2aed05858", "value": "hitclub.nagoya_119e0e0c_h_java-update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "139e6e3d-6494-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1781072257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072257, "uuid": "2f8e091d-8501-4db3-b7eb-6032dfe5b6e3", "comment": "Malware payload (SalatStealer)", "value": "88d9daf61dc34bd8fe4f81b52a9fc0f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072257, "uuid": "72d82fb3-ef82-4da0-9248-0fa37f0201df", "comment": "Malware payload (SalatStealer)", "value": "33b14a466f8bca5d4ebc5297f17abf1b5d20e267466ba22e3445e756af997875", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072257, "uuid": "ab25f08b-00c2-4f4a-92d1-177791313daa", "comment": "Malware payload (SalatStealer)", "value": "5487392397c97bccd851917aeaedcd0efe1ad5d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072257, "uuid": "3dfd7aa0-4917-4276-b1ee-c5baf20da017", "comment": "Malware payload (SalatStealer)", "value": "5ebc3f1738eb404ccc7a06912c85f923b3d95b7ed11cf896bbccbcf1220c376fa764e59802faefccea5de43c511571d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072257, "uuid": "2f514fbc-8a00-4b58-ba96-676c5fc1cb33", "value": "T12CC66B11FADB95F5E903583100ABB37F63315D048B28DB9BEB547B2AF87B6A10C66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072257, "uuid": "dd8f7336-604f-43e9-93bd-38db119264cd", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072257, "uuid": "fb2c0f65-5b0a-4ad8-96dd-670cfa314250", "value": "98304:5jNcCgYZpQtCB5NcQiS1IPsSaw4j3HxmcEsO/:ACgZK5h+PH98MsO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072257, "uuid": "005eed1b-5fde-4c69-8a43-519331abe855", "value": 12572160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072257, "uuid": "ae94374e-9f89-41e5-9c8d-8ac13051d2e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072257, "uuid": "d388fab5-7516-4b01-a621-deea600edec4", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44140eea-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781108845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108845, "uuid": "73883a9f-ab8d-4d8a-a334-4c358316106b", "comment": "Malware payload (RemcosRAT)", "value": "a42a20039909afc2a34fd75abed362c4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108845, "uuid": "7c6ae824-6690-43f4-a56f-8fd83766ab8c", "comment": "Malware payload (RemcosRAT)", "value": "33eec361ead2fd1b09d9cae5e83a5448ee97dcaa769f39bcd893201f2aec2fbc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108845, "uuid": "9a953215-219e-4342-8dc3-d15e0bce21eb", "comment": "Malware payload (RemcosRAT)", "value": "9017ea01a981e20e240bb76610daa029eee5b62c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108845, "uuid": "0f5417ed-4f09-4443-a0ba-7c4a9be18bca", "comment": "Malware payload (RemcosRAT)", "value": "371a882298b8d0d7b96aa9273782706216a13d8762fcb95d18eda713b45bbfef8e24a21457982434d46e68d74a731be1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108845, "uuid": "13ac6bb8-6aba-4cbe-bcea-be3770e29070", "value": "T1ADE6048302E64330FEFF158065B82BD489329487CE34715D22DE6BA54FD76686EB817E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108845, "uuid": "1dc2cec2-5ef7-4344-9c26-c646945814ec", "value": "384:Ljjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj+:aK6JUV2eVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108845, "uuid": "82c9d9c2-412d-4a17-b8ed-2831eabe4a18", "value": 14676886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108845, "uuid": "0d43cab2-f016-4dba-a345-63929e58d4ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108845, "uuid": "588e9418-266e-429c-9c49-575a270b29ce", "value": "Customs_Clearance.docx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b4ac81-64f8-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1781115314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781115314, "uuid": "b1ec80c9-eed2-48a7-8600-32c620d958c0", "comment": "Malware payload (WannaCry)", "value": "d107cdd287868be7c56c5c67b21239af", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781115314, "uuid": "e07b26db-24c2-4dd0-97bf-b57b3d962663", "comment": "Malware payload (WannaCry)", "value": "342ae6b1aae1c71425608f4edb12f9ca75c92d1e22361251e0173382cfdabd68", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781115314, "uuid": "5ca1545a-6ad8-41b4-8bc5-f8d0041f62ea", "comment": "Malware payload (WannaCry)", "value": "ea4d4e2b76fe02c445b104ce16dd85c23b3a94eb", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781115314, "uuid": "acfc6402-7f09-4c44-9358-09cc7030d2b6", "comment": "Malware payload (WannaCry)", "value": "b3db52147680551e53c400f0f8f0e1fdff5298522c3966b96638e4fe54519dae27a30b2664ab980da8e9f10d11fa2f42", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781115314, "uuid": "8efb07dd-5294-4f40-a217-f55dd3ac8592", "value": "T1C8363321B12841B9E19318F004FFFA26E6BE7C55037A56CF9B944AB64D227C27B70B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781115314, "uuid": "bd61d837-b479-47ff-8e9c-dfcd34c83f42", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781115314, "uuid": "a06b76fd-bb13-49ef-bbaf-30fd405e37db", "value": "98304:DXDqPoBhz1aRxcSUDk36SAEdhvxWa9P59Uc/:DXDqPe1Cxcxk3ZAEUadv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781115314, "uuid": "890e2759-8c28-475b-af4e-71e603739270", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781115314, "uuid": "8ca11818-a132-4276-952a-fdb778034c3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781115314, "uuid": "a19e0f94-d0a9-4417-b5ee-b060c3b75251", "value": "342ae6b1aae1c71425608f4edb12f9ca75c92d1e22361251e0173382cfdabd68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f87100a1-64a7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781080801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080801, "uuid": "6cfca9d7-0d47-4f00-a2cb-316d9a9aed60", "comment": "Malware payload", "value": "c17f01636b8c56f1d747b9ee07ebbf30", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080801, "uuid": "dd8bafed-7540-44c5-ad40-4d1ef74b91d7", "comment": "Malware payload", "value": "3431ed0a46d18ed6d16657d87dc481b6220634ab3724db2e7f9abae445d3ff1a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080801, "uuid": "3cfafb8a-3a8f-40b9-8e71-77bde48282c4", "comment": "Malware payload", "value": "8e408e63dde1ef747a27106fa528405c7500df44", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080801, "uuid": "fedc76d3-8bf1-4f86-98e5-ca221ca3a28c", "comment": "Malware payload", "value": "31f6d14bcb6b234d5122b74173dcfb4247bf1dd10bf76aedd2aab7d3eb50965c69a749526c57fd593b3919281f9cc697", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080801, "uuid": "52ea5277-3926-4f33-82b0-a7fb31e3da3e", "value": "T16C0188DEC012DB305186D99EA3AB51C0B820C38B15868BA87FAC443D9BBD628B055E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080801, "uuid": "e8852871-3a67-4291-bcce-3dc6fbb34445", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaBXIqNMhBOIhKFAIGDFPnIVes6EIGpNauD:kXCKysE2hi0ziQvZohaBXrJAXZfDEPN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781080801, "uuid": "0762cf47-e804-41c3-8a77-1dc344ac480d", "value": 830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781080801, "uuid": "ff8f8315-294d-46cd-af04-42de924e5f32", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080801, "uuid": "2beeaec4-9d93-460e-801b-8d93e273769a", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6989a2f8-6472-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781057798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057798, "uuid": "6cf3fcf0-fca7-4041-8df0-8512ab809813", "comment": "Malware payload (Mirai)", "value": "2b0299b5d30d0b5e0e338330e1d68d58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057798, "uuid": "3e541afb-13f7-43c0-9fdd-82264e52a1bf", "comment": "Malware payload (Mirai)", "value": "34e45d00a8644066f05c08d423a5ea3eede2f2b2a1d771bd40c60f89bdadb10c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057798, "uuid": "5eb68d45-4fe5-4247-ad4f-d814844f2acb", "comment": "Malware payload (Mirai)", "value": "b61186fc7f57a8c63d8d86ef667a1904bf87e041", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057798, "uuid": "6df9afd5-5c48-410a-9cba-0b677624bd50", "comment": "Malware payload (Mirai)", "value": "66db2694cafc4366ee77d246be3da12f74d5f24d69994aaf813aa626f893bacc5e2ca13e76321a2c1e4cd9a6f0427967", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781057798, "uuid": "83542128-6543-4782-823e-3069dc563ff0", "value": "T137E38D45E743E0F5F6B341F2402BE75A47F4C8269330EAC5EF953671B8B2689C91626C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781057798, "uuid": "dcb5786e-07f7-4e0b-b137-c7b7a7e623d2", "value": "3072:5IXdrSOt0E9pf/OJymje1nX4MTT9N20LGea+cXTA1WJ0Taurzk:qXd+ba5/qymje1nXHfV/14ufk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781057798, "uuid": "8ff31b59-31f6-41c3-af8a-ab14e5c9f137", "value": 145112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781057798, "uuid": "49bced23-4293-4663-9384-1dd6015cd113", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781057798, "uuid": "319b07dd-1d6b-42bc-8470-c1c9320c374c", "value": "wife.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677f7ddc-646e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781056077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056077, "uuid": "8732b700-67b8-4bdc-bd5d-bfee31da5858", "comment": "Malware payload", "value": "81a3354ec8a96f36968035e97c6c0533", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056077, "uuid": "cef1818c-cb74-4f9e-b679-f540fd93eb2c", "comment": "Malware payload", "value": "34ee544a94635d0bee324719c7897d3364398993258866a7ca95b339fff6a34e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056077, "uuid": "4047c78d-a45f-43d3-9f40-52a8ddcf16dd", "comment": "Malware payload", "value": "3e9f272d3ca508879b5875fab519b2e365337152", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056077, "uuid": "2b030b83-b1d9-4682-a2d3-6f5495f5f91f", "comment": "Malware payload", "value": "6ef14b480f3752b75b9decb5fe3c84cb5b89546930227010f5a297ee0bb800f0cdd7019f80c940c60c6268e4b5b4c281", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056077, "uuid": "4ff48f79-e566-4f7c-8641-023b467b2d92", "value": "T19A136C6566913C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056077, "uuid": "dc820477-835a-458d-88c3-6eb9c08de1e0", "value": "768:dXRWNGxVa9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:nlxdco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781056077, "uuid": "07816a1a-df30-4aea-a1f5-cbdf49066b62", "value": 45517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781056077, "uuid": "3743244a-8318-4bb8-be98-5d35aacdf1b0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056077, "uuid": "215bdbaf-875a-4f67-b871-d48cf3490054", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22829034-6507-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781121674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121674, "uuid": "793b16d5-f8fc-4d71-b1b0-39ba161429e8", "comment": "Malware payload", "value": "46604df27ec505b5b47e5d80d7e78772", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121674, "uuid": "b0e8dddc-449b-4f12-9668-5521d333b59a", "comment": "Malware payload", "value": "351b96d0959ff5b2d590fb074b8221d095f395f3637103ca281830c883f07037", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121674, "uuid": "3a043393-8d94-4ce8-a3db-587eb936b5f4", "comment": "Malware payload", "value": "2841c6a7553ca0d26e4a95fc71aff81bdccc8fc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121674, "uuid": "8796a741-61c5-40d8-aa2a-d2447fe0c5db", "comment": "Malware payload", "value": "88d412278c87fd6a0efdcb4f8cdbd1892a4e0682d5fe136be072daa36df452f64cc4bd26340e813ffd195de2dc2af7bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781121674, "uuid": "346b4d04-529e-400a-9bf7-63362700015d", "value": "T1AAE31A05B71D0983E2673EF03B3B27E1D3EF9A8131A4F640295FAA8991B2D321585DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781121674, "uuid": "e9aa0d3e-8237-4eb6-be6b-afb06f66aad2", "value": "1536:CzJsgFGIhiOe1C/WV0P3oMMV5ruzYQCyxtd1zGyP8qooDsvAC9/LTdp5yGpw5qqK:kJskihWxMDr3QBx1NPFtRCl8a+w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781121674, "uuid": "72c2769a-79ec-49b2-8765-f9a14f876f32", "value": 148312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781121674, "uuid": "6a7c96d0-4b66-4f10-88dc-4b8b1ceb3dc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781121674, "uuid": "4b07f8e6-d649-4455-a24a-e6c3b6e59daa", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883d1955-650d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781124421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781124421, "uuid": "e472ee64-47a7-4b1b-b4d6-c42b3dee1a2c", "comment": "Malware payload", "value": "02f9df4358e8c3dee6821a47141b999c", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781124421, "uuid": "7b901703-eaee-4a7a-bccf-b86787b99246", "comment": "Malware payload", "value": "354b48e050f30e4cb9a48c8dbc8443c1c562d797c342398148a79c4b97e16aef", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781124421, "uuid": "8ab4fb9f-d2e5-4793-86dc-8bcd22673d85", "comment": "Malware payload", "value": "b0da33fad9ddcc00f9dd69fd03c84e5c2b07364d", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781124421, "uuid": "fb92c435-95a3-464a-92db-14ac2ac6920d", "comment": "Malware payload", "value": "06ce5a85a4979def89a63ba92214aba57e6fd3a9482a1f1b6e7cdc1f943cce12e4cddc5d9e6152e8536e215c7642f414", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781124421, "uuid": "88a5a89a-8f2c-4692-aa59-cceccb4a5e69", "value": "T103C6011A473A4522C82C11BCEB2C73CD9EAD6529C78716976899F4F819C70EC28F72D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781124421, "uuid": "ffb728fb-7236-403e-8223-874357323df0", "value": "89cbd0d03f658f7b76d6cfbf08bc6fa4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781124421, "uuid": "b8941ac9-2709-4a0b-939a-560e850afff1", "value": "196608:Hgvc/+8d+lB+bOq3ViBDkddv7C4crC2d9+G+kw:Aud+lB0ZFi9k7R0CM9+GDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781124421, "uuid": "92b705e9-fa0e-4be4-85d3-154177947d8b", "value": 12447744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781124421, "uuid": "2baace13-6550-4d0a-b15d-becad93edb46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781124421, "uuid": "21ac0a28-25ed-44e0-981f-a8c9eba601ad", "value": "tr.ch", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9444cb1b-64e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105973, "uuid": "3627f927-ad26-470b-944d-76e597e61766", "comment": "Malware payload (Mirai)", "value": "dd1a1e7ba611122788dab1ded5a9ecb5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105973, "uuid": "8beb36ef-ca72-4b1f-ae39-96cbb74bf783", "comment": "Malware payload (Mirai)", "value": "355843493b5be6eb3b077d9750a3f80df35ef6348431ef88acb8907cc3fa4358", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105973, "uuid": "199689be-de36-41ca-ab88-9f1d7c6e4170", "comment": "Malware payload (Mirai)", "value": "e69f7b9d3719ad3c659a44e59397f34847fd9f82", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105973, "uuid": "59daeb8e-785b-453a-8590-3bbc88980c9c", "comment": "Malware payload (Mirai)", "value": "9c27353bc026b4aa0e47ade51ae05ae74809b16c55c46312f1355ec2d88aaea1377b2aa6bedb7b1f92b7806d6694f31d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105973, "uuid": "f1418624-8be8-49b7-9292-d9dcb47b4d04", "value": "T15F41B685B3A005B1BFF25E5671BCC414F2CAA4625EC6AAC1D4FD78FE844CF082D90A67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105973, "uuid": "a8669968-3871-4087-8755-bc5f7723fa93", "value": "24:veOS3aIOSwTrkaUoOSpoOSVOS6lOSHOSvOSqOSE2Ol:veRPRklRpoRVRYRHRvRqRre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105973, "uuid": "35798d94-9de4-40de-83f2-cef16c1ee746", "value": 1893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105973, "uuid": "641f19b4-9e75-4bcf-afb3-11e1466e1d80", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105973, "uuid": "5676bcec-0fb3-47a5-bdd3-c5364eaea6b6", "value": "yarn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff528dcf-6494-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781072652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072652, "uuid": "3d138bc0-7055-457a-859f-b33ffdf7d7c6", "comment": "Malware payload", "value": "aa8f32b54a72f915395e462d9137a0c4", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072652, "uuid": "7476347b-4a74-4173-b543-32d1f9062e40", "comment": "Malware payload", "value": "358cd9ae2ebc4a81b9dcb50d08195025208cb4861b5f90a989cc9a1580fa5b4a", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072652, "uuid": "2c7e3f18-81b8-4be0-811d-2f7a4241f049", "comment": "Malware payload", "value": "fdb587896cadf7ef499e53d55a762e959123bd24", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072652, "uuid": "c86b465c-d90d-4377-b887-b4c2b8094745", "comment": "Malware payload", "value": "308591882f02ddac50e35a49db695cfee06aa09029b416102ae1be43da09fc1a49fb216997c91670d5a46cf0eee5718e", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072652, "uuid": "f988b044-f423-4807-b821-b983582b1f3b", "value": "T11E9533319A1E93D98670DC22E113958F56FC3494C3EC233098DEC5BA561F99762EE0EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072652, "uuid": "b3689fd5-b4de-475d-89d8-d86c7f50eb72", "value": "49152:RpdUUd+KFeGJXCAZsus0k3t6R8g30rl+XDhomMb9CRn3j:Rpd/9XHZsuBUyWmyCR3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072652, "uuid": "944c7f68-7049-4a00-95c3-847eabfcc2cb", "value": 1958132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072652, "uuid": "9aee9f65-1813-430c-a088-fe2a1ec7bcf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072652, "uuid": "ca2195fe-02a5-4091-a5f8-b6871a97da11", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f426aa-64f7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781114944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781114944, "uuid": "f0e31ad7-8474-4429-aecd-a3802e0d4162", "comment": "Malware payload", "value": "be8780e842bdaa020ef661ae9ff5f5f5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781114944, "uuid": "cc9c81fd-d474-4d0d-b565-3a29999be3d5", "comment": "Malware payload", "value": "35d4a3f04e565919e5444f445ec7cff64b5acbbac302059720574b93fe6aedeb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781114944, "uuid": "81597107-6c1a-470d-a525-c5cf7bf98287", "comment": "Malware payload", "value": "dbc38d0cd6eaab74a27076a3a16d5de302ad736c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781114944, "uuid": "d8614bfd-8788-4120-8484-c5d7670eeb28", "comment": "Malware payload", "value": "2b25d2bf6c75c047075d61d7bfff427563b632d7d5af2921f374eea428f236b3455a8a4b6c918d80f2e6207ff146fb08", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781114944, "uuid": "f79fb416-147d-405a-83fe-d520c6c174e4", "value": "T19311FA97012549C7C9286D53F262B943624C5EECB8F87FADA9E01F6B4F4D7043824F52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781114944, "uuid": "d210a100-efb7-44c5-b18f-587754a6bafe", "value": "24:Emi+mBmPNIgmpK+mHNmdmBrmPmfmOYE8mF:UO71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781114944, "uuid": "aa9ce669-1036-4dbf-a72a-03c385579104", "value": 946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781114944, "uuid": "bfdad665-5584-440b-bf75-74caf677ae2d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781114944, "uuid": "db42209f-b09e-47b8-9d07-4f459c1cf8c0", "value": "sex.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46bb1eb4-64a5-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1781079644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079644, "uuid": "afca57db-5a93-4a1c-9832-408a4643ae14", "comment": "Malware payload (PhantomStealer)", "value": "951b5f5a925ab0ecc67bcc7ea2317221", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079644, "uuid": "b4caefd3-2ee3-4c5b-8c66-5d5cb7c56004", "comment": "Malware payload (PhantomStealer)", "value": "36a1e1df79f8a326f36eedb17f2c0ae36d7b216a72389617de1ad32532b61b37", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079644, "uuid": "40736d95-1755-488f-ae09-2ef99158a234", "comment": "Malware payload (PhantomStealer)", "value": "81c5236520554b790e27e845523ccec21cdbbe7e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079644, "uuid": "ec8fdf9f-91ec-49da-8db7-89458d09539a", "comment": "Malware payload (PhantomStealer)", "value": "cdaf581501d2865a54dfc18e79dccf6f57d2156d2ba1f4b554c121ccbf0be98374d4abfdcd0d7b4ce0b8f4a6a449e334", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079644, "uuid": "f6ed787b-1fef-4a0e-9fee-d43e9d827498", "value": "T180665B17C66F974E180D3B51006A5D9AFE89CAFCEF72BBC4E0CF90B614EA1110B855A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079644, "uuid": "70bc2b91-7aab-430c-a926-7ca724eacef0", "value": "49152:MvBtJ0/suYefNq2TNNgNhWll2n1qtxjAQKm/qiNA2Kx/CcBUh1mRBBniiIYzLET/:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079644, "uuid": "515855cb-796b-4460-8044-e4eb6c6a2a2c", "value": 7076311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079644, "uuid": "e6377fcb-6c12-422d-b97c-15bf267ee2d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079644, "uuid": "e59c67d3-2da6-4472-b545-0b6148890f53", "value": "Requisition.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74dbd6b2-6478-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781060394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781060394, "uuid": "1acf754b-d717-4e27-8aef-5ef6fac54f93", "comment": "Malware payload (Mirai)", "value": "c97201e57fa2f81b4957d2d37754eed6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781060394, "uuid": "528d0a99-964e-4ba1-8c68-129ea82d6f17", "comment": "Malware payload (Mirai)", "value": "36e11a689086bb42b8ec1ef249b06289cd65a0f96ffa524b909d7b026de383ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781060394, "uuid": "34f082da-181e-42cc-bdc8-92d060e0c9f6", "comment": "Malware payload (Mirai)", "value": "3f924880a2f362f9e3426bfcb68e948c5f8c32ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781060394, "uuid": "06b20288-8f7c-4e65-9ace-0c911e76aa82", "comment": "Malware payload (Mirai)", "value": "abae1140d6d4c0a54c7fadfa277aa11c83cad8a7e09edd20b3cba8842e694f496384c414cd8db56f7ebb6525f1bae622", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781060394, "uuid": "040e1a99-a1b4-4b11-829d-c05ab220a840", "value": "T18FE307C7F900E9FAF80AE73644134806B130BBA248925A377257357EED3F1991577E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781060394, "uuid": "1612e182-0e4a-4596-958b-315fbd258b8e", "value": "3072:BjQvKIxSSEpEyMMJizVYjbi+L71MQo0TGcCBAFySNoWc:V9vpEgJiyL7yLvKySaWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781060394, "uuid": "5e44aed6-50bf-4234-adef-f72241651bd5", "value": 156908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781060394, "uuid": "adb5e2a0-885d-4973-b11d-18115cacdec5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781060394, "uuid": "c116701c-8829-4634-a528-346b76fcf6cb", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "730d0eb5-64cc-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1781096469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096469, "uuid": "064c3dbc-1c04-4617-b5ce-5291cef015ca", "comment": "Malware payload (BlackMatter)", "value": "b2cb47c0a84f3c595759718297dfedf3", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096469, "uuid": "5690fb2e-ef10-42b3-b32b-e5631ccf31f2", "comment": "Malware payload (BlackMatter)", "value": "370415c872a4ca6e1974cafb2950c3d31259ebdbba4952a81253272cd6b4f93b", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096469, "uuid": "42a0fff7-9721-4a3b-aeec-6e2c79e2bf1a", "comment": "Malware payload (BlackMatter)", "value": "64cc6b737a013d6f007f29f26166b5b83bff2282", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096469, "uuid": "240682ef-6b89-41e4-8567-804806d4bcbc", "comment": "Malware payload (BlackMatter)", "value": "b59fe7c9fc63ad3f5fc51f29a1d8e4ff9223679c6ff1f83178153a12402afbbb58637965da23bd4a2890d02047dc8e4e", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096469, "uuid": "3ed92af8-8f3e-46d9-aacb-11abc8713596", "value": "T178E37D21F222D0B3C87718F13736B572F3DE8D2C19A56907EA980F59BC648236F45A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096469, "uuid": "c8f3ccb6-fd90-4514-9e1e-3e9964095ab2", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096469, "uuid": "6e630cb0-306e-4d6c-aafa-b916ee4985d2", "value": "3072:n6glyuxE4GsUPnliByocWepVzI5KLY46s:n6gDBGpvEByocWe3znLY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096469, "uuid": "22798f9f-5c21-4d25-90c1-1cc0f0362cf7", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096469, "uuid": "cb2b76a3-b369-432d-a33b-7bb992184a43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096469, "uuid": "6d8dec6e-f901-408c-9e43-030a8814ce2f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb660a16-6511-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781126306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126306, "uuid": "d231aba2-03bd-4da8-8083-c4bb0a66b87a", "comment": "Malware payload (Mirai)", "value": "62dc417cf73b0ba88e65309c8711bccc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126306, "uuid": "faa24305-f0fb-4910-becc-954ad584c245", "comment": "Malware payload (Mirai)", "value": "370883f9f6e88309dffc8b89bdbcfa3dae339bf2d7e41986eac5505a0ae14cbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126306, "uuid": "3eff595b-da2d-47d7-8115-3e68642bc538", "comment": "Malware payload (Mirai)", "value": "279166db66fab3bd6c530e569afd5a9b44344edc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126306, "uuid": "b9cfa35d-fb32-4217-bb04-0b8aa418bb4b", "comment": "Malware payload (Mirai)", "value": "e0b76b87c85b0abaf23778e6a648dce429684367a7f77b89dd1f248ce8abc5328f148898cbeaae9216d6923c6423ab97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126306, "uuid": "5b3b8f34-67b7-456b-8445-4718526629a4", "value": "T1E8333AC5D997DDF8E8201A793077AF3296B7E13E2128EDC3D3999937A942A03D10724D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126306, "uuid": "487a193a-345f-4104-9f34-688f3d43fc50", "value": "1536:PS+dEczOjRC6qf1dhWphmEBa19/MEgnNxg+kC:bOjRC6qf1dhWphmEBa1FMEGN+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781126306, "uuid": "9dd539ae-83ac-443b-8b84-67af06888455", "value": 53852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781126306, "uuid": "04540d3f-737e-4272-aac9-42d066c58f5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126306, "uuid": "5e48bdc7-ba9a-45ff-8321-a35ccecf444d", "value": "kwari.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa5c42b-6477-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781059813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059813, "uuid": "99d35fed-ba3c-406f-9de2-dfa24b70f544", "comment": "Malware payload", "value": "5c434ea0ef6ff7a44f062f6eb98321a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059813, "uuid": "3340fb85-bfdb-490f-877c-69870ec58d18", "comment": "Malware payload", "value": "3720c5a25bb7d4e41c55dc573f927a91d68e97c362e4ac3c1fdcc7d94bd30350", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059813, "uuid": "f0f8467b-211b-4ce9-975d-0bd83d20b958", "comment": "Malware payload", "value": "360d3f6f17b0e31db867513e72515685e6aa1ef0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059813, "uuid": "c3288aa2-dfd0-4829-a90a-9da92acb85e3", "comment": "Malware payload", "value": "52244a5db820bfb73aeec8da0c50a0fa607353f360e129c090fac1546b6f0b7b5937a53e8f4106ce8aec5a779b75264c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059813, "uuid": "cb0a1999-0862-4c55-b5ce-c334a5e9adec", "value": "T1DEE33A07B4C080FDC8D9C6B88FDEE12A9972F45E5138B21E27C46F661E5AF206F6D650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059813, "uuid": "2404a130-2a76-428b-86fd-7732441f6cbe", "value": "3072:pQF/nH68sdanF5doPsMsDy5XoqYmCxJffTHEIQmuHceuQ3w:6ZsYnFS21jHE13w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781059813, "uuid": "66ee8ca6-40b7-42c3-a069-db484d49a560", "value": 146264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781059813, "uuid": "52407fbf-d48f-42dd-ba2c-39112a70f2a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059813, "uuid": "89a42804-aee5-4f92-8259-f77c7a157ef0", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f7aaed-64ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781111083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781111083, "uuid": "59320c01-0d01-4df7-aaef-98f4afd40d23", "comment": "Malware payload", "value": "b4d260c50cd7f64f009409f73d7e2547", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781111083, "uuid": "e29ec063-f4b8-49f4-bfe9-b170351c368a", "comment": "Malware payload", "value": "38cc80e46547cbaf5fc6f20b0fb23b6b50897b8536099d461176b19877aad12b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781111083, "uuid": "0cd306b3-0aca-4a2e-97f4-4b8ff6dc2aa9", "comment": "Malware payload", "value": "8e7d4c3a212d92fdfdbd7fa936ad0202632cf840", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781111083, "uuid": "31d02d3c-dc99-4ba5-82a7-8dc758fdcadf", "comment": "Malware payload", "value": "248513364d08b167eb8daf3480f9675a943f012ada2a3f1063e65a7fd4333103324b2eebdf42a5f84387faaa4a671fbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781111083, "uuid": "c0bfa0a4-b7a5-4ea8-86ae-a8f64ae2228e", "value": "T1DA083354D4759A34DFAB4CFF13A36170A30DC06DBC05A006BFACD088BADA5C637AD65A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781111083, "uuid": "677e8d42-dd2c-42cb-90cd-515b4da53083", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781111083, "uuid": "daf36d69-9331-44d9-bfc4-449d741b9c8d", "value": "1572864:et9IKPj1zRjUnZROsFYb1wESAZgO67w1wrmQgGAc7:eUK5zRjEZybytAZVwClGAc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781111083, "uuid": "3aa564f5-6608-4f22-8c24-0b1c843cec8d", "value": 77318469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781111083, "uuid": "ac1008ce-f0a8-4b1f-9f20-7d0ed8299d27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781111083, "uuid": "e5782140-d8af-4e98-a766-14cbed365ae5", "value": "Nightmare.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32562065-6496-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781073167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073167, "uuid": "acbc80a1-ea32-4edc-9ccb-822e74160322", "comment": "Malware payload", "value": "c309fab927c3898f80a7f2a01c730956", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073167, "uuid": "abc0233c-6d79-4f97-b869-0db27ae19214", "comment": "Malware payload", "value": "3a683ee3937d7fb4e8a8dca9ba51ce6976b406149bed9c95d9e7400efcd48194", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073167, "uuid": "b89d85e7-aae0-46cd-8d86-33f03cc5f51d", "comment": "Malware payload", "value": "98bd5dc98bcca1b335e197b10ac89f457f5eb443", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073167, "uuid": "9c019b0c-bb90-4f87-a318-d8d8690f8e99", "comment": "Malware payload", "value": "83d1115e34397eb8fb465b2a9ae0612728156da2e8b790c96c9c1bfe093aff24440f1166e01be74ac4774dddd41bbbaf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781073167, "uuid": "f3184c77-edb7-4631-8c63-fc0bb0e5acb5", "value": "T1EE31D4DB1F1A368C4901EE6973A12588D054EADE226FD7B0FF480D7BD2C84487249B1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781073167, "uuid": "12df3bdf-2771-45b4-af7e-26d82fe01e29", "value": "12:5V+IrV+EFovJrrP85vptpIrpr7EkBraZN9/grbN9U2rGirrGKBIsrFGaZQrZ1h2/:Zoh85vlKfEf7nKGWQhV4tNW7wHvnAnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781073167, "uuid": "124c2e93-5365-4118-bd18-7bd977efb22a", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781073167, "uuid": "51005077-9cab-476c-b4cb-a59b2229f536", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781073167, "uuid": "f8221a2f-7a79-4e86-9814-1f2d7f5d298d", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "515eea29-64e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781108438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108438, "uuid": "b900909d-ecf5-4749-aa38-7a9954296fca", "comment": "Malware payload", "value": "2c5ee76b7c15edadb0364654ef1e7096", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108438, "uuid": "0be0d936-7f3d-4ee3-9059-cb2a8f189997", "comment": "Malware payload", "value": "3b72ed8b9307a6b0f6d8b22a478bbc5511ad0cf468c49d4dd0667111283f8a0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108438, "uuid": "5280d688-4735-4811-b55f-6d853a228e0d", "comment": "Malware payload", "value": "fa3996da454aa5c7fd10ad574f698714c1f468aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108438, "uuid": "58fdcd8f-4c32-4c36-83bf-0067b5084724", "comment": "Malware payload", "value": "0f406637a03129da73a18a5d06802a4946b5be882128245d308065230b12c1e259d4c4b5ae393b39769e3e249107b940", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108438, "uuid": "b0f4f7fd-17e6-4ed0-9e15-7895dce44833", "value": "T15BC54917FCA649A9C0AEA231896691527B71BC481F3023D33B60F77C2FB6BD059B5B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108438, "uuid": "ed6faff7-4057-4bfe-87ea-b24d77b3fcef", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108438, "uuid": "26f3ed8d-9c60-4920-8585-0174238cc008", "value": "24576:s62JDVmfK/zva9+PVTiQcyzy7D/T0dRSgHEJacEXjr+OPp9zPOfOylZPJkZzPKqW:s6SV/TakeQJzyf7WIgHE8RXjRdyKWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108438, "uuid": "0368cfd9-a8de-48f3-8e97-7d56a2a480ae", "value": 2668544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108438, "uuid": "2f59d1e6-00a8-40a8-94d5-c32ed5d7c8fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108438, "uuid": "d5f38f16-cea9-433b-b483-684ce48d1353", "value": "OneDriveUpdater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9305daa7-6491-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781071182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071182, "uuid": "ecbde09e-52dc-46c4-bd0b-ff40769351f2", "comment": "Malware payload", "value": "83efd711b89e557a379bb56192b0136f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071182, "uuid": "b0ca6925-4429-4389-b29f-d06c42f12b53", "comment": "Malware payload", "value": "3c235f2a79dd4ba968c1692c00ba5e96230513715f81d26d60f460787e49ab71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071182, "uuid": "925d7eaf-2f83-4266-95e0-534c2480e41d", "comment": "Malware payload", "value": "3dc14b47c2a6be3514e14b86bc430e445f563672", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071182, "uuid": "75ed190b-9d3b-43be-bbf7-47dda725bc15", "comment": "Malware payload", "value": "034ba69ca459733fb7c80710a8f814e8103459fc07f993e355d23b9beb7c5ed97c34493e1489151c1de66e9824c3c427", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071182, "uuid": "8b210cd0-f134-48b8-ae3b-269ab81c9c3e", "value": "T1A81733C913E10896F8AFA13DA5D54667D2F171201B31C99B0BE09E2D2D673E6EE31F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071182, "uuid": "b2fcf78b-09e3-4907-ad0a-c0c61f34fa98", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071182, "uuid": "2f26a11a-0727-4053-a71b-0feb0e767719", "value": "393216:02znAP/iXgAt2Jy6xFV61yNdq1B7nrhOzCQLVJHsouEbpiR:tznxv2JLxC1yNg1ZtOzDVtnxbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781071182, "uuid": "f4b60ec8-e094-4625-957b-666db58a8b13", "value": 19150850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781071182, "uuid": "15281578-6096-403d-8212-b161bd04267c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071182, "uuid": "ccd56e8f-38ad-4c28-9782-bb4397c717b9", "value": "83efd711b89e557a379bb56192b0136f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be5042b4-6470-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781057081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057081, "uuid": "faf45616-c9bf-4491-87f9-67a2f1a36db2", "comment": "Malware payload (Mirai)", "value": "a8e1e3f3f4139b3f14aa0b267b56f134", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057081, "uuid": "3ddfc3d2-fc07-448b-aa87-2e36cee33d82", "comment": "Malware payload (Mirai)", "value": "3c2eea21e1d78f6011a278771eefa153bbeab01ba227d624635c67ff058da9eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057081, "uuid": "59c9d061-5547-441c-a7c8-4a38997d67e5", "comment": "Malware payload (Mirai)", "value": "69c4d123d7bf40d75b1537525f83bf1efbd0f319", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057081, "uuid": "bfff53c4-4a07-416b-9bb7-8a59131450ba", "comment": "Malware payload (Mirai)", "value": "9315f93a8d17705d1743b97226de857381bbf1ea3203aa11e5b5d0c58072b727394e187746c0488e8d0bb64cdf088597", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781057081, "uuid": "92953b29-c0de-4ae4-a1eb-7e698c775434", "value": "T1BA143B4AAE605AEBC46FCE30451EC30311ED989A93F5633A757CCF8C39AA7494DD3894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781057081, "uuid": "f10f5dba-dafe-4f60-9b9d-15e7ad6bd757", "value": "6144:GkpdtTCyKdi62W7GKXJ13At9HhVGuZtNxJkUmk:GettEuV7bJkUmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781057081, "uuid": "97ff220d-6043-458d-8f7f-5bec7f5e94d4", "value": 200444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781057081, "uuid": "898f56f1-cd6a-49cb-aba7-31036d968386", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781057081, "uuid": "0a9cee20-6e41-446f-8ca8-2806c782be78", "value": "wife.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca841ddc-6491-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781071275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071275, "uuid": "0d08bbc7-eec9-428b-bef1-ef1a3aee1f36", "comment": "Malware payload (Vidar)", "value": "2855d7e43f6ef057ff5fa70f69981fb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071275, "uuid": "62651fa5-bd8d-45ce-8518-664f479bfdc6", "comment": "Malware payload (Vidar)", "value": "3c41f68260892375f90ce561f17026493a096754c962fcb71351bcd6d29b29db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071275, "uuid": "413008b2-86e9-4766-adee-14c9e537ac95", "comment": "Malware payload (Vidar)", "value": "599930726adf66b3f7bc58bf69c8bf035d3fb1e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071275, "uuid": "c313aec1-4167-4b7b-a7a4-5bbaa43e960e", "comment": "Malware payload (Vidar)", "value": "0364e6b650377994dd26671827636b91e3afb8502dfa4f7098de570f616ddf11e1bd4c427b721a99d1749ec49c133025", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071275, "uuid": "d72c6c33-2a8e-40ce-92d0-654643ae5292", "value": "T12E322BCAB257A0FDC16A82FCC05A12A69B66348A0B279F7F1EDC8DC837C3140F974650", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071275, "uuid": "8e4a9bcc-ef9d-46a0-bedd-c4fcf333546b", "value": "17a4bd9c95f2898add97f309fc6f9bcd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071275, "uuid": "7676b8a5-a7d1-49cc-9bef-692069e56dd1", "value": "192:OJKiiqVmJOH/mVe2ddaD9FahUMJritL2gtj5V2oHdG1+kLEEgEa:OMi9mIH/m0+daD9FahgIgtj5VbHQEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781071275, "uuid": "57183bb0-3248-44fc-adf5-36db8a000a3e", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781071275, "uuid": "45f32014-c8cc-43bc-b1cd-b9423f1c3153", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071275, "uuid": "644827fd-b08a-422c-a3d1-637c90f5647b", "value": "install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11960d6c-64eb-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1781109620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109620, "uuid": "39089789-a622-43cf-91ac-b7e9c4852084", "comment": "Malware payload (DCRat)", "value": "213d5f40829abe4a0c6ee32ec1ebb1a8", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109620, "uuid": "8759a45a-b85d-4a51-a1c1-25f6fa260a12", "comment": "Malware payload (DCRat)", "value": "3c742975836a7071afbb7d23820029f89a48d99f79b85291658a710eb096f9b3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109620, "uuid": "d365ea44-e7e7-428b-9c13-9b17ba16c1ae", "comment": "Malware payload (DCRat)", "value": "61dda991022dbdb4e66f11caa2e3fa91d8d27cab", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109620, "uuid": "e2dfa126-7880-460c-a926-c4bcad3c22b8", "comment": "Malware payload (DCRat)", "value": "cd1b7c67ee90fec67ca284fff7a4d030de260b2e4227b7da272d4bba44d107e09963010af08ba2c8486523e582c1a08b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109620, "uuid": "d2e64485-05ba-48f8-854d-428dca9d677d", "value": "T15E05E701BE44CE11F0191233C3EF694987B0A95166A6E72B7DBA377E55123AB3C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109620, "uuid": "0cfc3ad7-3ce0-40e8-aaaa-a45f10e348bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109620, "uuid": "4301c47b-f68c-473b-b54d-2fc5383bd1e3", "value": "12288:slEb6fy4q2AIemkYlLP0HNt1qfaqKb2/V1iI0zf87Ts1luba:Fb6a2AIeyLsHNzh2N1t0zkEye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781109620, "uuid": "5869fdc4-b77e-47e8-8d67-112f011b4b80", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781109620, "uuid": "3f9a9b96-0360-4ff1-b8de-bcd112010db8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109620, "uuid": "4a69bb95-c349-48cd-8bed-2f8adc0c97dc", "value": "213d5f40829abe4a0c6ee32ec1ebb1a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd682eda-64f0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781112055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781112055, "uuid": "8fd61561-b5fc-498d-b7b5-268bdbe6e325", "comment": "Malware payload", "value": "83cab157ace2702aa4c4d3790c8cda33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781112055, "uuid": "3ff98ee3-d8fc-4c61-b523-5bcb75bc9f6e", "comment": "Malware payload", "value": "3cfabffff6d7f05710445d8e06df02e2953c15bda0eea8e652b5fe0b9a3108e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781112055, "uuid": "76b280d6-427a-49d3-ab68-6a8afcdeae9b", "comment": "Malware payload", "value": "d1a360d151fe0980791f71780a23b3195e2cce63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781112055, "uuid": "4c7b06ac-6732-4163-8489-55f0cf6cbfab", "comment": "Malware payload", "value": "ecca4a8bf1c0990532d3ebbec21fc4e4579ce67eb50266df72a084cc2d9f18f651a35a5d10be756296d38a5604b9a514", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781112055, "uuid": "cf36bcaa-71d7-4811-9ca0-a7aa92272bfa", "value": "T138E57C477C9109EEC099B33189F2729ABB35B8490B3263D32F617A382EB27D04D76755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781112055, "uuid": "830d6ada-b855-411a-881d-74ce603016f8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781112055, "uuid": "056c3b5b-70e4-4aa6-94d9-b1f38aa958e6", "value": "49152:LB2uF/sZSK50PM3ZWeJAqdBaFpIsNY8PIoJRgpoadpqzn7B/:LJElJAlDJXKoxzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781112055, "uuid": "2b4b1af1-b300-4ff5-8e7f-deee9e2262f4", "value": 3245216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781112055, "uuid": "627e5420-bc94-4c2b-8311-e80c9d6e41fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781112055, "uuid": "c432f5ee-5fad-4f04-bae3-fb3b21a25b62", "value": "KingSlay3r-Boot_v2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae2799cb-64f2-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1781112889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781112889, "uuid": "5e59088d-48be-4fd7-b939-b3d67d78c4ca", "comment": "Malware payload (RemusStealer)", "value": "10abdf217a6b33e35fcb6e43cd09af6d", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781112889, "uuid": "eb67f5e1-3d9d-497c-ab4e-2b55159d43da", "comment": "Malware payload (RemusStealer)", "value": "3d9ee40c6b7b67f193511b665d005945179f0d5a9870e8ecb4e4cef495213de6", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781112889, "uuid": "39796891-3fd0-416b-ab62-e9b9f098112b", "comment": "Malware payload (RemusStealer)", "value": "461edc2dec1af872bfa5bffb94c387b8c2c6caab", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781112889, "uuid": "98a9b3ba-b4a3-4c4f-a1c5-a34665b36017", "comment": "Malware payload (RemusStealer)", "value": "acc6917bb69c82c4cd1f5e9a3bb7108b7f258807794b1b2c0bff9d815c0c2a5c5d3a27423f59ab85b837d35bde9dd49b", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781112889, "uuid": "d0eb52fc-875f-4165-af0b-8c029bb9a4c2", "value": "T172D54A07BCA108F9C0A9B33189B352567B75BC081B3227D72E90B7B82E76BE15D39754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781112889, "uuid": "fe003912-68c7-4f35-af4d-223938568ac4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781112889, "uuid": "88009c5e-a79d-46c1-ae2e-8c4146cfbac0", "value": "24576:JsTp6sh0qldUDvcfhfPOuNtVtGM1v9K+yl61tF+4872koBeletI92CIeXBts6Ab3:JsT4xqmvOhOw7P3yl61P+ZDib0cGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781112889, "uuid": "eb4a6d25-e77e-4aae-84be-2323bb8d8f88", "value": 2986496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781112889, "uuid": "fa391e56-b5be-4238-b688-54ffbc494c4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781112889, "uuid": "ab290b39-a428-44d7-a252-af08d29e4532", "value": "WStartereXL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "012d9d96-6495-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781072655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072655, "uuid": "a9e54638-14a0-4180-add0-b45a80426645", "comment": "Malware payload (Mirai)", "value": "81ba84983f7b9f210eed7400fb0e6332", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072655, "uuid": "d855389d-86d8-43f4-9c6d-6fcaee3ba574", "comment": "Malware payload (Mirai)", "value": "3e126730583ee3fc728d8b77e22651f4446942c21c3be79a59ca230923aecc42", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072655, "uuid": "aa523964-b623-425e-a947-3d8e38a8831f", "comment": "Malware payload (Mirai)", "value": "a1fc4f6590b123d11787ebd9207adf329dc2a4c5", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072655, "uuid": "95211ed5-489f-4c16-9e1e-bf7d4aef394e", "comment": "Malware payload (Mirai)", "value": "343f938ddc03cc0b19034add1c1ed19ad223f2e773faa201d6b4955e37bf4bd5ca08077a8cc9ec5227bdc49cf06e662a", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072655, "uuid": "46edf317-4ffc-4bc0-8d73-0903daef647f", "value": "T134A533A29557AD99C2C31B0F2AC1F98EF78D7166DC124833752ECC4FEDE1A2E25065B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072655, "uuid": "e8443a4f-643b-426e-bd60-dc7f94401613", "value": "49152:TZz9WKpiZHonPELPPtkRtjelCjBQfcMCwUVug4:Td9WKIon0PPGtEcBQfczwMX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072655, "uuid": "39f253ea-9966-4372-b16c-a5648ae8a5c6", "value": 2092676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072655, "uuid": "c2ed9afe-5f39-4e7d-a50f-28dfb043381d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072655, "uuid": "819d90d5-97e2-41fb-a5e3-19f6a6168fd9", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea3c17d-650c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781124083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781124083, "uuid": "04d1bc8e-ea29-4e7b-b2c0-4c9c1976260d", "comment": "Malware payload", "value": "ff78109489e82c211455494c2c90843c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781124083, "uuid": "b87eb440-9b87-4d1b-b766-0d68e8d7c209", "comment": "Malware payload", "value": "3e5b5bc7054d240c93904e71e7934261057636152a3f95292b325a7d0442b884", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781124083, "uuid": "b4efd471-b16b-40e5-b288-b17b1d9085dd", "comment": "Malware payload", "value": "127c97973e04b7d8472bd762d1ccf433d0a9eeaf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781124083, "uuid": "19635c14-6378-4766-a2d4-611cfbb88370", "comment": "Malware payload", "value": "70b81f8ec594821cd18c02ecf05731a52c799636b1ad3dd0fa64be91b5c75683be7d96e848b7976e551a6dac2e81e2a7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781124083, "uuid": "ed4db553-c930-404f-b106-4f8968010b10", "value": "T1A206E63CCC18422EF273D519C58A4A1FF8A2158A723CD907A0D7674B6E63583B7D639E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781124083, "uuid": "54af0700-7343-450d-b0dc-d25febc3441c", "value": "3072:yy9LLQoeukofr8j7m9TfxLuvTFgEpbV+ju49Z1Eb8wTw5ZtYFukYxxhOFjSTVDLN:Z2ukuLQ/qKkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781124083, "uuid": "06f6f295-3e7a-46f0-89e9-2e1537d67ca0", "value": 3975050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781124083, "uuid": "9fdcf82b-71ed-4ce9-9338-6a21b379abb8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781124083, "uuid": "21f59860-6c13-4827-ba0c-95defee56232", "value": "comprobante de pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a4d4a5-64dd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781103962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103962, "uuid": "71a81d95-45de-4079-9557-f8ef8bcd1a11", "comment": "Malware payload (Mirai)", "value": "fbe187f92116ae79c8006264829763fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103962, "uuid": "d70536df-615d-488f-bee8-fecc0b18d6fe", "comment": "Malware payload (Mirai)", "value": "3ea9e3906e78d4f535a0db8d7368db6e4ccdc753efd4f8da38ec25ed9c182aeb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103962, "uuid": "7d43ef9c-ed85-45ee-afe5-d290c286e82f", "comment": "Malware payload (Mirai)", "value": "ea1df677942a3e0d9be39d665da4099d700efdbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103962, "uuid": "f2308d76-aff5-4b5f-a88b-598bdb40a3ab", "comment": "Malware payload (Mirai)", "value": "e38907987b02bcf77453b661756770412d5af8fa6365e58a5c1b9080a6c2075aef9cbc4a9de3afed258cf3c0b2232c55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781103962, "uuid": "1e02ce41-ab0c-4458-ab07-7545644107d6", "value": "T160056C16AF805FEBC4AFCD70492EC31710DCE5C756D1A63AB1FC4A8CBA5D25A0AD3588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781103962, "uuid": "2386e224-0866-48dd-a02c-7d9672cdcff3", "value": "12288:hafliPQbbIoh2/Fra5Qm+mOGem5NzmmmmmZJWGebum2vUb8UgYESOvl+M2RInELA:YRxu1b5fsqPWFyqnp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781103962, "uuid": "4de8c928-331f-4b4c-b25e-c81c2018937d", "value": 835816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781103962, "uuid": "497b8bbc-d140-4ab2-aa92-9ea14bf5ca75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781103962, "uuid": "21493bf8-dda5-46c4-b5db-e9d62bfd324f", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87885fe7-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105522, "uuid": "a26b13c3-1241-46f5-839b-8f9f8f92571c", "comment": "Malware payload (Mirai)", "value": "2f9cdffe9d09ed3a45367808e6bb2087", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105522, "uuid": "8f24c8df-ea72-46c8-81f6-a71adc9e0432", "comment": "Malware payload (Mirai)", "value": "3eb2eebadb00dea4720be7202d754c84b36be4de6f9b3ea57c042b6f285314a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105522, "uuid": "d74a3811-ad53-4bbd-8294-5c9749df573f", "comment": "Malware payload (Mirai)", "value": "a6112cfa80189fc3b3b1d9accf09f2496c8a89ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105522, "uuid": "72149db6-5e90-4741-90ce-b4d10a2952cb", "comment": "Malware payload (Mirai)", "value": "7fd9e72832488a843a7f40392dfefdd851eebe7b224f4537c22c9e11931251d292ed90f91ac24c3c9134fd95b6f71549", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105522, "uuid": "9ad25927-745d-4789-b470-3051b2f7a8a2", "value": "T1E3333B42761C0E47C1A65BF4253F27E483FEE9A020F4F68C260F9A968175E77118AEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105522, "uuid": "94ad8832-4bfd-4106-92ec-ffad51bac00e", "value": "768:QgLrHy8idt5GQnLsmNXp0RwFYoCKUK3UbyPUgO4ZJiSHEefR/7tdAYEEsOHYEs:Cz5GkNXmpKUK3U2NrbHkSDfsUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105522, "uuid": "66d4975e-0b5d-4814-bf8e-7878dd556cde", "value": 50140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105522, "uuid": "043e5b71-e9fd-4270-a672-f9fd17e2ef58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105522, "uuid": "31944190-45a9-4062-8fc6-db35d1f1fe95", "value": "miraint.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2253f699-64c4-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1781092897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781092897, "uuid": "17bf48ca-63dd-4c10-8a46-45502e6fda74", "comment": "Malware payload (ValleyRAT)", "value": "dbbc8e8f04df3a04c2f88444db153bb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781092897, "uuid": "a8e71492-bf38-4104-8444-2794a2cf591a", "comment": "Malware payload (ValleyRAT)", "value": "3fa581165b093432e500c6b1c7c09a37a8accd256bbb6382c5dd542866886a98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781092897, "uuid": "444658bb-991e-4a07-9183-415b0308afd5", "comment": "Malware payload (ValleyRAT)", "value": "13aab3ecf543f6ba8721920a586168cb15609741", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781092897, "uuid": "84e88deb-b54f-4f13-92ca-f905609effcb", "comment": "Malware payload (ValleyRAT)", "value": "aacf3fdfe985f10be96a0ccb38adf8abaea1b8933e5479a43695819faf8197d3b644c2d7e86386d21bddbe54f4818474", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781092897, "uuid": "af705b63-6a52-4904-81ed-08fb5f714974", "value": "T1D1868D03ECA559E9C1A9A23089B39252BB71BC485B3223D72F60F7386F767D0AD75350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781092897, "uuid": "19966773-e31b-4b2a-88eb-38fc975c58fc", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781092897, "uuid": "009301b4-2587-470d-bc01-61527d457510", "value": "98304:g52HG2+cQB58NOBw7b7dqKyLnUXrwEkVYlp6PGFf41LAu+ZxPF:a2m2+7LwX7dRywFbF4iLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781092897, "uuid": "23d792fa-aee7-4fac-b0f3-066bf88643c7", "value": 8303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781092897, "uuid": "ac72fd0e-daf3-4515-8ce2-e38949ec008e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781092897, "uuid": "e5de4e93-6fbf-4447-ae59-8c1aa1738066", "value": "System.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8445362f-6493-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781072016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072016, "uuid": "75419834-cab5-4453-bba5-068dfba6a34e", "comment": "Malware payload (Gafgyt)", "value": "3edfc32b6d0b729e13450182f355ca1b", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072016, "uuid": "e79a8219-659c-46ca-947c-9a497e0e4c79", "comment": "Malware payload (Gafgyt)", "value": "4042f2a5d313bc37e0f8ca11d5be645db3449461ebf9c5d1503be0532ff974ee", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072016, "uuid": "743f13be-3146-41e5-97fc-7c7f94382584", "comment": "Malware payload (Gafgyt)", "value": "97c31217e6b2cc76c91d0cfb28e53d756ff48f99", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072016, "uuid": "a9b5ecbf-3662-45b5-8414-03a9876bec42", "comment": "Malware payload (Gafgyt)", "value": "6ab4f973623584a8fd69ef3af4ff465114506265a56afede0ba538c2db2c8eb5ae30f781c69df0758c57afd5f8b23fa1", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072016, "uuid": "334ca84a-7786-44da-89e5-98e1564283af", "value": "T1CBE3D706BF109EB7C81FDD3301F98B0124CCB49725A53B6B3674DA69BA5A58B05E3CE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072016, "uuid": "156098c8-3ede-4838-816d-da8b96361645", "value": "1536:J/Ywb4Bo+0NFgNShEyX2zJuoaZ8jCSRCt6+5Jx0XJwqo5hspJ6xD:fthEdzPasCB/eBo5hspJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072016, "uuid": "c2f82246-afca-48b8-a967-a0fd9da42162", "value": 150112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072016, "uuid": "17be3fa3-73c5-4522-9eb4-fab25f4e4db9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072016, "uuid": "7829abfc-d450-4ac3-a2bd-409627c1fe2f", "value": "FBI.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6552f6c5-64cc-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1781096446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096446, "uuid": "a31a3172-3eed-4e5f-94b8-fbd0b5e29a1d", "comment": "Malware payload (BlackMatter)", "value": "ee8b33f8b062203e9f73fc54730e7c2e", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096446, "uuid": "9bbed526-469b-431a-b417-0edc18cf601c", "comment": "Malware payload (BlackMatter)", "value": "4044ad92b73412a3ca0984bd1f2c4895641c82c437418271893bef418398714e", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096446, "uuid": "2d580d8d-0f42-4696-b381-96d537c7a6a9", "comment": "Malware payload (BlackMatter)", "value": "f348400c92d064d10170513536838958e4e1e313", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096446, "uuid": "7f1484ce-1e39-4f84-9c2c-341990cc05cc", "comment": "Malware payload (BlackMatter)", "value": "b9b1f5bc009b7787afa6c49b3bfbeea5bb4fdfe4267a0bf065cfe5a2a5074a52765ac3920999b69dea572b46771e8869", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096446, "uuid": "4cd7c6e7-b492-4d27-a251-a0b8a5537dda", "value": "T108E37E21F512D0B3C83718F53736B572F39E8D2C29A96807EAD80F99BC648232F54997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096446, "uuid": "7e3e50f1-8381-4b0c-86ca-de4bb5e090da", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096446, "uuid": "20007e2b-78d8-4df8-b71c-8e4233b9e69a", "value": "3072:z6glyuxE4GsUPnliByocWepNfQQzWH2ctDU5dg:z6gDBGpvEByocWe7fQZHU5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096446, "uuid": "e69ebbf0-f0d6-41fa-b8c0-69d87414a21f", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096446, "uuid": "3908f052-10ef-4c87-a667-8ae9e72ec9af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096446, "uuid": "fa46f319-c58f-462f-a7ea-dfec5869b8c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096eb03c-6506-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781121202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121202, "uuid": "66abb4b1-8d66-477c-b224-391af3507bf8", "comment": "Malware payload", "value": "a43409437f7eecf1a4d279b4473c69db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121202, "uuid": "c4960f38-913a-4ce0-b61b-f3467c3ad9b4", "comment": "Malware payload", "value": "4096883c0aff3e852b5a79e37157fb96b8f84acbf876f2f3ec141aa699ff47aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121202, "uuid": "ea9b5444-16ce-4b5f-a34b-9f0ff7a37ea1", "comment": "Malware payload", "value": "4cc374ddd32f10e98f0148d81388cc45f19f0a8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121202, "uuid": "2700b252-209d-45f1-9e8f-b16a76c32ef4", "comment": "Malware payload", "value": "db39a80074699afe75b902c5cca817504d45c1e7fd388e7567994025947c00050c7ef02b8b828c69b201cd7892d6c479", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781121202, "uuid": "d1b4f8ab-80ae-46f2-a36d-fe211ee499ea", "value": "T1F5167B03FC95096DD0A5723188F376527738B88D2B3A23D32D61A3352EB6BE1AD75364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781121202, "uuid": "ae0d6a50-3f93-4b34-a31e-d21bf07accb6", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781121202, "uuid": "43928647-c2cb-4022-9541-1678f5bba52d", "value": "49152:5ZZr1DuN5D5buVtFqx5zcGa7SxtrZYh6++bDiW6PiQD9ChXuzRki5jMRllk4eng3:5bRuxMOVtFQ0h6HIRlXcgzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781121202, "uuid": "05f86570-697b-47f2-8ac9-6eca8e06e905", "value": 4365976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781121202, "uuid": "41614b82-12f5-4c1f-ab02-5bde8769e4cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781121202, "uuid": "774d5286-e348-46b6-811c-e0a77f9baf8f", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4bca26b-64dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781103451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103451, "uuid": "fd2f08ae-4148-4ca2-8a16-1c65a458aff2", "comment": "Malware payload (Mirai)", "value": "2f5ee6e622b28a50f23e696db5f0d30b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103451, "uuid": "4c6b63c5-af65-4bd5-bcd2-06fdf252f994", "comment": "Malware payload (Mirai)", "value": "4098e08ddf2bc16e3106264b0cb831d3ebd16be31cf9ff4d8c9fa4d519b813b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103451, "uuid": "787ff3cf-8af4-41c3-805f-a81c2c3ec5af", "comment": "Malware payload (Mirai)", "value": "891a46a75723a34a0e24dfa967fcec35a513f0e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103451, "uuid": "90fa6411-8e35-4e61-99f6-35dea0825486", "comment": "Malware payload (Mirai)", "value": "85d15cc1fccd0e7b8e56e3d9bf3ccbf29d0bde02dd0f601194c3a33119b34612ad6253fda797e7efd05d4e13e77b6234", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781103451, "uuid": "9d631bd3-e8ba-49f4-a5d6-a14808963eee", "value": "T168433B8BBCC2A91BD1D4237ABB6F528D33A2A3F4D2DB3243DD184B24778650E4D5A580", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781103451, "uuid": "1777784c-0aeb-4cd5-9bf9-f8bd3a87ba99", "value": "768:clagZz/lyJNy85WVx8yWCmU5k7uTNi4aOJS/tRogyWNjYctBNj+E2zboel:YZz/lyJNsuyND5kcNm/7SC+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781103451, "uuid": "117c1db6-b26a-489d-afa9-b72a1d0b95f5", "value": 55832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781103451, "uuid": "d69c9161-c916-439f-9f38-5299f61615d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781103451, "uuid": "91c17075-4b1a-4ceb-8b89-0329de96516e", "value": "morormcey", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d2e7e84-6514-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781127436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781127436, "uuid": "c29f5872-7b1b-4479-9891-4f9629cf6222", "comment": "Malware payload (Mirai)", "value": "bbb7ba06aa1745c5dcb1369cc5a47867", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781127436, "uuid": "289dc31c-098f-4376-9dad-663cf1e2b281", "comment": "Malware payload (Mirai)", "value": "4143a7a5a9c239a318c9d2f359ce7abb55c6758df89a408baeaed5536c1ef2f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781127436, "uuid": "b579e799-5eac-4e17-ab16-bd5096993511", "comment": "Malware payload (Mirai)", "value": "6c2fb090f9317f15b9e2d23392f03bb3ca04aff5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781127436, "uuid": "d5d48241-ff92-4f79-9476-fa8a84929f3f", "comment": "Malware payload (Mirai)", "value": "836cbf1227f2a19263a958a1b872795c4bc12d4dfbab23f96f6ed2a06369a9c26b93d9cce335424df131fa2859b9a5b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781127436, "uuid": "04f13477-84f9-4748-ae3b-bba95b6a3cd8", "value": "T18DB31A89BC818B11D5D626BAFE1E118D33135BB8E3FA7113CE145B2A678AC6B0F37511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781127436, "uuid": "606f25de-77d7-4dbe-9979-0a2394605c67", "value": "3072:RnVRAoc259rla6QET2TovEzQeEGs+LwYDmVwpEJaT4RrTHdDB8DGXo5:9e6vdvEzAGs+kYAMEJaT4lTHdDoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781127436, "uuid": "03fd3f08-fe78-435e-9d44-1b0590f7dc26", "value": 116512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781127436, "uuid": "fc7a2285-4d79-4f4c-bfd6-79f3cf344391", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781127436, "uuid": "e8b11419-23c0-477c-bec0-b268aefe2a8d", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "094ba54f-64cd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781096721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096721, "uuid": "38a10f45-63e9-47ad-af1b-7c775981c7a7", "comment": "Malware payload", "value": "b47ba9b44f6559e1d9e26e38f9cf8771", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096721, "uuid": "552e63ca-ac38-476d-a06c-82acf7e5a835", "comment": "Malware payload", "value": "414f2ad91a23512aa4f55c15fb7f06ace0e178a3df84d5dd6fbe87b47fc8d548", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096721, "uuid": "0016fbd8-e23e-44fa-b703-e869fa5c26de", "comment": "Malware payload", "value": "a2f4f4f4142727e6b8dcd7bc093865e533e18b77", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096721, "uuid": "4d2318fa-8096-419b-9608-907354a004db", "comment": "Malware payload", "value": "dbf6cc27e3ad0117d5edb25b166d73f05fdb71895555e0d2b443a59a292f5abe1326f89ea429e11e122bd25c4e4138f1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096721, "uuid": "6159337c-da14-409c-bdd6-14e490f2e103", "value": "T1A6136915769FCA1422A247890AAF07B54B6F795F1FBF409A004DEEC98FD35229C473B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096721, "uuid": "898dcaf6-73db-45cc-b84e-295a85219e2e", "value": "384:1F8sS+1EhZbUvWuPekj0R+52DaG232YxjbmII5CVn:1F81rhKeoe2ZG232iKI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096721, "uuid": "876a10d8-55a6-46c2-938f-f61c517da44d", "value": 44464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096721, "uuid": "fb2b6be6-5618-4286-8939-ccbd55ae6b05", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096721, "uuid": "0d6f20db-512e-48e6-b3f5-565f7a8e3669", "value": "Factura pendiente de pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "397e3ed6-64b3-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1781085635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085635, "uuid": "144fbfc6-1c41-41e7-be0d-1c0137c9a527", "comment": "Malware payload (AsyncRAT)", "value": "4031b61216fbceec685e71ea0dd39db3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085635, "uuid": "4c0234f9-bcee-4b5d-afe4-1749fbe60ec5", "comment": "Malware payload (AsyncRAT)", "value": "4183648bf9b7677843bb02cbdd90602b0708e3f76bc2f8e3d0bd805df3bedeeb", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085635, "uuid": "861b5400-ef48-4644-9875-caa31a86b9e1", "comment": "Malware payload (AsyncRAT)", "value": "4419d6350cc06212b669246bc6827933e151d82b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085635, "uuid": "1e437ad3-38d0-4588-a4da-c5c78d5c89e0", "comment": "Malware payload (AsyncRAT)", "value": "f6560c3202f06a8f3f8c3555216e7249f4c25043cb46bf21c51ce6b6a19fd3393aa7fd435a3d37994144a4cda395f0c0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085635, "uuid": "967dc49c-ca15-4565-9810-c373215d15e4", "value": "T154D22A0873E98A51D2FE4B794833C604C776B5975D13DBAA6FC8909E2E237888E14FD0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085635, "uuid": "f5125492-3f40-4826-9b06-a14083371f70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085635, "uuid": "51fa6a03-6c02-473e-9f31-9b751c6d1778", "value": "384:0lHwObD8axtT4wE+eAP/H9qbuUsZQxnCJfTMzFdnjJCfFOw/A:SQ0AsOwESnIbnBuMzFaTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781085635, "uuid": "e67504e8-d605-4866-ad4c-9504e8178bcd", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781085635, "uuid": "f95fe6c9-a440-4f89-8171-3c280e63fd50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085635, "uuid": "0431e3d5-fa4c-4397-8e0d-cbacbedd9438", "value": "2sn7bt.sa.com_54c10685_s_avast-setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f7535a-6492-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781071749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071749, "uuid": "22d4af65-be85-4228-b893-9e41ffe630d9", "comment": "Malware payload (AgentTesla)", "value": "63f00c6f65bc44e2916fa27a51f6c752", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071749, "uuid": "f8626e1b-d66f-4294-bcbb-1e8588a7189c", "comment": "Malware payload (AgentTesla)", "value": "41ab007d2e42cfb2b514b10adcfe74124b0bc6dcac1e9521d14e1bc850f94409", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071749, "uuid": "a71f3680-7bd3-418e-aefa-dd51ee1c130d", "comment": "Malware payload (AgentTesla)", "value": "54d4e08f6a856b2f54f994c38b2796ff9d55e18a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071749, "uuid": "26db6f12-5a79-42e8-9c0a-ce4899db40f7", "comment": "Malware payload (AgentTesla)", "value": "a0334ed3cbe8ccf74b5efb506619bad5210b5cf81dbdd85e18ef6ee1271b4f4e0d0de1d0469a7f639ec9fcd368cd9eae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071749, "uuid": "2d783687-ca72-4bd5-a036-70e8ecd0f329", "value": "T16CA55C17D66F574D280E7B61106A5D9AFE89CAFCEF726BC4E08F90B510EE1100B856B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071749, "uuid": "31685217-13a5-4ad3-8a47-2d73d35b9f50", "value": "49152:Fv4NLAJqGA9ELIX+AEwbixz0UqjdTEzVmRdKvnreAS:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781071749, "uuid": "1822cc38-dea0-4f3e-b43a-80a16c5b3f28", "value": 2137404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781071749, "uuid": "810d28dd-b8fe-4ac9-8d61-df2b0c74f544", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071749, "uuid": "d0b5656b-ef3f-4dac-ac66-21ced2af2c69", "value": "Payment Receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "727aaaf3-64bd-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1781090025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781090025, "uuid": "42b5a471-3e05-4a31-9891-642fabeb101e", "comment": "Malware payload (MassLogger)", "value": "b1d4b73d477faf1fbbb6fa152444539b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781090025, "uuid": "02b9bb31-3bec-4d9c-a51a-14215e0b25a1", "comment": "Malware payload (MassLogger)", "value": "41f13693681cc7e8b773cae573f5e1bcbacbadbb0d271623b241baab64a3a43c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781090025, "uuid": "597899fb-bcbb-4534-967a-aabd21be5341", "comment": "Malware payload (MassLogger)", "value": "a279d2dc5a4ac6b8a31bbf816f7a179e335ebea0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781090025, "uuid": "ee89cf5d-ef8b-49e9-94ab-df8d286b9b74", "comment": "Malware payload (MassLogger)", "value": "b47d1c66713b75f2c786aa9b41a7aec8cab8d4b59cb80b20fec68b8a2cdcc59d6f73f2d9bdbefb9e46580d1659c90ce9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781090025, "uuid": "af5f2644-996d-403c-aaad-9ef3d55b471b", "value": "T1C5163A3DCC58412FE1B7CA18CAC6451FF8522A2B621DED4750C73B9F5D23682B7A216E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781090025, "uuid": "e16e6a1a-6b4c-45f1-9413-6539d04fa4e6", "value": "3072:d0Z2852mxZMn129APYtfPwMu9EvQ6vgYG8aumMFz13UaNVloNb7DphHH0/T8/hVN:Y1v2jLhnE2K2juvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781090025, "uuid": "a2642a8c-8f1f-4e5b-a26d-09e0c7378384", "value": 4042060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781090025, "uuid": "2172f876-fa16-4684-8641-afc9f2daa8b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781090025, "uuid": "bde327d0-03ca-49c8-a1b0-e136ad3497cb", "value": "Purchase Order #426497.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a4d9427-64d2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781099058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099058, "uuid": "be22a7da-8a24-4ffe-ba96-c863e16490e8", "comment": "Malware payload", "value": "3874c726e8e18e3234a624c10cb3cdae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099058, "uuid": "97b4d872-77a4-49cb-b91f-f0e333cd0c18", "comment": "Malware payload", "value": "4255882d47e2ca1175611276b7648225ed5d8b0911f37db720e3271aedcfd60b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099058, "uuid": "1b233db0-05fe-4582-9315-891902576d7b", "comment": "Malware payload", "value": "5dce5d81cb727cb911f591cfb026c129e99dcf3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099058, "uuid": "ca0e6d1f-afd0-4388-8850-31d9b0893071", "comment": "Malware payload", "value": "007583022e52491088a2c8f7ab64751aec0d5d65bd1d99c94867d7ce266bf436dc6edd24ee7011242a9080b29dba75c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099058, "uuid": "259d46e1-33bb-4a24-8c23-48db8e68ff09", "value": "T1D947DF77814338E9E5B98DB4D41025426DAC388B5738A3C7BAC471E667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099058, "uuid": "04ed7180-6a4c-498d-b8fd-edea66c27e84", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ3:cqYUQuVDt0TZEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781099058, "uuid": "665082d8-73c4-4737-a7ce-fcb862759593", "value": 26247168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781099058, "uuid": "766278b0-7645-4821-b882-186ecd92d62f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099058, "uuid": "be5e70d8-3677-4bc3-a549-f7ba8d006665", "value": "4255882d47e2ca1175611276b7648225ed5d8b0911f37db720e3271aedcfd60b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b67a14-64d5-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1781100396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100396, "uuid": "8fe776e6-d4a1-4d3e-b719-34ece146916e", "comment": "Malware payload (AsyncRAT)", "value": "799a765d84a7c277cdda6d69becf831f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100396, "uuid": "60e07868-6316-4f3a-a966-27e0b059611a", "comment": "Malware payload (AsyncRAT)", "value": "42d456327573520ea9f39a59f6995f4576d2c8b97b322db5100732f7a417a15f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100396, "uuid": "1c4b2533-8e5a-4d7b-84f2-3a3d73b27a07", "comment": "Malware payload (AsyncRAT)", "value": "3782be4abfebee3e49d317d4280f0fe7d765ed3a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100396, "uuid": "ccdccc76-62ad-4caa-85f3-859f5037c3a3", "comment": "Malware payload (AsyncRAT)", "value": "fd6f86b1c2586b16232496e8ff75ca5f45161d0b15adb3153294953ce3c05b02d19ba072e5b9e6921318eff5309be820", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100396, "uuid": "78135c8d-600b-4fef-9efd-7c1d0bbda7c4", "value": "T199535C003B98CA65E2AD46F8ACF2950146B1D5772102CB5E7CC814DB9B9FFC64A523EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100396, "uuid": "b1fc7fe9-1fd6-4f3a-a4be-72a5de4c8750", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100396, "uuid": "fcf6e1fe-c041-47db-b9e3-67f241603b1e", "value": "1536:SJBnX1VosLNPMSfjNeeiIVrGbbXwfJOC1GGDpqKmY7:SJBnX1VosLNPjjweXGbbX36gz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781100396, "uuid": "0d9ed12e-3aaa-4ac8-a092-fe6340bae578", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781100396, "uuid": "e4e5cc07-fb0f-403d-bc65-1db0d553e27b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100396, "uuid": "22fae777-e88e-465f-af54-efaa17763d91", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d68ea78-64a8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781081024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781081024, "uuid": "68fcbec6-737c-439b-b84a-417c7c130957", "comment": "Malware payload", "value": "99dd97786a34107a71a8e395a8a7cd50", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781081024, "uuid": "08a23d82-c5fb-436d-80de-6a86b526443b", "comment": "Malware payload", "value": "43a2c3e869bcf8fc9e90732bdc3a85f949c854fc2e80bda5598bf8474c64bfa2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781081024, "uuid": "6aac2879-f2ca-4a60-8f05-f508ac49899c", "comment": "Malware payload", "value": "47462dbbe84922c521eea22bc75c759659515acf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781081024, "uuid": "5b994dec-425b-49ee-8814-f2eabd91a608", "comment": "Malware payload", "value": "cf6fb987414dc5df89580ba6c2c1dfae737aa60dce96acb55b6753f789350f86a154a2a7b7ea3a1d02cff9915d6a6c49", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781081024, "uuid": "4b20b240-9333-4134-9d0a-98e20f167073", "value": "T1D931D4AB171E3AAC5405E9A97360155CD094E6EA304FE3A0FB880C7BE2D95583219F8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781081024, "uuid": "2c5d716d-8d04-497d-981a-ec0f16dea010", "value": "24:InVbRQubMtn4dENycKcqgsHR9pHBOsijUJyaYZjU5Z:InQhtn4QQOgiQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781081024, "uuid": "f961e4c2-d76d-4d4e-9125-38203bae748d", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781081024, "uuid": "ef447d39-0270-4116-9b16-9fea1e7de3fb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781081024, "uuid": "d4af911f-5918-4aef-8f34-a01e3e18aafe", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a32886b-64cd-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1781096937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096937, "uuid": "026eea0a-cc05-4ddd-94b4-f1e5cbb58e84", "comment": "Malware payload (BlackMatter)", "value": "3940ba429c8f6094617f50da0aa984be", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096937, "uuid": "39bb5f8e-04cc-4e0f-bff7-5ca5c86601e0", "comment": "Malware payload (BlackMatter)", "value": "43fbd94e73040bc4db717018ba42a6139a72e000e19314bcc51beed9699385f4", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096937, "uuid": "52498c28-6c30-4bd3-a500-c29f10fd4954", "comment": "Malware payload (BlackMatter)", "value": "97ebe8b34d200a22e83e587f32d3b0b9b6503013", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096937, "uuid": "9d133dca-00a9-4ce1-8f39-0fba572ac76c", "comment": "Malware payload (BlackMatter)", "value": "7ce12b0ee150bd3ae13715378c552bedf85602d7080a249f93e254ea443c4ab417ec0291e037d476d052100f1df49f5d", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096937, "uuid": "9f6c1c9a-78c0-4566-a3fc-fbc814a4a656", "value": "T1E5E37C21F212D0B3D83718F13B367572F39E4D2C19A96807EA980F99BC658236F45A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096937, "uuid": "330cc6c2-2769-49fa-a48a-9352ddb153cf", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096937, "uuid": "7bbbcb9f-550c-4aac-b84b-92c604e127ae", "value": "3072:j6glyuxE4GsUPnliByocWepua4yqWkrtQl23:j6gDBGpvEByocWeAa4ckUy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096937, "uuid": "198acc43-7dc4-4624-be26-23733e9643ad", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096937, "uuid": "a94d4768-8d6c-4948-886f-fe5cab3316c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096937, "uuid": "dcbd7a4f-a5d4-4c8f-a735-d4bffbd11b29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a43654b-64e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105983, "uuid": "b59df2fb-7f06-4480-aecd-7ebfba3727d8", "comment": "Malware payload (Mirai)", "value": "57e38f22acc661bba74a16871502eaae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105983, "uuid": "d4d859f1-4bd9-4d1f-97a1-6f66c2aded4b", "comment": "Malware payload (Mirai)", "value": "4409090911db2ab055d4b7a37f27cb48221fe3cfafa28764c209b67d36f25e65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105983, "uuid": "ca788dc8-045c-45ff-a696-332d79a48f7b", "comment": "Malware payload (Mirai)", "value": "7b59d8a0d1e8a52215b697583a0e69fbd2d33d68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105983, "uuid": "01aa1f41-65ac-47fd-8b7d-838cd363c1c5", "comment": "Malware payload (Mirai)", "value": "3e69f1b7bb7fe5c39a0c5f1c67c2765123ac716e554501b2e943bc90feb4f4c3738993ae9696442695967677ce18d194", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105983, "uuid": "0c01ccb9-648a-46a6-8305-608b0de45318", "value": "T13983C6297E218FBEF79D823947B78F22964837C637E1D581D15CDA005E7028E641BFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105983, "uuid": "5f453ba1-2ab3-49da-a950-d347bf0988c6", "value": "1536:E6/iw/0w8HoQ5uy8NxqlcJ0vXxh11xYqcn6BZOpkMoArgR:x/8RHTgMcJ0fmqJZOpkM/sR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105983, "uuid": "fd8c12e2-3239-4bb4-9d6f-7ad223d1446a", "value": 85312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105983, "uuid": "e6020c9d-e197-4264-a013-8cbcbf2bde8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105983, "uuid": "41dc5df3-cf40-4611-bb4d-b98451927756", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "812bfe22-64d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781099928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099928, "uuid": "317e2176-2e3d-4c1f-830d-c3397a920e6d", "comment": "Malware payload (Mirai)", "value": "10a43f3648aaae9002611386178fae90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099928, "uuid": "888cda70-b0f3-4d39-a1c0-9454b8cd03f1", "comment": "Malware payload (Mirai)", "value": "441d481ff2950e2bafda0096c29bd2febf09198733f38fc66096b999de1b5c00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099928, "uuid": "ba3b50f9-2c5e-4cb1-9a03-51dd9347a5fa", "comment": "Malware payload (Mirai)", "value": "4a95a71e067a2825f726f466711fa8910971902d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099928, "uuid": "ec54baed-d5fc-4d48-9e9a-cb7f13a48040", "comment": "Malware payload (Mirai)", "value": "11d653a7d7ded3e6c4fb9c37c89e358a1c98da9307e1c68850368032b41202642b51a6ceaf7e56509b5e31c1c815d078", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099928, "uuid": "f6466269-11d9-4931-b0f4-9c16d43df6b4", "value": "T1DEB30845F8505B27C6D212B7FB4E438D7B2A57D8E3EE320399256F20379B96B0E3A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099928, "uuid": "5000fd4b-9713-46d6-8bc4-6ddc3e4bd8b6", "value": "1536:0Ce869BKH0aC2Cud4Vi3prTbVKJ1R84SQNZwlzQdwyw9NYGGXE/uXJ4u4hnJgOR/:0CAe0Zw44prnVy1RFSAo8jwnH+f2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781099928, "uuid": "8abbab65-8038-4983-a0e1-d4c48ea6aecb", "value": 115328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781099928, "uuid": "f7d9a7bb-8143-4f54-b492-f022c3cfaf92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099928, "uuid": "88c86f53-cdad-4d95-9418-4f344b596844", "value": "CRY.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f97bba-6498-11f1-a769-42010a9c0008", "comment": "Malware payload (PhoenixStealer)", "timestamp": 1781074064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074064, "uuid": "3cf519f1-a251-45a0-bbe5-1dea4315bb73", "comment": "Malware payload (PhoenixStealer)", "value": "0b7e3c17d4c866c7c1ef3139221c51de", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074064, "uuid": "3ec4220c-51c1-4aba-a302-e6b49968ac4a", "comment": "Malware payload (PhoenixStealer)", "value": "443ab50f1e37a066234f533d168d1215f74242a187bc7ee02c0133661626940b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074064, "uuid": "351d9573-13a3-451a-85f5-e8abacb6d6f0", "comment": "Malware payload (PhoenixStealer)", "value": "71167f7736b62ec9ced18afb48370087646320f7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074064, "uuid": "e27fa3ee-f6a0-4b35-b4ad-d0b74148668f", "comment": "Malware payload (PhoenixStealer)", "value": "df5aa5262dbf1ab7548960802d776c64b9eb63ff6f510f274163b44abaf793a622d31f227d4634ece08f1e6ea0795b26", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074064, "uuid": "70844131-fb01-4c9b-a3e0-67ba19c948bf", "value": "T17845E63DCD14412FE9B2C918C899455FF482699B221CED4BD0CB6F5F6E62882B7C325E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074064, "uuid": "3b366bc5-27dc-4fa7-afb9-99288b23dc44", "value": "3072:yBlWrOFcmIUG+XG8G88KyDv+qdAvKcF41YNt+ZhEVi3gjdBH9eVIn49edScPvH/O:bOkb2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781074064, "uuid": "8f401f5e-4363-4ae5-bb2d-82af1f138bcf", "value": 1198274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781074064, "uuid": "3750e121-3fc9-40e7-bbf1-415239c97ef0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074064, "uuid": "993f1d29-d5e0-4b76-88b4-6b381b2ccc91", "value": "Proforma Invoice 20260610.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c30260-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105521, "uuid": "d0cced20-6cf0-42df-bbc3-3ee5951f5f89", "comment": "Malware payload (Mirai)", "value": "6b0bccb0e67cf1b85facfc1ce92bcdd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105521, "uuid": "6e4924bd-be04-4a09-be6c-88f15de52bb9", "comment": "Malware payload (Mirai)", "value": "446ec00614b516fac8f65a6db8d6d68f9a1436d612fc266ab7748e3a2f92688d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105521, "uuid": "83763391-9ef9-47e4-b30c-d85af693228c", "comment": "Malware payload (Mirai)", "value": "24a87a452f098ef2ab0c9824c66255ccf74c2471", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105521, "uuid": "ac5df993-d759-42a1-a41c-1d5eac66f262", "comment": "Malware payload (Mirai)", "value": "dedb3d83e2574ed5b42a3220c39ee28223a74117d813eb92b798def8720ff26c69e1a0ad4d1bcb982063505293952948", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105521, "uuid": "c7e519c7-ddad-4bb3-bb58-fbd9df6f44e0", "value": "T17A639209BF611FF7EC6FDC374AE9274525CC641A21A83B397A34D818F64A24B19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105521, "uuid": "1f2a99a7-c03f-4e7f-8d69-3d56cb4db758", "value": "768:aBn9czWVIl6e8i2Sxt9yYULRyP52o5vOeWve6Wek7xSeNpXiFN9FSD8E:aBn9yWVpeb249F4PoQPvrWL70IsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105521, "uuid": "c4280cb4-9f45-4264-9638-29cba434f6b1", "value": 71568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105521, "uuid": "cd8bf00f-cf29-417b-9ac2-8dda4f14f038", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105521, "uuid": "658a97cd-3535-481e-a74f-9bd84a3d817d", "value": "miraint.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c34450-64a4-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1781079109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079109, "uuid": "f9a59ce7-7551-4d09-82f0-832fe453ca7a", "comment": "Malware payload (DarkCloud)", "value": "28141a3bad4e464abb1ddb28f60fb18b", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079109, "uuid": "2ca9cbb1-3c5b-424a-98ef-bfd163bbce92", "comment": "Malware payload (DarkCloud)", "value": "4478325027d1f2078683f6ee23223ab623561adca7b249b506dacf2c5b1f52d8", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079109, "uuid": "c4f5d9e5-0a32-4ebd-9c0f-9d4974b750a0", "comment": "Malware payload (DarkCloud)", "value": "582e2eb514e7fce182d03d237d32147468507802", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079109, "uuid": "d0a15668-2265-4fab-bc84-9703d3fb5630", "comment": "Malware payload (DarkCloud)", "value": "f056a0dc65e76724c8e8335fea5b1dacb683336298b5a3bd2eb6d52d6bb4617e14a672deca13f7c25c3c69f7239ad990", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079109, "uuid": "af8e021d-86a0-4e72-b943-9679d03f1e3d", "value": "T121F4193DCC65052ED572C62DC49A495FF8825A17223CE84760C73B9BAF63542B7C23AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079109, "uuid": "f2c42bc8-d5a4-4428-9546-879d0c03bc2a", "value": "3072:A0ah2ADK1w6zkOnNVGOz/s8cuq9pOGp4x1FgJ9Gyf9H7YAtqRm98FKgK/hbBDCbL:YOnbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079109, "uuid": "0194ebd8-4e75-49bf-9414-4f4ab4fbfd6f", "value": 772032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079109, "uuid": "71b82462-71dc-4a43-9421-bd8595e14f25", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079109, "uuid": "66efa5fd-9cfa-46bc-b82d-96125b8cfceb", "value": "confirmar cotizaci\u00f3n.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f9f000d-64b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781087927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087927, "uuid": "b7c354e6-4308-4b63-aa51-babcd9a9be03", "comment": "Malware payload", "value": "ad3d0b53f8eb6b05ee9623b16a7e0f30", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087927, "uuid": "148680bf-43d6-472b-b87a-ed073cbaac42", "comment": "Malware payload", "value": "45171981ac23dcb7e90dd9a3ce07415720be92815bcd2ccfe51e716d736eab3e", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087927, "uuid": "909c7b41-61dd-4403-8aea-0294d7203766", "comment": "Malware payload", "value": "a8495760f9910e89d63a96498da1b9f61652b8da", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087927, "uuid": "1e59656e-2c80-4de3-b3bf-f850182c9b3f", "comment": "Malware payload", "value": "0e6e5759f3943399ecbc3953047289532e81416b6daf87ba9676505ad5ab81e86bca69bade1ee40aee84ff1b55239cbc", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087927, "uuid": "04bab105-791f-4830-8ed8-eb735ab2245d", "value": "T1BA512F562AED1330E37A8D7788F696518533BC6AED664B1E01840BCC2C53601EC31F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087927, "uuid": "c3c29c5d-6db3-45e7-ac22-b5ce22e196b4", "value": "48:8EOWQ576M/xwa1yTATSd08XuH+cyDCK1CCXv3yNYYk:8EBQ5763aUTATBGuevDrv4YY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781087927, "uuid": "4d5feaff-4256-4b1f-950c-22bc91472f08", "value": 2974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781087927, "uuid": "a4970923-109c-45fa-a136-51831c34dde5", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087927, "uuid": "3d1ff398-cf38-40ac-a76d-1be3ad36bb68", "value": "agreement-inovice.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdff37f1-64d6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781100889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100889, "uuid": "9e4e5c25-e7fc-4e08-a49b-9a2d0c85e103", "comment": "Malware payload", "value": "eb7fe0fd1463a58a165df1111669eaea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100889, "uuid": "719d1163-da76-4e86-9d09-fe4fe4a3d1fc", "comment": "Malware payload", "value": "461a9036ea41cca79988c0504c72059af47b5e8ec1a9194d88da5395fe4e452f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100889, "uuid": "780ffafd-685a-45b5-b982-ec16652b1cd3", "comment": "Malware payload", "value": "df510f6f69a5c149c216c7b3accc4f460d8cf363", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100889, "uuid": "94fa1e59-af16-4043-92cb-bad1d77bb357", "comment": "Malware payload", "value": "188f73faae9105b1221f04060dd3c6ee018872bf1906f3468dd1fe5a70ec6802ef38e1200c3ac271fe3ee973debaf188", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100889, "uuid": "6e6b6854-910a-4f5d-9289-e36e0433d54d", "value": "T18FA44A25BC819B91CAD16EBFFB5E824833130B7CE3EE7111DE155B3526DB84A0E7A442", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100889, "uuid": "c3c02d49-2594-4863-b44a-6eef8a6f3a13", "value": "12288:yhznq66fMpivtI2TomrsihZOWamZaPcqgG7ikaOUEOHTqCZb6V:WzqlEiQmrly7PfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781100889, "uuid": "6bdca25f-17b4-45a1-afed-e8bef6db657d", "value": 456264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781100889, "uuid": "a50e5dbd-9592-463e-a598-20652ea237c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100889, "uuid": "4beca562-bd1f-449d-b755-aeaff22c5f19", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c88376-64e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105971, "uuid": "54dc9418-dbb9-400a-812c-eca261f4cf33", "comment": "Malware payload (Mirai)", "value": "671ae05471b14f1922c7a6bf10c1c803", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105971, "uuid": "794f4328-9998-4573-b7e3-297078f8d3b8", "comment": "Malware payload (Mirai)", "value": "46d8c4f39f0a9cfcbfa91846421775c020aaf67da3d9fb15ffd643e5f0697901", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105971, "uuid": "ee453e01-19b3-4f25-83c6-af122c1ca746", "comment": "Malware payload (Mirai)", "value": "699712032fc6aebc7417f09cbb91afe8ab088b83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105971, "uuid": "617b7b4b-3c5a-4d09-997e-30d9e6f77030", "comment": "Malware payload (Mirai)", "value": "f039affd62fdc1052a553c1c9b9ea9a5d2f0d21f1aa4208cbf7f777e0e4eb14fff3c2d8867d4c8385526a680434e89bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105971, "uuid": "bf325f48-1f29-4b78-8180-201661566ff0", "value": "T15193D706BF610FF7DC9BDC3705A92B05289C665A31A97B35BA30D818F64B21F19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105971, "uuid": "7b6adbf2-888b-4a14-9e3c-b71d7122df38", "value": "1536:NF2GXYZ8a8fnwEvLNPENIdhs9WZx0ZCufq4hK:NFjXYyCEx0hhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105971, "uuid": "646210dc-75f9-410d-80dc-bf280d5887a1", "value": 89408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105971, "uuid": "b4f7a0e2-47c4-4224-80d1-83c8803f6576", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105971, "uuid": "18f6960c-7ab4-413d-85a0-541afc8c150e", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f245bed-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781108891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108891, "uuid": "ee885bba-51a4-4fa0-9b64-1dbe42cec837", "comment": "Malware payload", "value": "167a3829f1eccb7e4ad3146c3b458f78", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108891, "uuid": "ba385a42-373c-4f86-bfdc-c28a3b64b256", "comment": "Malware payload", "value": "47865ec1d4f69febee81fa3a2e0622a1d84a86e5bb641eee340557df50ea9e4b", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108891, "uuid": "89330191-552c-4c77-8e65-808291acf767", "comment": "Malware payload", "value": "32971c7f55d450b6c0ada65fad581318129c4334", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108891, "uuid": "0c497395-6941-4964-849f-1230d905c20d", "comment": "Malware payload", "value": "b0537bc7aa8ddcb49bd551595547d918a6f8642f0533b729dd68e632b912812d8a419ce5faf994ab1e8a28705c0bc3ca", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108891, "uuid": "b2c62eb7-df38-404b-af34-87960ce0e7ec", "value": "T14E9512C6D35EF8E66156F253D40A57F22B76A78FC6A312C1DB1AF34047A869620B03F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108891, "uuid": "2513a289-1b58-4379-8e17-f5aecf258408", "value": "1536:Cl6VlsEx6lTsgitx2CnUNCJypCK9gLA2ycUJ3a966FlUWb+tjY8wAJK1WP:+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108891, "uuid": "728bc688-334e-4026-a012-84dd904dc636", "value": 1940146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108891, "uuid": "76d572f4-86b3-4f6a-8604-d6d97619f4c9", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108891, "uuid": "63a1123c-8d21-48f4-ada4-2d38ef137b7f", "value": "Quotation.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba13b9cf-6498-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781074254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074254, "uuid": "71cfe7d1-feb6-4f9d-a9eb-bdeb9c46ac9d", "comment": "Malware payload", "value": "b6dedad5b85e108b7c9565d64495b458", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074254, "uuid": "9f02967a-7dcc-41bb-88f5-38d176e14738", "comment": "Malware payload", "value": "48b77bc84b6a1475fa0740cfab41d5998c0619e90f625f13e07181e08b3c7f4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074254, "uuid": "83193ff5-346f-48ea-8ec3-1043d4eca148", "comment": "Malware payload", "value": "fa886315102b5557198528fa0dc08e5c2ad9546e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074254, "uuid": "0515152c-dc79-4e52-a417-9b73327caa04", "comment": "Malware payload", "value": "b9ff84ccdbcc971bd65c7e318ffdfa9e7544c669444b434a89dfa48cf96b576fd6994d4b6e3bda82a026a65eb86b6ec1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074254, "uuid": "6b78e84f-8b34-47bd-99f0-6fef96fced69", "value": "T1E534294B36A049F3E867913899A3DA52F6B2F8501F60D74B11B2833E5F7B7606D2C712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074254, "uuid": "48d19c56-3e2e-4392-82fe-ca081e363009", "value": "9f4f596758445ab6c6347917cc8d7ee9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074254, "uuid": "3655f9ce-1cfd-41b5-b4f0-f127e54ab4c4", "value": "3072:IKMAIWIu0Zs0vEzkMHAKHf8GaVJpRrbJmRTfOEm0Ykl5gZ5bFGE8j:IHdn9i/KG0fwOE35kbAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781074254, "uuid": "390dd2c7-a17b-4894-a727-091b3f69dd86", "value": 241344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781074254, "uuid": "e5904d49-6afe-4127-ba6e-4e8ff0871ac4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074254, "uuid": "9555d543-74c7-44b7-9fcc-8144ecfdc90d", "value": "MSOCF.DLL.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d1c813-64fb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781116628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781116628, "uuid": "0a604349-5fa4-46ec-ae1b-e2bb90f379dc", "comment": "Malware payload", "value": "8953165ae513622b3c976dfefcbc7e66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781116628, "uuid": "d5199d6c-677c-4623-b144-39567bb683da", "comment": "Malware payload", "value": "49f730662afa06738e3694018d8e2a196a96266c36b3f864add5bd5977baf04e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781116628, "uuid": "0d75d172-fd34-4ceb-b305-569529aa99d7", "comment": "Malware payload", "value": "0c6cfbe88b347b6ee86cf93fbd562d87646d5b25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781116628, "uuid": "475697e8-33d8-4f64-8dc8-b5033c27ae39", "comment": "Malware payload", "value": "0723d6fe5fc4a05241e303aa7c9083e18792776305ff21c75f0a672064de6f242ab5e3688fe18911dd1c4d4358d9909e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781116628, "uuid": "c86196c3-73b0-4e93-a3d7-6cd4987dc7f6", "value": "T111D623F959E152B4D4C24A00B18FC3AAB4C1655D42FC1D193EC36D81272ACAF5A4EFBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781116628, "uuid": "88df4c4b-e2b1-49f9-9843-31d4ce38ce08", "value": "f4bfb846ac560712a0d781a49871311d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781116628, "uuid": "b82a32d8-5409-4b8d-b416-09c15ddebef1", "value": "196608:9StUNwSTg4lbDDyTun5xn62+6QNcAkVKNuFtldrEVrWJp349CJ9o1ODjk0:9StOwl4lbnDzgcpmuFtlxEVSL3/TJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781116628, "uuid": "cdda9fd1-1418-4d34-9c22-66e3b0bc9904", "value": 12721992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781116628, "uuid": "a2a73d48-7c8c-4c59-876f-4ba39467c107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781116628, "uuid": "27249d35-3c67-4ba8-a096-4a4506cab996", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db93c768-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105663, "uuid": "91cc9b94-f211-4e3f-b4a0-a635f1fd99cb", "comment": "Malware payload (Mirai)", "value": "e7bf2a0c191339e21a41c87481ee436a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105663, "uuid": "fb9f13f6-591d-43a8-bff1-640f27dc095d", "comment": "Malware payload (Mirai)", "value": "4a2e49e76e058ba9810f8e96b1b3f4fe35303f9a06ad560ca67601bcf9734c20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105663, "uuid": "278357eb-c728-4933-96a6-f3b76e0149c1", "comment": "Malware payload (Mirai)", "value": "16971525db46cdac185559017b62e77ee89c41eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105663, "uuid": "7fc61056-0939-4906-825e-0e5d005753fc", "comment": "Malware payload (Mirai)", "value": "4dce53dd3efbac37dc001751178f0ca4624979ec66f1418bdd5bbb7d6d8cdbfedd32a01da112e1ba0ea0ee1339807887", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105663, "uuid": "e9aa098b-3c61-4b73-956f-7fa3a30d755e", "value": "T10B732A26B97A1E26C0D4B57E60FB8B11F6E1278E26B4C50A7D720E5EEF147006502BF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105663, "uuid": "8fd112d1-ea76-44f2-8759-fe56653fddec", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXzSKV6v3G78nN9WQ:927jqCD8v3GI/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105663, "uuid": "f94220fe-54ed-49da-8b2e-517e488e9b24", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105663, "uuid": "e4dc0162-6706-4b81-85c2-302cfe26c457", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105663, "uuid": "fc674d48-42ff-4a59-aea5-0f1503161347", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d071a0-64b7-11f1-a769-42010a9c0008", "comment": "Malware payload (LokiRAT)", "timestamp": 1781087501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087501, "uuid": "bd7ddd47-a721-4e62-9c4b-b8d0249a7078", "comment": "Malware payload (LokiRAT)", "value": "52b69b1821427488f1ca31b8fae73b6d", "object_relation": "md5", "Tag": [ { "name": "LokiRAT", "colour": "#17B4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087501, "uuid": "de6b4573-07e5-4d7c-9cf7-b78b06dbbc72", "comment": "Malware payload (LokiRAT)", "value": "4a4c286c2ee27df4c0ca597b2568986689f8fb5d0b325fdc2cf45af560b80c97", "object_relation": "sha256", "Tag": [ { "name": "LokiRAT", "colour": "#17B4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087501, "uuid": "07adb26a-8709-4127-971c-e1b157636b38", "comment": "Malware payload (LokiRAT)", "value": "e58a30b752dfc606cde915f857de4f641ef842c6", "object_relation": "sha1", "Tag": [ { "name": "LokiRAT", "colour": "#17B4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087501, "uuid": "0d2aac1d-ebcc-4ab5-91bb-32b712aa4ca0", "comment": "Malware payload (LokiRAT)", "value": "f9c30424bad496d7fb7f684fcde900d2927ab9a6b89b285635ae0cf663376079ee4309c6af99278ed07d27253e7723f4", "object_relation": "sha3-384", "Tag": [ { "name": "LokiRAT", "colour": "#17B4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087501, "uuid": "fb2f08ec-251a-4dac-834f-34311e975ebc", "value": "T19EB22A4ABBDC8606C0BE4BBCE8A243880B76B3515831DB4E0DFC506EB935B80D741B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087501, "uuid": "b8c02eb4-8006-40e2-9593-ece27267fdc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087501, "uuid": "dbeeef68-a8b5-4dfc-8c68-a02a1bf5d5aa", "value": "384:pp4sKugk7LYbS4pB/aIIQMbLAARK23eXp+5ns+o9fMKAD+acyQNuXzKrsomOBsjN:QDS4hS3eXww254ohWMTYdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781087501, "uuid": "b7d6aada-2d7e-4e59-a00c-9f0a218ad30d", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781087501, "uuid": "a22f8d62-aac3-4e89-a8b0-20c1c23d11fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087501, "uuid": "2496dd66-fc3e-45d5-b811-f42bd91a99aa", "value": "citrum.io_4968624d_k_unikey.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e7a7d5-64c5-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1781093438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781093438, "uuid": "c82251b4-8f9b-46e5-b665-995bd51369af", "comment": "Malware payload (Phorpiex)", "value": "dba7640d842dc671c37007a8ed1140e5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781093438, "uuid": "8c82c463-39e4-4060-bc06-3d0ba875f817", "comment": "Malware payload (Phorpiex)", "value": "4ac2e42630f8f7d7c0a8303f9581ee82ef041016d394db22fd9def53c9ec8276", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781093438, "uuid": "4037d986-1992-4fcc-8381-ff8ac99e167e", "comment": "Malware payload (Phorpiex)", "value": "d67d1f76e30505a0c61731926a86ae1e3bc49b8a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781093438, "uuid": "23cfecd9-4ec2-4c39-a854-0acad4cc1f8f", "comment": "Malware payload (Phorpiex)", "value": "32653ff073f40ef940e5e21e2e6cfc6e5514f27d5e990a971a697c969af732c23067df8f3c2cca539d98d25f9ae00501", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781093438, "uuid": "c005af9b-d338-4d83-955c-e23e95ac45bc", "value": "T155824B0FB8424726C1E100B09636967BDA79A87137C408DBF7D48ADE1AAC6D5FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781093438, "uuid": "3074992c-6e88-4fcd-b209-f51cc160b722", "value": "31944fc5dd8a4e2a3b0515f33255f586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781093438, "uuid": "f76f97e8-3c12-4d4c-be8e-e2618e29f6cf", "value": "192:DKaqCngTtXWQQzbytjt0CzSETzl/le6f2vKUSvu9zw+ghSpOgbO5qmEd/FN2GJxJ:N0W/ytwEN/0Gu9JgwHcoav8U9cN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781093438, "uuid": "f168a9a8-709c-4313-80fd-41472c2be5bd", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781093438, "uuid": "9743c0de-00fa-4c9f-ae9e-48ce9d2aab2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781093438, "uuid": "1e2074fa-4fc2-49fd-a4d7-5cd0ab7c31da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14ddddd0-64a5-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781079560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079560, "uuid": "df62fd40-fd18-4c91-9dee-508647522c50", "comment": "Malware payload (Formbook)", "value": "eab392bf6e908ec530d8312c07000640", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079560, "uuid": "0195d129-aa86-4918-b561-a43fb330ae71", "comment": "Malware payload (Formbook)", "value": "4aedf4dd44e8a50d210c9e8983666ea213cc3883be38a6f7b171842993e098d8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079560, "uuid": "c39910ea-8249-40e2-b3ee-6c8fc98044cc", "comment": "Malware payload (Formbook)", "value": "2f5734f1d50eb85fcaccd744c8fd507ddcd38bb2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079560, "uuid": "18ba81a2-0dff-4819-9c18-66dccac0aa9f", "comment": "Malware payload (Formbook)", "value": "70f877c969861fdfb3c8c35351602174127794dcf30e3d3b3f8dda302d004deac0e2bd77909a0a7cd48c451dd9bc8d30", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079560, "uuid": "ad36eb76-c32d-4d4b-a4e5-6255119673b5", "value": "T13B9251C93AC6F8128613E43B3D2BB9AAF16E5CC0774C8054F619786CFCA4745C5F6A68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079560, "uuid": "7792ce35-0e3d-42de-9309-fd20e45d6cba", "value": "384:V6tVhpNnlxvU02hWGHV0FZBMuCYHYtT3m1OpzVt3R7zYETnZf:V6tVhpdbMZt1+AuX4rmEpzd7z/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079560, "uuid": "ad7a5bb5-f2aa-47de-ae39-eeda5e731416", "value": 21116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079560, "uuid": "09459c33-f64f-4049-a793-92d5fd0cc02c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079560, "uuid": "a9d2a556-f63f-4f3e-90d8-56373c87e8b8", "value": "SMITH Parts needed STM-MICRON.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b71c5417-64d5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781100448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100448, "uuid": "7f2cc92b-3d05-4d4e-8dad-6d76c06895dc", "comment": "Malware payload (Mirai)", "value": "0e2bb5807ed369ce97d16c0b9afd14f7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100448, "uuid": "e6f3dd0d-7fcf-448b-91f4-073da7f8b7d7", "comment": "Malware payload (Mirai)", "value": "4b19c630f18b8d732b2517954f681671f75990f6e525b6cfbb57ab5016893b5d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100448, "uuid": "9188ddac-2a75-4bbd-a0e0-ff0ca3af3b83", "comment": "Malware payload (Mirai)", "value": "513465d26cd1ffc483ef81b1d9a4642d7748eddb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100448, "uuid": "819e6704-2ca1-4049-9f24-03026a205b1d", "comment": "Malware payload (Mirai)", "value": "2f640a04807821b76ea2107641035a5c1dc9a61071107825edc93ca889579774b169d359835823e7516121bf3866886e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100448, "uuid": "70cd2550-a15b-435c-8c53-7325f081bc78", "value": "T1373108AB0F293AAE5514DAB937611848D474E6DB204FD3A4FF484CBBB1C9108325AB1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100448, "uuid": "05206a53-3481-42c5-9134-22d228024194", "value": "12:5TrJmEt7Yurqb+b+GUNirUNyiZHrZO8uvhrX7Mr8aV9rVnDOZLSrZLAcexreupha:D8SSrvBNyvhTMDqiMjkup7AT+OL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781100448, "uuid": "6068babd-3915-4113-b52b-04557f736a68", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781100448, "uuid": "23737741-a050-4c2c-916d-301e2fb88334", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100448, "uuid": "a8c97618-0a2d-4cf5-ad34-4d9f4378636d", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc43f29-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781108757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108757, "uuid": "20501dca-1810-411e-8160-51fbee6189f6", "comment": "Malware payload", "value": "a7151c1771277e6b4d396c8e5fc292d1", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108757, "uuid": "26f8e40c-771e-4f31-b635-7ef224971180", "comment": "Malware payload", "value": "4b3ee5c2e9f807abfef1e861911852fe6dd862bb9f8ac5b4dc70e991e895e680", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108757, "uuid": "e2f1baaa-b224-4038-9f2a-46f62e506770", "comment": "Malware payload", "value": "f54ffc0935784d6ca7a27ee995b1465981b08532", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108757, "uuid": "cd218530-6a27-4fb2-91ff-9c706f5b7dd3", "comment": "Malware payload", "value": "6bdfecb4ca843db66ca84417bbae4dbf419a2a3a546663d74dba14eb15fedd6ffeb0cc686da7fc948b7bc1a0dabd2b46", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108757, "uuid": "022e8758-a8e4-48ce-b12c-225dc8e74570", "value": "T1CDB427F4B8E4C50BD36FD231E64334867A8DA2C111459997A5CE5AABE3F200DC4E77B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108757, "uuid": "1d2b7457-1443-40de-9b2e-5221b4bc8bb6", "value": "12288:s9TGnIYOnYJWmpGUSTf4NNHGNLvADSo+51/c7niqT4iEeSN:sWWmpGU1NNm+DSo+n/c7niqT4iG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108757, "uuid": "a3319b64-8e0e-4a3c-942d-d374cacb20eb", "value": 506615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108757, "uuid": "e4ccaf66-d08b-41f7-b75e-bee156e3f2a1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108757, "uuid": "5469f962-bae0-4d4a-a030-f95554649c9b", "value": "setup.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b7d4f7-64e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105835, "uuid": "db8ee470-2053-4359-bb44-5f258bba382d", "comment": "Malware payload (Mirai)", "value": "79e3ee1aaeebfdcc0f8783698eba2fb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105835, "uuid": "d6cbf91f-5e53-4527-a7a6-205113b9b64a", "comment": "Malware payload (Mirai)", "value": "4baaab9a40a56e78c4de027a6d108f85501c4dd1fef1801df91a04abed7c39aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105835, "uuid": "79459a22-3e95-4bc5-b843-c18aab06457a", "comment": "Malware payload (Mirai)", "value": "fdbe57f65953e566b93180af0c283638079db38e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105835, "uuid": "e9869616-5556-4d05-befd-d0e70e1bb5c0", "comment": "Malware payload (Mirai)", "value": "33d83706949792309115947f08d97aab96336915acaef62567a06c17d1fa295bd297f39b369ed35fc8abb21b28935a72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105835, "uuid": "729e6f37-64f3-4cb2-b993-6ec6b6654481", "value": "T13D156C5EFE4F7D47D2D6F239DF8AC2A47127B099D223106331C1020DE6CA99DCBA2959", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105835, "uuid": "d0eb12e9-4167-4f59-803a-7fe5f0c7cfda", "value": "12288:/4Dn8JMIV6dl5GITMw6rkWcggFrGmY+a5CwUvlE1O3pJXfiF/t5:/C8JMISRgPgBwQX3XfiF/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105835, "uuid": "b13603c8-a3e3-4522-a4d6-7b941bf83a6d", "value": 947368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105835, "uuid": "cf2cf197-6306-4248-bd6b-29000f492d4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105835, "uuid": "78f5ab57-04eb-4f97-a4da-a4fc03694bfe", "value": "bot.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c23283fd-6491-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781071261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071261, "uuid": "05f17648-bea3-4203-9deb-170f61dbb1d0", "comment": "Malware payload (Vidar)", "value": "fb6aa22c3434387290bbaca6104738b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071261, "uuid": "1ca112d2-c8fe-4fc5-aadf-79acfe8faf37", "comment": "Malware payload (Vidar)", "value": "4bc0c699a5b5a0348495dcd3e57b4529c1edc5f515d727ad20cb6bef8c6a4076", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071261, "uuid": "9bd62334-3bd9-4443-bac0-d37c2eec5818", "comment": "Malware payload (Vidar)", "value": "fb0b9169b81cd5c56cda676eb20279e34f3bea67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071261, "uuid": "7456e5be-0c0e-427a-a222-9febcc2de70f", "comment": "Malware payload (Vidar)", "value": "9d5ea46e482c8f931516478ca8125bce164ef79bd0ad59d69870e6e14569a4322ab0fb27ebcea6b0bb7b3404a3334438", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071261, "uuid": "a98cc82b-fec6-4e4b-8bf8-cacc95e3cf24", "value": "T16232288673EAD0BEC5EEC534A56F06729E12348917661EBF63A448C03FC3161767EE80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071261, "uuid": "5ba19465-efba-4880-9331-c761b2a81329", "value": "17a4bd9c95f2898add97f309fc6f9bcd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071261, "uuid": "0a9726ca-13fe-4adf-ac16-5d1f90d0e07a", "value": "192:lgRjCQ7vA56jo3vtQTb62omk+XFZqe0WoIlKDHWRgR:Y9vA56iVn+3XvqvUKDWR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781071261, "uuid": "24fa2c71-8cc1-4cb0-89f1-7f6f10bc6eb0", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781071261, "uuid": "8e20bb03-0c58-4ef8-a3d9-d647e497e9fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071261, "uuid": "ae4cf38b-07f6-4cb0-9c3e-36ddfacc0ba3", "value": "install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c724e5-64e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105900, "uuid": "f28f9451-82b4-4205-85c5-03d1c0efad36", "comment": "Malware payload (Mirai)", "value": "3d896fb128bb4349bf36cc877a636b80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105900, "uuid": "9421f4c2-f0db-45dc-85b0-7c577ca9d837", "comment": "Malware payload (Mirai)", "value": "4c50709334b27bca4ffd175c0d0307980308ebc16263c493ec358c43c1c51842", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105900, "uuid": "a009a02f-9de2-46a1-9a0e-3575213dc157", "comment": "Malware payload (Mirai)", "value": "97c95cd22d3290896a1ee7249ba60534f0f6344b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105900, "uuid": "68f22fac-94bf-4d28-87c4-e91b1c2c8c1f", "comment": "Malware payload (Mirai)", "value": "ccdb468f07574f5a120c846d04ea041caeb64fb7e38f2dda240e55a04539b6966aacf0affe10ff1524e3c6ada098f8f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105900, "uuid": "8b13fde8-b678-46b9-88f5-a84c58459097", "value": "T11D53F891B8426A3AC2D1577BEDAF548E3314A7D8D1DB3213CD240BA07B8694F1C97F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105900, "uuid": "93c67748-82b6-435e-bbe2-21a1dca02bf0", "value": "1536:dn385gSW19bj2h1XBfpu2ac/ISxMSvhWy5pXS:dn3QxJpRISxMKf5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105900, "uuid": "36bf3e7b-f0bc-43f4-af11-76c476607904", "value": 61696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105900, "uuid": "361d6f48-de4d-4aeb-b18b-cd7b13c8e88d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105900, "uuid": "d99bfdfc-0ebb-4b50-b72b-4f60d07ad88a", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e50c267c-64eb-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1781109974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109974, "uuid": "d7add3bf-339f-4b3c-af3a-2769a2874e27", "comment": "Malware payload (ACRStealer)", "value": "d6bd9971e50491050f0a8269eb4143ec", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109974, "uuid": "b4f4210b-2e89-413e-81f5-871906c86dac", "comment": "Malware payload (ACRStealer)", "value": "4c510755f504064b9aa13ab6b61122b0dcd3435fb3253ce6854cef90b2b24cf8", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109974, "uuid": "26eff8cd-828e-4b64-80be-d106ae94df6f", "comment": "Malware payload (ACRStealer)", "value": "305e1872fd6ad280d6e6dc13bafc0af706790e1b", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109974, "uuid": "836ddb5d-f042-4bca-8d43-11568c27ca43", "comment": "Malware payload (ACRStealer)", "value": "6ff041bc1e4084c4ff70029e1b30b8a04644c125244bb439e607227a1aec9d27005403992aee1f41a478f512596487bf", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109974, "uuid": "4e65e720-25a5-4c38-b882-3098113689fe", "value": "T12C86F14BFCA109F6C4AAA2318976A1527B21BC451F3123D72FA0B7782F72BE09D75714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109974, "uuid": "31bedc42-f773-4d8b-90b3-176dddd1e326", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109974, "uuid": "cc42fff4-8d24-45b5-a6c2-48c4dcaf5731", "value": "196608:5Rq0Y252tzw3K/a+3c4lAuCNZ+N7dsSLC:5RqNrJKxmnr+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781109974, "uuid": "f8da2081-02c4-4d88-8fba-43e5ae9d85b0", "value": 8180072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781109974, "uuid": "391d9e53-032c-477f-910e-98bf52bfc9f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109974, "uuid": "55cfcec4-027b-4d21-9ef8-20aa9b9c81fe", "value": "Launch\u0435r.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c5aa09-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105645, "uuid": "b99b6371-56c0-46bc-b986-502679d6276e", "comment": "Malware payload (Mirai)", "value": "cdb9033c11151bbe23ed2651caabfac2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105645, "uuid": "d4e97ad9-3c20-4531-b7b6-c9d94569b461", "comment": "Malware payload (Mirai)", "value": "4db21c5c66b238ac5eab5c13dd61efc21ca9fd0b78bd9bef6a89fe25871ff577", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105645, "uuid": "661d1820-c50e-4138-84af-62aef272bff4", "comment": "Malware payload (Mirai)", "value": "0de52353d3a2b8625eca81656bbb5fd7530f8f9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105645, "uuid": "62dd1e06-8db7-4d8e-85d6-09f4dcb73202", "comment": "Malware payload (Mirai)", "value": "49747e36c8d0207aad4ecf9e35208f6d14e3a4c5419d36537d6ea8966d2ad2c23dd82a815aa67b295e53c164ec46a585", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105645, "uuid": "3c04bf9c-e768-4815-9753-32219a7b2c3f", "value": "T1E883AD32EA292D44C0455570B0B98F395B73A5C083476FB66AFAC6785047DACF90AFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105645, "uuid": "5c29789b-8c16-43df-98ee-de884e8f1153", "value": "1536:UenMpsd6H316K/1hoNJXa+GlbDKu4JlvqjwKqad+WC7c:UeAsdukuhoNJVwbmuUqjLjwWic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105645, "uuid": "2b3471b5-a6b6-47a0-b85c-c8c94bb52ecc", "value": 83532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105645, "uuid": "102e96e2-5b1a-495c-bc33-1d1025ec7d9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105645, "uuid": "b660f0c9-8386-4d32-a56f-97d5098d7912", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b65a98-64e8-11f1-a769-42010a9c0008", "comment": "Malware payload (KongTuke)", "timestamp": 1781108705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108705, "uuid": "6d760341-935f-4228-ad2b-f3b59b1e5b78", "comment": "Malware payload (KongTuke)", "value": "5421c973181ea980a1e0d4b2eb793def", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108705, "uuid": "a9cd71ce-8848-436e-a068-b9bc37d85bc1", "comment": "Malware payload (KongTuke)", "value": "4dd1f15776d78f82f2ee8dcf661e6d2431d9140e1b5b89b699e06d1e11712cdc", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108705, "uuid": "eeb0e059-dabc-49a2-b067-d57f4251fa30", "comment": "Malware payload (KongTuke)", "value": "9128bbec462e5d62a0fa7922d64cb246c27dc496", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108705, "uuid": "8a31e977-f721-499e-9aab-ab7168731661", "comment": "Malware payload (KongTuke)", "value": "af91d2757655422d374d80127b5e196a77d44cdcdc531c2e789863e88737ba31ca36fcdd51a758cbeb092a268d1681a6", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108705, "uuid": "0704687e-cec8-430e-bc68-ec8e5b35010a", "value": "T1F5C17E287E3126FB785194A6BBD76716F2E051732024E488331C64D86F4DB29FBC2277", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108705, "uuid": "463d8e75-73e8-4b8e-ad58-b62cddd6bd6b", "value": "96:u6Q80JHx/g5Xq7VV900XmqN5kO3i7jTOQ4dR/6D6oDFFTsRktQsvstroc/yqknkQ:uzEXq/6+mC5l3i7j/VDPDLzQsvst8c/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108705, "uuid": "90a32783-22fa-4947-aeef-465cef371dd6", "value": 6140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108705, "uuid": "a8b6fe95-2121-4399-ac4f-706958f6aa10", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108705, "uuid": "fda23fc8-79c0-4aef-b209-160cfb3e4a25", "value": "script.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bdc32cc-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781108885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108885, "uuid": "0e82192a-3936-429b-b85a-618c91346999", "comment": "Malware payload (RemcosRAT)", "value": "7b859b2d3faef05693b17987ba4f32bb", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108885, "uuid": "4a19c02f-bce2-40ff-ad3c-d76f28c428d0", "comment": "Malware payload (RemcosRAT)", "value": "4df9ade8a5acaa721c0228465c9a1f53640594854a5dc68d18e0c42e98abd455", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108885, "uuid": "6239ee3d-ff56-4036-a4af-eec3b4a066b7", "comment": "Malware payload (RemcosRAT)", "value": "4a7b025a71b86585444d42ce283cda6af3768ac8", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108885, "uuid": "1abc0951-2745-44d4-ab3c-0dbc83f5e92c", "comment": "Malware payload (RemcosRAT)", "value": "bb41611c314f38cec6c70d57bbf00dc9f6bb290f0ce4f856763e7b242dac6bfd8434ec47ad674557b5676331cc120ee1", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108885, "uuid": "df4a4925-7c00-4949-8e75-e98898a21be6", "value": "T12FE6C423E57B4046F19A9C13401BB1FBB4633569A8D4ED899AB0079619FF7A06F1BF03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108885, "uuid": "a62bc904-b07e-4c50-be3e-69e47e1a1647", "value": "768:tdI/TbGugkes9MPfLlOE6kU8smVBkhVrgPFuBFyGVXJaWdBPvcb89gkoraa7WKpq:+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108885, "uuid": "958039f3-195f-4125-b683-b7e51326eeb2", "value": 14756214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108885, "uuid": "2675b44c-2fb3-46fc-8549-ddb2f8570651", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108885, "uuid": "80196a2c-f596-416c-a7d0-fd732097449b", "value": "task.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aad7019-64a5-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1781079651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079651, "uuid": "dbf772aa-717f-4fa1-a52e-d44fa5dc007d", "comment": "Malware payload (PhantomStealer)", "value": "c9e2d49f7599b4596f0f7abb211a24ea", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079651, "uuid": "91e54db1-3f5d-4904-b431-8c9aed484d1d", "comment": "Malware payload (PhantomStealer)", "value": "4e4b07ea66c8d238da3398a2a81281a27737e3cb82bcaf48195a9e6d423e050d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079651, "uuid": "62bc0a19-6954-4273-b6b1-cb8c4fa14055", "comment": "Malware payload (PhantomStealer)", "value": "b4e6835ef499cf0623250ae0caf3ce6262e77807", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079651, "uuid": "e74838d0-aaa2-49c5-9829-14b4349c6c37", "comment": "Malware payload (PhantomStealer)", "value": "adf363098a893c6bb3c3f52947ebd66a0c7d8192528d4aa06477b1c853dc6f1b66db5dc53850e6f9edc7c13cb2e23d79", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079651, "uuid": "74e9f39b-3253-48bc-a34b-f1ecb4c47f15", "value": "T15175B8F9EBAD02452B113625AE1EE443BC9E999709123BDD3F2DC5F259CAD849031C3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079651, "uuid": "281a0e91-da2e-491e-bae8-7498b2ef5500", "value": "192:BpWpWpWpWpWpWpWpWpWpWpWpWpWpWpWpWpWpWpWpWpWpWpWpWpWpWpWpWpWpWpW6:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079651, "uuid": "abd95d67-cfbf-4f07-bd12-d87d517de7bc", "value": 1663568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079651, "uuid": "98b3411e-be43-44dd-82d2-a2ee0faf9c82", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079651, "uuid": "d2fa0867-39c9-4ca7-b45f-901a5e104dd9", "value": "100325.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad8f052-6491-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781071222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071222, "uuid": "55a70cf6-662b-43d2-bf20-a7b9bcca7979", "comment": "Malware payload (RemcosRAT)", "value": "fcecfc7fbe54b0447eebfde26b02f129", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071222, "uuid": "d4bd3724-59a3-4fee-88e3-dc287442e7a6", "comment": "Malware payload (RemcosRAT)", "value": "4e80c1bf29d7414c91e6527898c0366e5ebdf08f0fca6cc5f582e2cbaf80ebfe", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071222, "uuid": "85239fa4-9aa5-4d46-8b3e-e1700e14c46a", "comment": "Malware payload (RemcosRAT)", "value": "edd75d4d06897d359645b80d8bd15cd93fe9f822", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071222, "uuid": "cd67298c-3127-4441-bcbb-7738463da6cf", "comment": "Malware payload (RemcosRAT)", "value": "23b2b4fedd6809674c04cbab8edb40a475a30f5c6299ac37782f62d749a4b237cf590216b1cca7c5f30aeb99bb89d84c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071222, "uuid": "cb31f779-932c-4a1c-82b7-56a35c6c24d7", "value": "T1C2450CA2DEB7DE3ECB798F314AE68205A7745C52C331CB07A5853139BAD9E20BD450C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071222, "uuid": "249c94e7-8ce9-4392-9c50-1fa84689410c", "value": "12288:bDylH4wSoTA8EVZau7yLLw6OrB7mDylH4wSoTA8EVZau7yLLw6OrB7ud:S+wtEcIdB7F+wtEcIdB74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781071222, "uuid": "c918a343-e5ae-4439-bbd1-48caa86cbcb8", "value": 1178624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781071222, "uuid": "083957cb-406b-4837-ba0f-7417f2cb5f7c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071222, "uuid": "6e8b7acb-e80e-4ee6-8061-ec7910dde1a2", "value": "Order Q865-H20163 .xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ba6d76-64c2-11f1-a769-42010a9c0008", "comment": "Malware payload (LeetHozer)", "timestamp": 1781092124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781092124, "uuid": "f5ba10a2-c95e-44cc-9ad1-2b44800ea883", "comment": "Malware payload (LeetHozer)", "value": "50789429176605c541939e73a70e0c58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LeetHozer", "colour": "#A57159", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781092124, "uuid": "f42d9874-f2a5-4d57-be09-3ce17b85afb7", "comment": "Malware payload (LeetHozer)", "value": "4f37d61d2a689730c1a27a15bd6a3f4075d293a13b6b812ab2bc9c0c3b5691d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LeetHozer", "colour": "#A57159", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781092124, "uuid": "b53b674b-5a8c-441a-a7a2-28836a5e82fa", "comment": "Malware payload (LeetHozer)", "value": "6c728e5b1fac07ec580cc9cdb4d07a6cd4aa7884", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LeetHozer", "colour": "#A57159", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781092124, "uuid": "92aa15e6-1091-4463-8719-6cca04497ca9", "comment": "Malware payload (LeetHozer)", "value": "b033cdc35271e84df8dacfb2b5e363ba2b710dcf207a71306a74e5b2dbab36e8cbbc045f5c9df541a094133a5e5025fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LeetHozer", "colour": "#A57159", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781092124, "uuid": "a4ddf3ef-b52b-4f5c-a573-6e6d1a010f96", "value": "T14303F2D026556833F2764574BEB182967A77077C90FE353168204828EE4387773BD6DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781092124, "uuid": "2052c5fb-5fc7-4cdf-acdf-5b7fbff4886a", "value": "768:Cd5dOl0ryIckuICrLQG/eQ03wafVsH/22+PJs3Uoz7:CnG0rYIkmP1A/z7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781092124, "uuid": "aabfd0af-b24b-46eb-9218-3c5ef85331a0", "value": 39368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781092124, "uuid": "d5c4fa4f-3a0e-4d61-878f-4c47319dc742", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781092124, "uuid": "8e3b74e9-7357-4311-9b73-2fb9070857bc", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80fff5ae-64cc-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781096492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096492, "uuid": "9dfb3a13-10ba-45a1-ab0e-c33262ffbf38", "comment": "Malware payload (RemcosRAT)", "value": "bc8433e995f79be3c95045c349a21a29", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096492, "uuid": "c7d8ed98-589a-4881-9d43-22cf367a32db", "comment": "Malware payload (RemcosRAT)", "value": "4f8f5f80b9ef1d80aa7f7198a4164d97e7c502316d2d54f85a7663f5de793964", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096492, "uuid": "dd35f774-d3c8-41b6-8689-07db2cb6f000", "comment": "Malware payload (RemcosRAT)", "value": "7ed0104722a3fe2c75160d47738d6160271c9d16", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096492, "uuid": "ce4fe4e3-56d1-45cb-b946-14235ef37cc5", "comment": "Malware payload (RemcosRAT)", "value": "ebfebda049e795f5b67643ed042007a3fb1d73b4c759afc6e2e8577e9e1e036fade7164de7e6f91a7b25e0b75910df1a", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096492, "uuid": "5af51487-6e4b-4dce-8930-f9a7960af9e0", "value": "T1A951271017F80B18F2B72B79A8BA62614476BD15ED32D78E0128209E08F1A10D977F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096492, "uuid": "742a4c17-64ae-4b54-8bba-333bf8f4cc54", "value": "24:8Zb25vVDiAzWn+/CWXgOyuOX/V5yAWBpWAUMkWzAUkLYAUkLN:8ZK5RBsuuX/V5yAWBpWAH07z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096492, "uuid": "1c31c92f-2410-4c53-b5ba-7cdfe4e9cca4", "value": 2991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096492, "uuid": "397823e7-ffdd-47d3-af43-6d909f0414c5", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096492, "uuid": "3b13c440-2728-4223-8581-06ab8b27c08f", "value": "Payment confirmation.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "944099db-649f-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1781077197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077197, "uuid": "92469a14-0521-469e-b2b0-98553d6a05ef", "comment": "Malware payload (RemusStealer)", "value": "57ded3f726f41e685873dce701edbce2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077197, "uuid": "4a5cada3-be5e-4f7a-90d1-adcac1282581", "comment": "Malware payload (RemusStealer)", "value": "4fe508025770c53e0717b524175f079ee23443a4ed909a36be04ee7522e7e055", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077197, "uuid": "677ce80a-8f4a-4d9e-89a3-58c44dc05de5", "comment": "Malware payload (RemusStealer)", "value": "a68b2c91c66a1b74e5e66695f3ab18f812dca893", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077197, "uuid": "0a1b06ed-9886-4e25-a812-1e65e2437df7", "comment": "Malware payload (RemusStealer)", "value": "9e0b19f6c8b1c206b70eb1700ccf5fe83546ac3160d620f17ea251b95ab1d74905a001151de2d0bfa087a5da897c37ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077197, "uuid": "a1bbb8c5-eb1f-4c4f-a683-f61bc7c1c09d", "value": "T1B5452301C2D48036EC7D977048F74EDB4135BD12A9B5576A72C4B8963CA3A49EA3273F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077197, "uuid": "ce74af53-9946-4d42-bce8-bd696b54aeeb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077197, "uuid": "14f60380-a729-4810-a63c-fea913a9070b", "value": "24576:cBhUSx4QP3ZFb72XPwIA1gqf/F+fgXad8y5SquiVZaSIjP6q/oj9:cBhza4ZFb7anA1gyggXe8yAcaNmd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781077197, "uuid": "58688627-3e5f-42b4-a4a9-28ec204d34a4", "value": 1232896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781077197, "uuid": "26dd260c-4d22-4c59-a352-1a5d7c256ab8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077197, "uuid": "4e1ffda6-4542-4987-9f8e-c5c24418abbd", "value": "SecuriteInfo.com.Trojan.Inject6.60286.12148.12270", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42fee738-64a4-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781079208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079208, "uuid": "5e42cbf3-8d72-4541-8d72-1e63e9609c98", "comment": "Malware payload (AgentTesla)", "value": "f41a5de5492ca94f5d08fe4d538e7e6c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079208, "uuid": "264c0e12-d1d9-489b-9ad1-68c203206792", "comment": "Malware payload (AgentTesla)", "value": "505d336c0772ddb7cb73416ab3935727b179455506d37c181fe34acdab3a47ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079208, "uuid": "71381e39-413f-4c73-87e0-032f6b91c42c", "comment": "Malware payload (AgentTesla)", "value": "7412bc8f1ae02df74dbb9eefac5f203cdcfe11af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079208, "uuid": "6867886a-29df-4d0b-90cb-6a8c4d4386c6", "comment": "Malware payload (AgentTesla)", "value": "716c1dcaf2aba29ea3ff3275cca37e7c7ab2a142d056810743b99a462a85f6a084818d3517d87f3b035e6fb06314767c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079208, "uuid": "3cdc8ba9-eee9-432e-b418-c6dd2de5e2a1", "value": "T1A2D57B6D937C94028B2B7A7604646F25FBD7167A54E18FEEFF3938C23420A54864EC72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079208, "uuid": "29cbefca-edaa-4dce-9593-cd74c551c340", "value": "768:YQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQb:N+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079208, "uuid": "16859ded-d21e-4cf1-b317-2976a5c8ba78", "value": 2926411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079208, "uuid": "cdb9a753-f43c-481d-a73a-2dc1dd5a8289", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079208, "uuid": "e7d08b7c-78c1-4339-bfbb-4f6d48a62329", "value": "RFQ_ANNEXBID.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46cfbcc1-64a4-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1781079215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079215, "uuid": "03bb0c6d-f8b2-407e-b57a-8c1ade562830", "comment": "Malware payload (PhantomStealer)", "value": "442e532f7596182205d87b40546025a8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079215, "uuid": "45472013-eb20-4c9d-8616-13f203d29582", "comment": "Malware payload (PhantomStealer)", "value": "5060df36d2b6701839279f5ac009ecf132a4659afd568eafcfa3a215a2b734e8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079215, "uuid": "0292472e-7954-46c1-a070-2afb16e820ed", "comment": "Malware payload (PhantomStealer)", "value": "be35473278cbdff0136f18e81a03977a8b123691", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079215, "uuid": "a25e0104-e54d-4c67-9185-fb4de5e0f8f4", "comment": "Malware payload (PhantomStealer)", "value": "5e2dbd13a8cd95b7a6e824475d3ccdbfaee34c8a5b1eeca03b9e8f6b80967e9def224442681d7af1e4a6dce75c12796f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079215, "uuid": "27af824a-eba2-4433-b44b-fd0bb5a9aca4", "value": "T12D96423103548671F3545F9A26B9B528540E5DCA88F9EB013A5EC7B4227EC33A3BA7F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079215, "uuid": "a893fca6-9586-4ed7-acd1-e57e7060c9aa", "value": "196608:+Qyuatf5hNF3uidBkVMjbl6gIzqLW5GrAGZS6bmHGTEOvEuXbzXKAdnjPA8q9K:tfA5hNmVRSEOvEuXbzKAdnE8q0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079215, "uuid": "6cddde21-4d25-47ce-acb5-10e4bdb562e1", "value": 8993806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079215, "uuid": "f243cb26-49a4-46ad-941d-59a8606dd2a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079215, "uuid": "b75ab5fa-8b0f-445d-a278-5e048f538f61", "value": "SHT - ASICS LOSS ORDER.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0999c084-64d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781101016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101016, "uuid": "43c75b9e-ecb5-4e97-a3a7-334cdf5e0f77", "comment": "Malware payload (Mirai)", "value": "4f0b92d396c3b76bd50e7f2091959d4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101016, "uuid": "40cfa89b-0694-4e79-9378-a7cc11e85aae", "comment": "Malware payload (Mirai)", "value": "5070f40bfe7cdf30a4e75dd315fa3d1e8e205150dbc067251506a45e37d3ccd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101016, "uuid": "f6ca52cb-f4f5-4bff-bbb2-59b6710cad0f", "comment": "Malware payload (Mirai)", "value": "58e0f8a1aab5e28411a6c3b0981d25099ca25ded", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101016, "uuid": "d919c453-d86f-4a3e-9e66-79722c186ef4", "comment": "Malware payload (Mirai)", "value": "7538698cae9bc11c55a5912b3dd65b5b990d0cdffc4b867575bbd08d11e4097d3589274da5a05f2c35e434d3c082049a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101016, "uuid": "e514ee2d-b932-42f7-ac7e-f7a692dabda4", "value": "T1E5B3B80E6F315F7DFBE882349BB74A606359339223E2C685D1BDE6011E7024E641FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101016, "uuid": "636c9315-c352-4924-92b3-07ef6db88453", "value": "3072:4bRKQ8C7BoQxDIq+xrCljh+/RitkGwDUER0D:4VKQnvmq+xrCljhLGtUERo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781101016, "uuid": "b9dbb4dc-5f49-4b8e-b770-000a677feda5", "value": 114352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781101016, "uuid": "11f4375c-f3f0-4397-afbe-af2adf9a0b43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101016, "uuid": "1d2a7620-fc6d-487b-9eac-56c4c3ba1f39", "value": "uoicjoyug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11729575-64cc-11f1-a769-42010a9c0008", "comment": "Malware payload (DiscordTokenStealer)", "timestamp": 1781096305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096305, "uuid": "bada495d-c254-4914-ad8b-7a5e1699bf56", "comment": "Malware payload (DiscordTokenStealer)", "value": "cf9c0a18c8be5da999b26526872fa199", "object_relation": "md5", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096305, "uuid": "cde81bcd-cb8f-4d11-957c-fd3eef7dddfc", "comment": "Malware payload (DiscordTokenStealer)", "value": "509ca0ac662f7029588be141c6b62e8f8d64b994886213bbb656121bea3c33c3", "object_relation": "sha256", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096305, "uuid": "f575848e-25e7-4bd7-bfd0-716afc8b08d7", "comment": "Malware payload (DiscordTokenStealer)", "value": "6ac73812cd1e6cf28b0c8940a999cb00396b1147", "object_relation": "sha1", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096305, "uuid": "a6e53c5c-f33d-4141-9810-b39d13d1acd3", "comment": "Malware payload (DiscordTokenStealer)", "value": "d50ff327b80497e086e3f02295747d8fc604d27dd98630addcc48ca5c20a44a20b1acb15693e130796966d33ce236bcb", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096305, "uuid": "faa9342d-ca7e-4a72-854a-232ac5bb069e", "value": "T160952BCCC7E71CE128049B6A29D656F37B3989B781D5D83930DE188B086BCEBD14BE54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096305, "uuid": "9a5c600e-a911-4dd8-b75d-1c3d39e2adcc", "value": "24576:TUvk2Z9GMyQEKDSD8MC1aBHni6Xa2bT2askBn:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096305, "uuid": "c62d77da-e2f3-4889-bbdd-ecd63b4a789f", "value": 2059323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096305, "uuid": "dadfa1bc-27dd-4e78-90ea-0984d6e8dd53", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096305, "uuid": "8533dc4a-0ca5-44db-a796-fe8f1dea264d", "value": "dsrghlqj sdtdgrSjS_.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9231f927-6503-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781120143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781120143, "uuid": "d8182492-e0b1-400d-83fe-a9e2454352f1", "comment": "Malware payload (ConnectWise)", "value": "2a909e5ebfcd7e85d55277efad0c5cbc", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781120143, "uuid": "324571fd-0f09-46b8-b135-aaaae6e36265", "comment": "Malware payload (ConnectWise)", "value": "50e8972a7549150b341c678e3be364dbcc54c5cd93df0ea6028fdc4065d916f5", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781120143, "uuid": "c47b3653-c4c6-46b1-bae4-7690861674fa", "comment": "Malware payload (ConnectWise)", "value": "480e19fda1771b34bba24356c508eeb494c7aed8", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781120143, "uuid": "62de5737-c81c-4a78-b5dd-69e56492553b", "comment": "Malware payload (ConnectWise)", "value": "dfe38996b5076821dc88f4a83252588f46cdf8469d105459b8991573092fbea7744c44b681dba82f6d9f02bed7fde31f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781120143, "uuid": "99c0390d-1967-460a-95eb-dd5e77993db5", "value": "T15946E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781120143, "uuid": "82071ee1-81ff-46b0-b26a-f124cbe7dbc8", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781120143, "uuid": "3cb401bc-1aa0-45e1-a43a-0ddcab4c92de", "value": "98304:YzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:YhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781120143, "uuid": "67dd802e-f7d6-4660-8f5b-a2dc6c3e3fa8", "value": 5643056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781120143, "uuid": "3ec22b90-4b5d-4bc9-8ec3-488906c11980", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781120143, "uuid": "3b18ebf9-913d-484d-bebe-11b8a34981d0", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33c6d7d9-6474-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781058567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058567, "uuid": "0d80d2a9-bcee-4097-acba-dce485194c62", "comment": "Malware payload (Mirai)", "value": "2a89825e470e137f0ee2775dc56177e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058567, "uuid": "31f8082d-6bb4-44c5-b7c3-ec58d68a9b73", "comment": "Malware payload (Mirai)", "value": "51040d00c2b62a7d13ebf229b29297923e7527c6f7e998f58b93a52143929afb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058567, "uuid": "fda9d140-f2b9-403d-9d38-a437e227c92b", "comment": "Malware payload (Mirai)", "value": "aa73335ee622f7814c51229efbe3f212a7a75598", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058567, "uuid": "8256934b-7b4e-4891-a586-a2145a54a136", "comment": "Malware payload (Mirai)", "value": "4a300c4a99d0cd0d07f4155033baf7d5b9da09c34c135a21e95c3bbfbc8ba2752865b6b9c159a05d1e0a7da22b59c24a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058567, "uuid": "ffcd7856-626e-4ace-ab02-c09ab675bd2d", "value": "T11114F95A3710DF61D369D1300AF3C753A7E926922AD2894AF26DDE082F70759682FFD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058567, "uuid": "862f4755-2986-4c53-8d02-69a2582e007b", "value": "6144:L0nPxta3pVMvQo5pVOXDQ/s2McQY5uJ3sFhtKvv:L0nPxta3pVMvQ4OX+xQQhKvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781058567, "uuid": "535a8383-1f78-4675-b083-624c69939473", "value": 200444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781058567, "uuid": "f4c9da33-a5a3-4c17-a454-9467b60357bd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058567, "uuid": "89eb7a5e-ac6a-4402-b5a2-b4e6e623d52f", "value": "wife.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d56cb35-650a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781122980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781122980, "uuid": "e437582a-f8d1-40fa-8cda-3763aee79ae4", "comment": "Malware payload", "value": "917dcc2235a8b3d3c0f052e8c16bd7a2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781122980, "uuid": "ddec0911-be26-4cbf-8cc3-e1ff29e7771a", "comment": "Malware payload", "value": "523f31faceaf893dd4e00b04d351eb3ae93eca10bb1fdbaeceed91cdf4707afd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781122980, "uuid": "2d5e5dd2-693e-4658-82a5-840b3eb405eb", "comment": "Malware payload", "value": "f2967a5f56c490ab7e71c02fd9e4a014ade0d62f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781122980, "uuid": "4d32bd40-ea73-4c32-83fa-bf544d5ef285", "comment": "Malware payload", "value": "73846611ea99db624b06d3a4d96565f0517e92c86fbdd5ff690813286ea1d15d8bd0da6a9173f256040dbd574498fd5c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781122980, "uuid": "149958d2-981d-4ccd-9d07-61d2ce4a448c", "value": "T130136D6526953C25AE99883B5C7E2F0CBDA983E2304491DDBFCA3CF18C15A9CE718719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781122980, "uuid": "7a252985-def0-4d78-8a9b-a02254bca0ba", "value": "768:k4r9NyXsZztCY09GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bHusZr5co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781122980, "uuid": "d4a4dc22-dcf3-426a-b84d-d770fe67cbcc", "value": 45533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781122980, "uuid": "56b5df2e-cb17-4962-b2df-bf6705d1bce8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781122980, "uuid": "29e1582e-72e8-4f85-9dcf-0708c3641e77", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7dbab12-64b1-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1781084988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084988, "uuid": "b5cb5b1e-6da9-4556-8995-43cb392d9a51", "comment": "Malware payload (RustyStealer)", "value": "65b644e072543f4ceff682232423a6ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084988, "uuid": "7432102c-636e-4a71-80b7-0ac9bf4782c3", "comment": "Malware payload (RustyStealer)", "value": "5281fc111278e9df642790799efd801617affe9346b2a923df36769b051dbeec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084988, "uuid": "da676b1b-f7fd-4ff5-a8ab-4f01019d754d", "comment": "Malware payload (RustyStealer)", "value": "4aa6cee1d754dcce378df0baa21fd9bd49849f22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084988, "uuid": "31b5dda0-1ce7-41b5-ab4e-6eef80e15519", "comment": "Malware payload (RustyStealer)", "value": "43cd720ad5d6ec12203eacf6ff2c55f829b850c4db4d20b0532cce56415b0effa56328fa2f74cb4b90a2d06404e53664", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084988, "uuid": "277ebd13-cd8f-4ef0-b9d5-36d423df7cb3", "value": "T1CDD56C43E29580FDC46AC174875BA333FA32B8495631B69F6BA4DB213F22F605B0E754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084988, "uuid": "bb4f3861-106f-474c-9656-23f6c1e4032c", "value": "34ab7e2b8d1b85060e514c0fadc08f95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084988, "uuid": "5ae5a9b3-1c12-44cb-a677-2ca76d5d43a5", "value": "49152:g6ikUkZCt2TK72JAIbxiHEul5JYviEI2vb6XVz0rzXnIXq:7iuZEKs30r8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781084988, "uuid": "af4569c4-a40a-4a86-9b24-9382a6f79cff", "value": 2895872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781084988, "uuid": "9b88fa3a-56b9-490c-9643-6bc086c675ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084988, "uuid": "a739b8c1-4eac-4837-b92c-d1fa87fc458c", "value": "dia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5af5a81-64b6-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1781087185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087185, "uuid": "2e70f12d-4acc-4704-bdd7-8fd0f0f2b620", "comment": "Malware payload (AsyncRAT)", "value": "cfbe3f5554a7217cf4461e5b7bc9552a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087185, "uuid": "c3961432-2313-4b29-a8d9-b59d70195656", "comment": "Malware payload (AsyncRAT)", "value": "54202d955f19f8d721408471a906211833843624ecdca03ace14824c2b041d82", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087185, "uuid": "186bd528-32e6-4c15-bf2e-b085c38ee777", "comment": "Malware payload (AsyncRAT)", "value": "75f2d17b91a69454980d4709e0d6c9fd233c611d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087185, "uuid": "65dc24dc-fdad-4a46-83c2-8b1ffe530282", "comment": "Malware payload (AsyncRAT)", "value": "5b5508c26d8c47e86800129654507d38c8188ec81bbc5659bf4efe66a07ff222e08c709af82e7688690f5493ca069cb9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087185, "uuid": "a5bf1010-b210-4d74-9a35-b23bd2a7fa6d", "value": "T1CFD23A0873D98A52E2FD477D5833C604C376A5979D12DB6A6EC891DE2E237C8CE18BD0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087185, "uuid": "0fb57c8a-e2ab-4e5b-b393-c75f7d240b92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087185, "uuid": "3b23711a-c07b-4277-9c8f-9aec2f81b09a", "value": "384:oVQW3BTvLxXoryhysekgLlH9qbuUs0QxnCJfTBzFdnjJ4fUbe:mQUR9iyhysg5IbyBuBzFIOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781087185, "uuid": "c99aa576-bfd8-4389-9b63-7105261e6d75", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781087185, "uuid": "885bb5fd-46f9-40ce-bc36-fdd22577a5a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087185, "uuid": "35f36185-3c5c-40a3-ae0d-2e78bdfdfc0c", "value": "citrum.io_13876d9e_s_onedrive-update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a07529-6491-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781071215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071215, "uuid": "81860cca-8015-490d-84c4-1c69e869d5a1", "comment": "Malware payload", "value": "a11dbc497bd34d8f74f312b1ed265d3f", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071215, "uuid": "0a3e961f-8120-4f4e-93de-3bbaeb8fc163", "comment": "Malware payload", "value": "548db0eb069c8037672d24745b0d55d210303a3305537b14dab60c2a6f3853f6", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071215, "uuid": "9c0dd7f6-c020-4360-9d51-b8b152916d4f", "comment": "Malware payload", "value": "e08ea6453b24079256800c7cd2b1744e92b580a7", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071215, "uuid": "d4186ef6-ed99-4c2c-bba0-a8a4cf75bf5a", "comment": "Malware payload", "value": "618c3e4884d43c758c549916c9169563658c1562852dc9a5df1724909ec24daba301a658072f1404fbabf79d0bb524fa", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071215, "uuid": "0cdfcde4-c476-4e49-949e-bdbe09282006", "value": "T10165D03CA923B04FD71ACD379026284AB0062C63CDBD17059995EB696E8BF7E77746C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071215, "uuid": "e0b876f8-59e2-4a5a-8c11-9ebfdd3e1105", "value": "24576:3adDtV6d/6lPdtz3y2WZ12XGP4o6M7lDHC5rvfY2bqiSDFCGTVAzi:mPdtz3y2WZ12XGP96ElDHyrvfY2b6FCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781071215, "uuid": "27159d2a-8047-4110-acca-9b57b7677763", "value": 1495221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781071215, "uuid": "996b1648-86d6-4ffc-b01f-6c0819501d55", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071215, "uuid": "d849d02e-75c4-4561-a180-9fc0918414dd", "value": "SANKARAMMA INCOME TAX 2025-26.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e8e009-6505-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781121015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121015, "uuid": "07d923c5-ebde-414c-be5c-e8847f5be204", "comment": "Malware payload (Mirai)", "value": "c77f681077cf2dd82769fac7ebbf14fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121015, "uuid": "05129e6f-0075-4d57-8c35-a86605fa6db7", "comment": "Malware payload (Mirai)", "value": "55ca0172abebcaf52ee8b0563b81719c6e9d48780b1b58a8af609ed0803384b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121015, "uuid": "0e4605ed-0103-4b0e-96ee-92ee9be9e0ad", "comment": "Malware payload (Mirai)", "value": "0ab70b17fe1754c2220b0afb4ea6cc5b1e9d015f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121015, "uuid": "649d3d22-a99d-4075-b6ba-1ecb491e645f", "comment": "Malware payload (Mirai)", "value": "7365d44c13c7bc19cc0f02d2df0eaf480b064e9b171f98f78dc2591adaacba887eae098e4cfad7d17028efcefd4e65ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781121015, "uuid": "d1ce6fda-c49d-4788-8006-f9489944b6c9", "value": "T1A2F3F756B8819F16D5C152BAFF0E534A33131F78E2DE7203AD246B247B8B86F0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781121015, "uuid": "dcadc81f-8447-47e7-a912-5d27aa66b839", "value": "3072:/UWqhCJik6830sWB60T6uXWTNcXv7cIEsyqskgvcqaZ3P/Cr:8pKiZ830sW00T7XW+XDNEsmdvcqaxyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781121015, "uuid": "b876ba24-c6ce-4fa0-bfec-9b4477e5ce3b", "value": 160688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781121015, "uuid": "cdf2bcc0-beb5-4cf4-9612-5f795b97cb99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781121015, "uuid": "bacb7530-e1c0-4811-aec5-e5de5d813af1", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8ff3fc-6471-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781057400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057400, "uuid": "dfea7266-1cd4-4b97-854e-3d6a78502083", "comment": "Malware payload", "value": "bf9fabba6c97192235ce895b2e80d5dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057400, "uuid": "18f94829-ab1c-4625-9eac-a8f84a18d270", "comment": "Malware payload", "value": "55daa035e31771f97c38137f6c822665402065f754bae3ff1be2d4dd0d660bc0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057400, "uuid": "aaf16bdf-7f26-4f31-a3e3-4032216e5a6c", "comment": "Malware payload", "value": "baf780d1df0082b372dfc70e07c001324a328eee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057400, "uuid": "1db4fdcc-49aa-433a-8839-ab7643ddbf8d", "comment": "Malware payload", "value": "21361767527b1bc0b4dd633e1a53ac368afb484e888f0cca64b8666d63f3858d83b9bcf2c9c8f5ce88563ec52b058ca9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781057400, "uuid": "c2408230-d56e-439a-bd2f-03ae1c951f4a", "value": "T100E32A05B31D0983E2673EF03B3B27D1D3EF9A8131A8F640691FAA8991B2D325585DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781057400, "uuid": "caf267d7-6e67-40e8-bced-79a8bf390344", "value": "1536:he5DD3TecvEOE6V9ft+tFA1+cm1zrLxqlam4P0tvA4HXBPGuJBldqdF4+Gau0KpG:unlEd8YAkcm1LxLPF4PR/rq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781057400, "uuid": "a98266a6-fb0e-47ca-a70c-a4b164aa9263", "value": 144440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781057400, "uuid": "21589a30-65db-47d5-b25a-caf474101fcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781057400, "uuid": "8864949b-ff4d-4ef9-845c-8aebfd3d2ded", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0062ce2d-6495-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781072654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072654, "uuid": "f6022fa1-a60c-4d06-a355-0278594d5ba9", "comment": "Malware payload", "value": "f4d8da8c2eaa8128041ac9535ee471b8", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072654, "uuid": "d3d6b559-06b9-4394-8d19-ef6a935bc750", "comment": "Malware payload", "value": "5687f54dab2014990fb8aef3a4645ac3405471bdd380e016afd89e98024811e3", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072654, "uuid": "3ce01e34-8812-4089-a6fb-f915e1619e70", "comment": "Malware payload", "value": "bbf6dd7538b0fab7212520ea785357d1ee9ee357", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072654, "uuid": "64edea5c-5175-4d40-a312-a88ed432dc66", "comment": "Malware payload", "value": "b6a7b8b21645b61d4ddcdb206b6cb25663b7b3b7e1538653229fd107f31da05dd6cb09b5acc4c75615520df1671bf98c", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072654, "uuid": "287e8524-784f-4d6a-8ca6-07a8edc738b4", "value": "T1BA9533B25209102BE95758381579D427128092E3D6CBF8F1BEB87B6DAC2D691770F3CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072654, "uuid": "b5510097-d227-4aa7-86f8-62a2e3ec478f", "value": "24576:AHnSBJO1KasEag69idpaUpXCG4wRbsF32xL7NeCR+QKN2jtpa9DcZE5nJVdW3kZr:1tNk31RRbTZ7XHjtUDcGZAsr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072654, "uuid": "aad2b48e-0e02-4a02-b560-9fe7265f0911", "value": 1951316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072654, "uuid": "e8dbe756-93e7-400b-8bed-05f27e2eb555", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072654, "uuid": "a09de5b9-7ebb-4ace-892d-f40135425069", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2640fc50-64bd-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1781089897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781089897, "uuid": "de00ade9-528e-4dd1-98d3-c9b155e0ad6b", "comment": "Malware payload (MassLogger)", "value": "c682e38eb3d3cc288281744853dd5113", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781089897, "uuid": "f4a1e357-6666-455e-a875-356116d36d3d", "comment": "Malware payload (MassLogger)", "value": "56f14ce40e19fb067daf65a973dca1ca3c319834ced645613d72535db37882eb", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781089897, "uuid": "9b7c537e-a56c-415d-8533-184899a5b350", "comment": "Malware payload (MassLogger)", "value": "a88648795860d16f2919d5f3c1273951bf9c16be", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781089897, "uuid": "ed4f199a-e77d-4ae2-a3f8-10e5579038ac", "comment": "Malware payload (MassLogger)", "value": "acc58e78225872e43ed0ee7593fbe3a13e5ce759099b1e4c8b42683162273959244e4f59275fd81fdebb679fb702f35c", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781089897, "uuid": "001c760e-ced7-4b66-bf32-7d7249dcd99b", "value": "T17DE512ED529A7284CBC1635968EC618DE87104A737EF9B9E388B74CF4430F855428BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781089897, "uuid": "c7a29ce2-2b4c-4284-a55f-1abaaac827be", "value": "1536:z4Pd90XFnwPjcfrlljALZ69PjAjAiganIf8h8lZz3PVgzgQpubw+q:zg+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781089897, "uuid": "e08b937a-3f25-4d49-844d-a80840215e4c", "value": 3067262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781089897, "uuid": "5e00fc72-32d3-49ae-9503-28632c1d5f3b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781089897, "uuid": "decf28c1-fc37-44e9-aca4-73eb50598fa0", "value": "rckki98773.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe755db8-64ea-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1781109587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109587, "uuid": "4bafc5c0-343c-4c5d-ab54-2c3a3e77d576", "comment": "Malware payload (ACRStealer)", "value": "455287a1a747d194c87ecad393fa329a", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Evasion", "colour": "#ED2010", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109587, "uuid": "3d63ded6-2c7a-4840-8327-2a7ae5d821c0", "comment": "Malware payload (ACRStealer)", "value": "574a9dc8d3c70754407618fba81e49af5229a673a7dc9a194f11cd877af1683c", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Evasion", "colour": "#ED2010", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109587, "uuid": "48d26c0c-1086-4567-a795-bba1988bb7f2", "comment": "Malware payload (ACRStealer)", "value": "c140156bbd4d3807ee731f34e312975a7006d2ce", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Evasion", "colour": "#ED2010", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109587, "uuid": "0151f2eb-9b9c-4b18-b5e4-7f3db6480494", "comment": "Malware payload (ACRStealer)", "value": "2495cd7fedead0c7332227a66fdf0c6a9b0df5768854599b35b9bf5f03bd56d85069de1d264577db0c9010b1d450c23b", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Evasion", "colour": "#ED2010", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109587, "uuid": "529a567f-27d0-49c4-95cb-b58d021fda31", "value": "T1F9F55B07B8E004FDC099B33089A666567B757C440B3627E72F92BB782E72BE15D7A314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109587, "uuid": "a0fb1a1b-476d-428e-9972-7591972b4020", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109587, "uuid": "61b8cd17-85af-4402-b1db-498970ab70f9", "value": "49152:3CZP/LUVQGd/o0KDq7vqBrlB101uMgA82IWhuIOcQg:3s5plj01Yj2rb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781109587, "uuid": "472036ae-d29a-4055-998f-c63c38f6a742", "value": 3409800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781109587, "uuid": "441a00d5-aa8b-4f69-a3cd-69dd3022fa13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109587, "uuid": "9dd78cc9-c76e-4553-94e6-6ec1e48196b5", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c57fdac6-6471-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781057523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057523, "uuid": "baaef3d2-a868-4b13-93d2-ed03456cd6ce", "comment": "Malware payload", "value": "9bb36aa1abcbd3d434bd8c33dbea4206", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057523, "uuid": "3d5bad23-1dd6-4001-94a6-75383a02ba1e", "comment": "Malware payload", "value": "5781dba03c5f113bdff1963ea94c6729a678d3cded32deba65ee969b60e54a55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057523, "uuid": "e626f5da-960c-4822-8d73-80570ec02a2f", "comment": "Malware payload", "value": "0d69a8f91d0f7bf63d295e597a2928e582741852", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057523, "uuid": "11dfbd2e-02e3-441e-bce4-a12bd438506d", "comment": "Malware payload", "value": "44c0a672278df925560d6c74c68919a39ca1e711c931fed050fd111ab165e18ce2fe196624971d234900d8df3e9dbb9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781057523, "uuid": "374f8e6d-bde9-4105-ae4e-9d9f7d13421a", "value": "T1F5E318CBF900DDFAF84AE73644534806B130BB9258925A336227357EED3F1981577E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781057523, "uuid": "7aa970a6-ac63-4b7f-99b1-79e48641292c", "value": "3072:HJWUDKbUaIzZwXH3R78dVYjbiALjlag/C/WofoHlsy1aLaU:QtgwXh78qLjspQWy1KaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781057523, "uuid": "b7116636-318e-4f03-bd48-984ec138b19a", "value": 156460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781057523, "uuid": "130c8e6b-5baa-4ff3-938b-8a2f06fc395d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781057523, "uuid": "c7ca83ae-6b54-40ef-ba6e-541b512bc9a9", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93d6c4c-64b0-11f1-a769-42010a9c0008", "comment": "Malware payload (Adware.Generic)", "timestamp": 1781084534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084534, "uuid": "564dfa2b-fe8e-4540-8d70-f52cf3fe43a1", "comment": "Malware payload (Adware.Generic)", "value": "d29c98ac8c44d39a58dd9992cffde2c0", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084534, "uuid": "fc2ca0c3-0a43-45a1-b1d3-31ac697b95c8", "comment": "Malware payload (Adware.Generic)", "value": "5812d9b5f81198f5db8c33b0780a9b95eb377f89f75bef5083e396829dc9e308", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084534, "uuid": "70ba230d-6d5f-48dd-a71f-71a42ed83355", "comment": "Malware payload (Adware.Generic)", "value": "5083eea34e5ad97d9ac2d9cd0033c4d7ffd36047", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084534, "uuid": "8297af85-df31-4adc-b97b-428f3bc6a058", "comment": "Malware payload (Adware.Generic)", "value": "5b815ffbc03d599fd34f3e414272fe91ef18e1476d8dbd3a7a3259c4cbba062044734196e71eda6eeb6aae1c111d4fc9", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084534, "uuid": "b57d4585-efa1-4c70-9922-1f4052eb752f", "value": "T102C6232BA2D8653ED5AA3AF54572823056776E5EE50E8C1AD3F03B0FDF364201E3E605", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084534, "uuid": "91668a3b-5d23-4f3b-ae12-a83b5e40c9f4", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084534, "uuid": "e1025e78-53fa-4544-8f23-b1dac303771a", "value": "196608:vvchog7Ahgy7cKe/uo19TnywevWs8wguaomM+Fs+VDbuD9xIT:ng7ugy7xe/uSQF1Xm9FRfuD9x2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781084534, "uuid": "bd6c589e-a422-471c-9052-2a14a368e5ef", "value": 12556840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781084534, "uuid": "5de5cfd1-d6bf-413c-9205-86ed294880b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084534, "uuid": "f773436e-b32f-4b2f-a9a7-bf8de9005a03", "value": "SecuriteInfo.com.Program.Unwanted.5529.31730.5950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd02c17-64a6-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781080112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080112, "uuid": "6a7b8e4a-84db-4015-a3eb-c439ab1f6326", "comment": "Malware payload (RemcosRAT)", "value": "0c6cbc889fa4c7cdab9b27b2e52ca763", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080112, "uuid": "95a1164a-c729-48ec-899f-607ac5929b09", "comment": "Malware payload (RemcosRAT)", "value": "58c03576d08b5663ffe8fbb33c5de6d3a89e54e240175dfa76e3eec1e5cd0846", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080112, "uuid": "25187e08-9dd2-4772-860d-9ca23217157e", "comment": "Malware payload (RemcosRAT)", "value": "0b9c5521ae9e84ccd0c708e91bd32f59c13c2e44", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080112, "uuid": "2bda521f-1fa4-4b16-b718-db60f0fa355b", "comment": "Malware payload (RemcosRAT)", "value": "d27c15070b19f1dc5f101b73abc1ac43305dcfeb0bb04a946bc1192bd43b15114810293d9a3c7a4b7193ba05e5588b00", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080112, "uuid": "d5cf8d67-7aac-4889-875d-22fcdd22450d", "value": "T1A59230B19A9687A5BC8B677D8CE1360472749FB4407114E9FDE0B388B00D8747F36E9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080112, "uuid": "d31a3226-e57b-48e4-ab8d-cda394b664eb", "value": "192:8HQA3z1ticyb8p7lkhwrEt+etdaJB8CBuZcBvLkYtM/KC9ppIMNP20fknD6hOM9d:4VhLyb/RI2OuBYa/Nn72dK/aRIrViuNF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781080112, "uuid": "790cc432-f8d2-4210-a9e6-917e47d2083b", "value": 20933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781080112, "uuid": "adc55272-52eb-497f-899f-6029ddd0e407", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080112, "uuid": "bc60cbcd-f9ad-4623-84b0-570c80bccbde", "value": "Outstanding_Invoice.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "771415e7-64cc-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1781096475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096475, "uuid": "a010b986-490d-40a1-ae54-1092b3142197", "comment": "Malware payload (BlackMatter)", "value": "23a7bca9d9da3a49a18f8163cea1e1ef", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096475, "uuid": "4488803a-f527-4495-bb65-61f83e4d78c5", "comment": "Malware payload (BlackMatter)", "value": "58e4c1a9530ea6236fffb02ad3fb9dff7c4462e71942a64f564373e7930cb8b4", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096475, "uuid": "ac342eed-77fa-48fb-b0e4-7f887cd03794", "comment": "Malware payload (BlackMatter)", "value": "6b65b89f01f2f82a97bac17b85ec4ad5490b162f", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096475, "uuid": "eda21feb-feeb-47f8-8b54-229eb3328bba", "comment": "Malware payload (BlackMatter)", "value": "ab09fa7caf4724e06f595bc99e8950c750bbb6521c05909a058aa87843e335014caa672c6e5058a45bda9a59f851c3a8", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096475, "uuid": "7edf9898-f483-4a5b-8301-3f1a46f7ca3d", "value": "T187E36D21F212D0B3C87718F12736B571F39E8D2C15A96407EAE80F99BCA58232F55A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096475, "uuid": "55d1243d-7c77-4112-9e71-13afa98005db", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096475, "uuid": "9d5ea7c2-417b-4724-98b2-fdf8374688cb", "value": "3072:L6glyuxE4GsUPnliByocWep1i9nxHb58Or:L6gDBGpvEByocWePi9nxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096475, "uuid": "7f0d3a32-781f-4876-8492-60a9fdfc8879", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096475, "uuid": "79a22505-fe6c-47ef-a5ab-173403e9b0c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096475, "uuid": "a3a85cb3-f1a0-4f5d-846a-ad6f82342749", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f02103-64cc-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1781096505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096505, "uuid": "6b2bfc8f-e272-40b3-a028-0bd3f25f04b1", "comment": "Malware payload (BlackMatter)", "value": "45e79ddfffb9aaeb369a22cc20019165", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096505, "uuid": "b8372cbd-a5d8-4a4d-9dd8-f9dbdf839e40", "comment": "Malware payload (BlackMatter)", "value": "58e8419426fba3b971dd6eb448d6932a5b10247f3e1725e9e36469428abb138c", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096505, "uuid": "bc921d39-af3b-4239-b010-8972776c026f", "comment": "Malware payload (BlackMatter)", "value": "9538948c7911584b9c7bf6e8aedbe469f67d0b4f", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096505, "uuid": "b6b82e34-d61b-437f-9aec-3c15bc47d3e4", "comment": "Malware payload (BlackMatter)", "value": "4411d6b615aefbe237a9478933964ce353634ac25ce7a837c24ace91d549ce8cf30bf79e5bf2b196b6b51374f02342f2", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096505, "uuid": "9756ad75-00da-44c1-81ea-b6ae40c6a025", "value": "T10EE36D21F222D0B3C83718F13B267571B3DE8D6C2AA96807DAD80F9D7C648236F55697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096505, "uuid": "7af23011-f9a5-4ea1-94f1-3b3cb59d81e6", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096505, "uuid": "a65ce241-cb87-4385-9001-f7d4e2c0e253", "value": "3072:S6glyuxE4GsUPnliByocWepXHAo7s71S:S6gDBGpvEByocWehHA6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096505, "uuid": "e1b071cc-83e8-4034-9f1b-37e1c4ec519c", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096505, "uuid": "e852e51c-d51b-43b8-81b7-10122faa29dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096505, "uuid": "d132b9a4-3410-4f3d-bea4-0698c88138fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2fb4f0a-64b2-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1781085516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085516, "uuid": "28e57556-e96c-41b3-9e8a-378097f36895", "comment": "Malware payload (QuasarRAT)", "value": "7013e6692fbfc5fc110f47f71ad0fad8", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085516, "uuid": "235bf03c-b351-46f7-975a-02f13964e284", "comment": "Malware payload (QuasarRAT)", "value": "5903092322871269cb4c72fd4bc706a7d7c6a12c4422e92d7729cb082a6013f8", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085516, "uuid": "4c3fa33d-cc42-4fb2-8043-0c65772740b4", "comment": "Malware payload (QuasarRAT)", "value": "89ad2ecc2d245e1ce7071120cd61ed5fe7152b94", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085516, "uuid": "aabf3992-f508-453a-bcd0-c342dfb90faf", "comment": "Malware payload (QuasarRAT)", "value": "d31ba3102a3d4e50464ecd033506e59d9fe04b9762da8c41ca60d801bc989dd4eb38a3bcf44017e6923eaaec5c4589f5", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085516, "uuid": "a3373d2c-9069-4cb4-bedf-880c76746053", "value": "T1E6D34A1433EC8A16E6BF5BB9EC7801011372EA17E667EB4E5D8820EE19637D1D1817B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085516, "uuid": "a6419964-3bc4-4fa5-9eca-db50cb24808f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085516, "uuid": "b941e102-9e38-4d8c-9552-6f1db0a42c59", "value": "3072:vcQOYD7/cEYQ3vorJ+TULjzFzoh+BCfZpbhGPa6Z0fWTrJ:AYX/cTrJ+TULjzNyZpbhT01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781085516, "uuid": "6bd9867a-6b78-4c17-83f3-f6c05224afcf", "value": 139776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781085516, "uuid": "6c0e024a-55ee-41db-9019-1bbaeac8d645", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085516, "uuid": "5ddd2a8a-5097-406d-86f4-749e699b456b", "value": "2sn7bt.sa.com_548e4112_q_zoom-updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1226afb3-64e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105755, "uuid": "bc82454e-4c09-49b6-ae58-84544ed52963", "comment": "Malware payload (Mirai)", "value": "ca8e651483906d159650dea0c7971d0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105755, "uuid": "31d7547c-e3a5-4f95-9151-fd8b59b8c2c0", "comment": "Malware payload (Mirai)", "value": "594d5d71bd709fba01a0a528f4f7a5ef531e630ba35224599d6fade4afd8cfe9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105755, "uuid": "eed3c6ac-f24d-47f4-ac50-7930f2c09815", "comment": "Malware payload (Mirai)", "value": "9208c1f7bd334af86583eaed138b1d9584838903", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105755, "uuid": "171716e9-53ad-4f58-a2fc-1d21a3df991d", "comment": "Malware payload (Mirai)", "value": "aa97d1b2cf78a4e780d90251c9e5f7b7e58167ac37b3f056e4afce11be6eaaefa23d407f5b7b33d5b4f6adfde0e1bfa3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105755, "uuid": "b3b5674f-86af-4abf-9585-6a96d2d3bee8", "value": "T164730A81B9819B25C6D513BBF91F018E33165BE8E3DE73129D241F607BCA91B0D27E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105755, "uuid": "b63197b1-2945-411a-8379-b1c01be38fcf", "value": "1536:y0nC6qYfkiubZwoNCJYDQ7gppg6T6315yAMw1f9r/1eUc6I+i3JqwsjAgQ:CskiIZJNlDWQpg6TO4Xwtl/OJqwsjAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105755, "uuid": "4a6dad6d-f8f2-433b-8866-9414d7e6bef4", "value": 79760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105755, "uuid": "8d2443c0-8237-4b5c-828d-79774f1269ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105755, "uuid": "f3953105-0d0e-42eb-865b-9971b5335357", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dab5fca8-64a3-11f1-a769-42010a9c0008", "comment": "Malware payload (PhoenixStealer)", "timestamp": 1781079033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079033, "uuid": "8449dee9-1037-414b-888f-ed5312cc6bac", "comment": "Malware payload (PhoenixStealer)", "value": "a42b4442014071cd9353b5d54b45aaa1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079033, "uuid": "26931902-c1c6-4434-9f72-9a19d11c1275", "comment": "Malware payload (PhoenixStealer)", "value": "5a31b27b8a41ba3387f060f9ebe9353e1fbab6b23e6b8f9ba8fb364c3c8ed5ba", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079033, "uuid": "b0a9bf33-0689-4200-b9af-f88e1f9c1cbe", "comment": "Malware payload (PhoenixStealer)", "value": "a5d1997165f3abd1d589546570065e7d90fecda5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079033, "uuid": "5c7c7c1a-6588-4655-82c8-fde2c288015d", "comment": "Malware payload (PhoenixStealer)", "value": "8365520611fff3b18bc6862fb50363fee071c6fd6df6373b180a3a1ea999cfde9cb95469058fbe8c1282afa1a0469388", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079033, "uuid": "b543580e-3d70-4d02-ac93-66adb6550a3f", "value": "T12105D63DC958422ED272D728C59A095FFC922A0B563CD84B64CA370F9F639427BD236D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079033, "uuid": "700d0b1e-68d9-41c5-b910-86eb4bb05a99", "value": "3072:jmASN8RIvxWBY79x2g85bQ4r+zXA3q3Gr2tdHzWB55W0f3wMToVqSfnR7nWQEPWH:6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079033, "uuid": "e089d1ab-3666-4244-9dd7-27ee39594f73", "value": 807694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079033, "uuid": "3685824e-2982-4ffa-b318-23ef9551a7f1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079033, "uuid": "a17d69ee-ca1b-4608-9781-ab3bc313f483", "value": "Perfil de la empresa VCR-ORDER.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2845bce8-64b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781087753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087753, "uuid": "f7fc7774-fd75-4c84-b809-6e067d4712fa", "comment": "Malware payload", "value": "7ac9cd6ee88cd90fdb34a9711d0be143", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087753, "uuid": "7254c596-13e8-4717-a04a-a1c572ca71d7", "comment": "Malware payload", "value": "5a3953fc874c19e45eb8ae6479e1bca3214f8c3e828d38681b68ed4652a6fa83", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087753, "uuid": "1e64f2b4-10c5-4a94-8fb6-c3a5e5a10ad8", "comment": "Malware payload", "value": "7948b34bf03e71ac9a3191b89def3828f048f407", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087753, "uuid": "409fd401-bbb9-4b21-8872-37aeebc9aa90", "comment": "Malware payload", "value": "f724cf2c35a5627c89e9df4656189d174e33684d6d227c497c89ec3dc7cd98fa19e5c0edcbd78801a3e942012cfcc9f8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087753, "uuid": "487a2f29-3fa6-46fb-a3e2-870c7d0bb10a", "value": "T1ECA3B504736D9A97CABD81F44E325211DBF9545B3962DAC83CCE14CA4FF2B280769DA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087753, "uuid": "c4055f2b-2f57-46cc-847b-ced8cb939356", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087753, "uuid": "01b15e10-39ae-4b72-ada6-880376b20d53", "value": "3072:phAz/u3sGaRLgPd+MrasRVU6x068xqpBoQeKxeJCI2b:XAz/u3sGaRLgPd+MrasRVU6x068xuBoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781087753, "uuid": "eb1379c4-6ffb-40bb-bb88-e54ea406c574", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781087753, "uuid": "eda7032d-39fe-4178-a73b-4fe42c90b4ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087753, "uuid": "097ab90d-8415-413d-9144-948f12d12268", "value": "citrum.io_79bb3c34_c_7zip-setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0847b16-64d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781099578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099578, "uuid": "1fb86fb8-ef14-415f-a7df-419eec9c0fec", "comment": "Malware payload (Mirai)", "value": "02cc0d37cc851e018ee25b825e05fa01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099578, "uuid": "c9b40c23-03b6-413e-943d-75d378ebf5bf", "comment": "Malware payload (Mirai)", "value": "5af77bd7f24950c3bc6a6083599633fc257e26b92acdf224735cb76f4f67bce6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099578, "uuid": "9705e801-a95f-438e-a337-476cedf3c91a", "comment": "Malware payload (Mirai)", "value": "e09b13b6e8c040198000e03d3882ad53c72339db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099578, "uuid": "80b15a23-9127-4baa-b779-9944d0fbba2d", "comment": "Malware payload (Mirai)", "value": "91ffece6c69b92ecb6e478b2ce488e0b6ef16208e5b9a5c4b827263e511b72d33ba713518054a24c845f97038b6ca108", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099578, "uuid": "a984dc5b-5e10-4d46-ba4c-3b9de5417330", "value": "T1E2833C01734C0D83D16B1EB53B3F27E793EFD59222B4AA85690FAA464171A73158EECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099578, "uuid": "62e1e0b8-116f-4e5b-8584-590cbca97b56", "value": "1536:dkMj/sEAqpXLuW6l25uyM3O7HQVhWpNeQkuLXZNW00gOLQXm5hzk:D/sepXLu7l25m7+/LpNWjlzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781099578, "uuid": "c95a6fb1-b42d-49ee-bb94-637cdbe8d58d", "value": 88316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781099578, "uuid": "7174972c-c12b-4b24-9508-12a3f09937ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099578, "uuid": "19f3686c-2bef-4f18-98e8-31e619166bb5", "value": "zlkbnkpmc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df08a4e-6514-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781127438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781127438, "uuid": "b71dddba-aa9c-4d4c-bf4b-9c15856771e3", "comment": "Malware payload (Mirai)", "value": "0b8ef8410679f2463d7e5437405c778e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781127438, "uuid": "9a432f4d-c8ea-4583-afd4-98c7ea074ab2", "comment": "Malware payload (Mirai)", "value": "5b6b89c4490873fd7595a20f6e597743b05359aaadd50423f8ce5a03f7241955", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781127438, "uuid": "9dadbadf-01e7-4e0e-84ea-fc1effc42f9d", "comment": "Malware payload (Mirai)", "value": "9d4e678af0815ca6340d8e1b079da4e4b1ab210f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781127438, "uuid": "16c71b48-e36f-4e29-ad75-e37f2834e089", "comment": "Malware payload (Mirai)", "value": "76e47d6fbddad90ed06cfb72b723afdd92a3eb876790ddbac7de0cc18428930cedd989833d2cfabbb897f0292d73385c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781127438, "uuid": "423c50ac-3fdd-45fa-9dde-67c85e1497cc", "value": "T19CA32986BCC1C612C5E0A1B7FB1F91CD3B2643A8E3E67103DD19AB59674B86B0E3B151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781127438, "uuid": "70b07a27-23db-4b20-8078-7dd1f72ea885", "value": "1536:Q99o2yahV2He+DhjyBpLPKv53xCvZ1XyIFTXvL+06:Q9CgV6eKm/Liv53URdffL+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781127438, "uuid": "54668c51-216b-4d64-85d8-b2280fcf4291", "value": 98508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781127438, "uuid": "45a4fd92-3c2f-4fa6-b44c-a943626f309f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781127438, "uuid": "06e85d2a-57ea-4713-8ab1-637325390a80", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9327cdc0-6512-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781126587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126587, "uuid": "935727db-24d7-49c0-967c-a5996e83398f", "comment": "Malware payload", "value": "d3416bd48561cac8529cc730ef79a7f1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126587, "uuid": "f118d825-4166-4e33-805b-f8f7115d8ad1", "comment": "Malware payload", "value": "5b8c3be74d3fd23450b9f1fbf74fd3b0211d1df0c743f04d3961fc72c27ce7cb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126587, "uuid": "01713ace-9c13-4921-ae53-5040d8ffab30", "comment": "Malware payload", "value": "cbac49e38afe734960e211679e999e4e1400b6ae", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126587, "uuid": "0db8ae18-0fb7-4941-94c0-b388c1ebc3cc", "comment": "Malware payload", "value": "8cc1257bd003bf8cc47439337a9f99a7718f585ba6761c01b1cb5bff02106640a715cb25d2604c97d0aeb2ff4860bdd2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126587, "uuid": "9054ebe2-1ccc-4b25-98d3-b0116a728831", "value": "T141D02EA2802B517532B28891F1A3A400B204C77ECD8686AEFA2B20342F0030AF0C0258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126587, "uuid": "00ccf98e-89e4-4e5e-a4b0-d6b576d5f0e4", "value": "6:hT/iDu24vOVC07HAulNXYq9DG+NjVsNXYrkJ:V/ian2VCUPiq9DGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781126587, "uuid": "4f9338f9-be91-429f-a39e-9e7eb1dac20c", "value": 266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781126587, "uuid": "76610628-fc5c-47cf-976b-de7c8eb30a19", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126587, "uuid": "efa64b53-2907-4a3d-8f3b-c560038f9179", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de1e847c-64d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781101373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101373, "uuid": "fd3ec3c2-60cf-493a-9b4b-3e40080b9359", "comment": "Malware payload (Mirai)", "value": "d28dff111cca5633482ca351c6409dc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101373, "uuid": "7b235baa-cc33-4160-be4e-2e16a7f70c4f", "comment": "Malware payload (Mirai)", "value": "5b96e190e89c1b2f9e436173d3c4138fb3314cd203e395b1875bd91c00348ebd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101373, "uuid": "ae32fe84-0b2c-42d0-870d-4eb44ead59ec", "comment": "Malware payload (Mirai)", "value": "21ba785cadf9da6c25f10ad1f6994c6709b0041d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101373, "uuid": "c4db691e-1377-404a-9aa7-1e5df236a8c9", "comment": "Malware payload (Mirai)", "value": "8ef4c78540da9cc5def7235045d28c56ac3597a3f592d075b19c86145e030e29eec951749e742472eda47f951c31e644", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101373, "uuid": "2f7697b5-a363-447e-829e-901ea0c54b43", "value": "T1788328C5F98781F6E85B4830A1A6B73FD732D8A90071975CEF86AF35CE73401A613289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101373, "uuid": "b6fd17fa-a852-4f1c-9a0f-1624ea3c15a9", "value": "1536:Va2kDSrYR6UwkY4fxKkU7zrskFhAIUgXfSyWWRqS1Daeg4fcxb/Jwd6lR:Va2kDSrYR6vkY4fxKkU7zrskFbrXfTwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781101373, "uuid": "bc0a56d2-a45c-408e-b8d2-d5b92434ae81", "value": 87988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781101373, "uuid": "325111ae-eaf1-4d3c-8ba1-413d9607939c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101373, "uuid": "1c950f38-07f9-4386-b034-bcb92af5aa5b", "value": "evpyuqbis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0472540-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105671, "uuid": "c8b66a5f-1fdc-4706-8da8-40112843582a", "comment": "Malware payload (Mirai)", "value": "b668ff801b95941bdf17c32d69daa4f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105671, "uuid": "285c7d6a-c08b-425e-86be-2195099adf8b", "comment": "Malware payload (Mirai)", "value": "5bc883a81779b66e4256f9ee9ea1654ccfa100f23193f3ca7b6f18830c5acc79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105671, "uuid": "f6837b1f-31b1-4ce8-8bde-cb5f73bdaf07", "comment": "Malware payload (Mirai)", "value": "2c323bb4c670026ae2bbfb13e33efcd614a60aad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105671, "uuid": "b0acc4ed-36a3-4e8e-b8e5-f95629f14249", "comment": "Malware payload (Mirai)", "value": "d8dca9e735c1391fed56f2180f9fceff03a89e0e5c9bf917872587474e04b39fbaf0f38a5678bfba378b3d7d56fded84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105671, "uuid": "3ea7175b-5682-46bf-80d4-064cf50f9069", "value": "T1B6C3D60ABF210FFBD85FCD3B06A9170225CC555722E9BB3A7574C928F64A21B09D3DA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105671, "uuid": "fbce758d-ba03-439b-a725-c6464db9772f", "value": "1536:QhwCvdHmez3BK9LW05Biw6PmPQ4+efKmWhS4cUz9KrZ9nTDCV5bOvd7JMpN:MwCvdHmezn0nUPMu9KryXsMpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105671, "uuid": "965b6f60-1bf9-4861-8576-5b803e1b0f98", "value": 123348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105671, "uuid": "77fe8651-2410-47c0-974b-761b4e79555f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105671, "uuid": "e9a127b5-fe02-4990-af4b-98ccd417a293", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df87d264-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105670, "uuid": "25b00aab-f0ab-45ad-b5d3-cc1c86fc5dc2", "comment": "Malware payload (Mirai)", "value": "cdb0ae55993f35eea17002e1ad336a4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105670, "uuid": "86f88e22-525b-4b1e-83c3-6e9341acd465", "comment": "Malware payload (Mirai)", "value": "5c8d612ad3273073a38afc05e69d7f6f3aeaaabd197ee34e0f056cfd3abe4feb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105670, "uuid": "423592ff-c89d-489f-aa81-4e7c6fff23ac", "comment": "Malware payload (Mirai)", "value": "d8e6623dbb63fec1ea0d1b6986657597e74a7039", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105670, "uuid": "9013cc5a-3038-4c7e-b426-98e963f39950", "comment": "Malware payload (Mirai)", "value": "8ff6d1a1e9b15c00fc972151b3a7295b917342f67390596a9288f704dd3bd8f7bcd6e3827549fd4bb8a3b41754a9d3ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105670, "uuid": "bcb74a97-bc61-4fc1-9210-fc1b55c69d9c", "value": "T1AB538D75D15DAEA8C0414AB4A9198E704F13E4C046732EFBEA9587A68443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105670, "uuid": "0ec2710a-7ee0-4e3a-ace3-976b90fc8522", "value": "1536:ragXV1f1Fl/wtknQPQauiufs3Ii3O/qyD6EZeCc:r57f1b/qQHf+Iey6EZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105670, "uuid": "e6c6c7ba-bf3d-4615-83e4-f4b87b0b3504", "value": 63480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105670, "uuid": "ed542c1a-89ba-4499-a9d8-021d5ed88b55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105670, "uuid": "e88f9479-ccae-4ec5-8a64-c159ea240a27", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "392e5395-64d8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781101526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101526, "uuid": "e1c68219-3945-4d2b-a2e6-517008701a4c", "comment": "Malware payload", "value": "ea3bec17861c01a992b8b3cea26a7db5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101526, "uuid": "9b4c70e3-a1b9-45ad-a091-c2929e9fa16d", "comment": "Malware payload", "value": "5da6ca15d7fadff2c33550469eb7e3521dff59c78094b4b4440fc58fae9addde", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101526, "uuid": "053a3891-f780-4d0a-8ad2-ec5a7df056b0", "comment": "Malware payload", "value": "8fcb7dd1a477f0100f37e977f17e4d163530e8a1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101526, "uuid": "f7d7c900-df4f-4f49-b866-ad5d6ac04ab3", "comment": "Malware payload", "value": "4508e7d383501b18951f2b9c3e50cdb49590057228a540c2fb7affe8194750bb2612be64e1ecd04c71a764b562d2fd1d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101526, "uuid": "672a7d8d-fba9-49e1-8e25-53d07bdf679c", "value": "T18FF2E13CC6276071E4BAFB72F9394991F1A94AD081CA2B5E3C77C25990F3B4D7A67101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101526, "uuid": "50b73176-0b4f-4f94-897b-d5f8c2ccbf32", "value": "768:trkcenm7rdW8Rhej3aCRWrY/CGD5uLiNTKUUL1vAvfoZ4cQ:Z4m7rZHIDr/CGD5uLmdUp4j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781101526, "uuid": "6ccc19f4-2d72-4f7a-af9a-dc0010981025", "value": 37559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781101526, "uuid": "ea3e4e4c-ee9c-4954-8b82-99aeea47a4f2", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101526, "uuid": "2d08dc07-a290-405c-968d-0da2f06a448d", "value": "Cyber_Threat_Detection_Response_Readiness_Analyst.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ee9fdb-64a6-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1781079992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079992, "uuid": "d29a84c0-115d-4781-8ca7-39ed4ef620c5", "comment": "Malware payload (PhantomStealer)", "value": "55813d99f841609f37ccfc9fdbb9c20d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079992, "uuid": "bec411a3-5d0d-453f-870b-f8d1e4ed4bd4", "comment": "Malware payload (PhantomStealer)", "value": "5ebb195c1c7cb0f9f7fd57415eddb32fb15e72567b7f1ea166a73e6fa4b16636", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079992, "uuid": "10a82d84-a962-41eb-9475-3329d34ec714", "comment": "Malware payload (PhantomStealer)", "value": "13a6b73bd826a93340e60a130aa07f1e8058da19", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079992, "uuid": "16b60507-7334-4146-91dc-c14f947834f8", "comment": "Malware payload (PhantomStealer)", "value": "8dca10a9990cc363abb3d48af83b0720133d752bcd1136851df5040cdf2d5d2cd4285e313ce88eb4f39d78dc1f3a851b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079992, "uuid": "1b518483-b621-4b51-9425-ddbe5cc7cd44", "value": "T1FD96413103548672F3549F9A26B5B528600E4DCA58F9EB017A5EC7B4127EC33A3BB7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079992, "uuid": "7057fcda-26e1-464a-9e3f-2679ae40c40b", "value": "196608:rG3JYPiBVaaNkRqi/pdZQyFwiOWAGgOGa/zP9cCzoQPGBuca5IQo97vtfEAO4vtq:i3TabRqi/pdVbGqwKlwmVU7Cf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079992, "uuid": "958c3ee1-3497-4301-8df8-bd05de6009f3", "value": 9156423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079992, "uuid": "9b354d3f-7258-4edd-bc9b-8d49c9301ff4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079992, "uuid": "f434ac34-4c9c-489f-a9ee-cc0383054463", "value": "udofherq.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f73ef4-647c-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1781061933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781061933, "uuid": "4710f21a-c3f9-4ac5-8883-5b8a80059027", "comment": "Malware payload (Joker)", "value": "068639139fc473d87a86d3d5ed16e8a4", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781061933, "uuid": "6004253c-8a7e-4e71-bb88-38a61f6fa655", "comment": "Malware payload (Joker)", "value": "5ef2915937e6661b8ef37a78f42f53c551376bbebb6527ac3919535eb77b704a", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781061933, "uuid": "10a38a39-66e2-4a3a-aee2-6bf3b5bc2445", "comment": "Malware payload (Joker)", "value": "59f6f27fcf855e112f9e7a88c55a79ece1325d66", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781061933, "uuid": "21b53b39-936b-4739-9f2e-f0a749a629f7", "comment": "Malware payload (Joker)", "value": "e40a2710a47d87a54c08e5f4e16c68dd13cca37f5d596ec251a7c2f2ff6b6c6c112b5d762e46a63279327dfee833c033", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781061933, "uuid": "0387edd5-bb51-4cd8-adc3-6c1194eab107", "value": "T11AA7014AF60CD92BC9EAB07CED8B03D3B5126C595210C29B2921D61DFFA37D4DA127E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781061933, "uuid": "32e99b23-ad6e-47b7-b65f-4562f776c55d", "value": "786432:IW6DlFcjo5gp6mxQt1Kg/bIBHlQrp6U78qEfucFv4eZ/:eDlSjQmgKhBHlQrp8Wq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781061933, "uuid": "12ff3938-eda8-4449-b802-bc16962f14ec", "value": 47222327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781061933, "uuid": "8fae61de-1d3b-4b0f-987b-9d8370d9f03b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781061933, "uuid": "2ab18e1b-dbcf-44fa-a5ed-2e5083c696d1", "value": "com.visms.fastig.messages_6.3.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d721fe27-64df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781104797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781104797, "uuid": "dc5d7cc4-0c49-4820-a8c7-be1c038e1fac", "comment": "Malware payload (Mirai)", "value": "bcbb500bbb57edbfd9ab54e968e476ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781104797, "uuid": "bbd72a86-bc28-4739-9c75-aa6101e083d2", "comment": "Malware payload (Mirai)", "value": "6068adbdb12ccc8d1d80152df902def9730ffe318cbae4feb5f0a6b26f00a193", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781104797, "uuid": "9fdd0178-d350-41ea-b291-49095f018221", "comment": "Malware payload (Mirai)", "value": "cf3b885261256b4b1f0bc035517d6eca26a1c4b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781104797, "uuid": "bde0fb66-021a-4cee-87fe-13b0dd8f489e", "comment": "Malware payload (Mirai)", "value": "b5a57c28828568d8e214516baaa7231c619e4737fb50648e8dcbadac868ec0c31c620839bb26079419a2b4b4f3c68cbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781104797, "uuid": "68ba55af-d817-4905-8283-be6a8cf82d44", "value": "T1AB13015CD1C43CF6DEAD1FBDE21A26C8889EB58DAE3C058C83355C57553A46A30FA0B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781104797, "uuid": "302d08bc-4d9f-4ecb-a196-fabb8eb174c5", "value": "768:YaEuKbkfzPnZrvVlHHK9O9Nfr4Oo2aMIHMAlIWB:YaEuKbkfzPnxvVlK9O9FU9MEMAl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781104797, "uuid": "4a669341-edf4-4326-943b-15b306a5d6e4", "value": 45564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781104797, "uuid": "07f91bc2-3c4c-4507-b006-b7c579929cae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781104797, "uuid": "40f2e1af-3874-4add-9ab0-d51e3951a1e1", "value": "zero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c2e4ea-64e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105981, "uuid": "76e212db-6df2-46fb-878d-2d7cbfb03f6a", "comment": "Malware payload (Mirai)", "value": "6d9a3e03feec480dbd38c48bf3d8a049", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105981, "uuid": "9cbe98e3-21d8-49c9-ae40-a0c1b4336b96", "comment": "Malware payload (Mirai)", "value": "60cbdb62c1a9e56df0b3ddfd933137fd6e155724ebc097d88fff1ede4a83fb11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105981, "uuid": "fdb79994-22d8-4a16-b646-358d85407982", "comment": "Malware payload (Mirai)", "value": "b1c1f478410842a69f1507949fb2f9e3a1fdde04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105981, "uuid": "4b0276d5-f7a9-4030-a929-6c9f36b8afbd", "comment": "Malware payload (Mirai)", "value": "5cb474167b4f032fe9bb6a320166799e70105f3eb844bf1b39c3b8f926fa234494b5c058ca9e7f8898e54132506676fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105981, "uuid": "a1987fe6-974d-4e23-b753-c5eeb2866682", "value": "T1FE53F891B8426A39C2D1577BEDAF548E3314A7D8D1DB3213C9244BA07BCA94F0C97F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105981, "uuid": "45ed2902-d222-442a-aa21-f5cbbdebc64d", "value": "1536:nEbNn3E5sOq19Pj21ZXBbpuW+8nkSXeVSvhWy5UzS:+n3IxdpNkSXsKf5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105981, "uuid": "b5a5f297-42f5-487c-b39a-58f956fd4b50", "value": 61700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105981, "uuid": "50c2e762-4950-4fcf-982e-340af53e75ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105981, "uuid": "8f8b353c-5459-4939-9f02-48c51cfd71f2", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c2ee280-64a5-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781079734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079734, "uuid": "32e68de1-b4d6-4532-abed-43f862de0029", "comment": "Malware payload (Formbook)", "value": "541a691306d1d58c2548eb69f05c41b0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079734, "uuid": "e285cbc1-51dc-4094-a247-b9686085924e", "comment": "Malware payload (Formbook)", "value": "60cda0957c7f3d24ef21a92a6f1bd57f791726b8f2e39ab732066bc99f565f4e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079734, "uuid": "0b9f4e14-4cd3-4595-a169-0d341e6c2df2", "comment": "Malware payload (Formbook)", "value": "a9b7d9a1fed3aac5b9713a68495f5227a67e38b6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079734, "uuid": "a35df220-54c9-45fc-8a61-725dc5188653", "comment": "Malware payload (Formbook)", "value": "e3356a2d5308fb24b4d3005db3bcf944acfae63bef782acb915e02b90a3ac64c14a9dae8a302201f88377ba60ce70641", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079734, "uuid": "f2272d2d-b85f-400b-9272-8a1a7cd24625", "value": "T1CAF4083ECC25012FD572D629C49A095FF8C25507623CE94B60CB3B9BAF63886779239D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079734, "uuid": "fd1281b1-0742-4a53-8b19-def829a9fab5", "value": "3072:KXWQb5imT6H/6/dHSPDra4h6ruPW6W8Uebf6kDE4Oria24dZ9XirY8D0HwqSQ5Pb:f/yNePC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079734, "uuid": "764d2fb8-9c39-4dc0-a91d-bf6b1522e87c", "value": 734528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079734, "uuid": "c4c6c376-534d-4e82-a935-9da0af855f52", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079734, "uuid": "246718af-dd3f-45aa-aec0-28136bfed5be", "value": "Payment_pdf_copy_HSBC.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1501acb3-64a4-11f1-a769-42010a9c0008", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1781079131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079131, "uuid": "e0a75b3b-ff00-4637-8b74-544c3049228d", "comment": "Malware payload (LxBaseRAT)", "value": "8e7942ab362aa5dbc4595f895b33badc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079131, "uuid": "bdefbc83-754e-41d0-b020-224b06b8ed33", "comment": "Malware payload (LxBaseRAT)", "value": "60e8ff8b269b9b3842223824d7ce321de93fb434b445051b69ac67d069e30a3a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079131, "uuid": "9b766a1a-a2ea-415a-8e52-ebec80456d0d", "comment": "Malware payload (LxBaseRAT)", "value": "a956bdfb5b7746a116e987a9c8d7f59e0f927897", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079131, "uuid": "9f28895f-8ae7-4b07-a4ee-169d849c35e0", "comment": "Malware payload (LxBaseRAT)", "value": "d23cfcd8ffb6791fa46a6663e82ca84266cc0d8dbd2ba5485c8b46623a5c106d01b12f22834dd8fa273440c08a048853", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079131, "uuid": "d3c79e1e-9f35-4973-9d8a-c8551cbc2f13", "value": "T1DF06275303851BBDF69D0EC9C94B215B20F2D46B7D251298EBB36EE7BC3B9849430636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079131, "uuid": "7014df78-bfbc-46ad-a4b3-908bc246f6b6", "value": "1536:YviCfrMNB5XFfTHPYJOlEAORn4FS77mbGCJjjP2xaOMePqn0B8/0z7ofnQyoO99O:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079131, "uuid": "a88d0fd8-3320-49cd-be69-d3c48ec5cb4d", "value": 3799338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079131, "uuid": "8e5fbcdf-e1f9-4350-bd01-d5d5b4789b3e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079131, "uuid": "7cd733b3-0de5-4710-8265-654a9e4adfdd", "value": "LX_TXwnH5S5lvg.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c30a80-6498-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781074352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074352, "uuid": "51262340-f245-4be2-87eb-650632de3b76", "comment": "Malware payload", "value": "e769e650ee183f026385b5ada214cfe9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074352, "uuid": "6b66a21b-8dbc-4ef4-b6bb-2fa49ee9ffbe", "comment": "Malware payload", "value": "622837d2306c82a95dfe7b872de7fc6ed396b44260791612967887d5f871c11c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074352, "uuid": "271c77e5-9ae3-4b36-bc77-15314c57cebd", "comment": "Malware payload", "value": "a9e0e1d405f61545e7dc6682edb9e9bdd3a036e8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074352, "uuid": "e42618f6-7494-4de2-9614-02bcf8b670d4", "comment": "Malware payload", "value": "28f415241cc718b32642d58c0ff22f9b266fce80703766db7abdf098fbe1834527b4141592119776aaec3f49183ade71", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074352, "uuid": "50166148-5a2c-47c2-a9c0-010999ce94b4", "value": "T1A827AE23E5D180B1DA9631FA56BA376E9A7C8F11033841C777AC3C469B716E1763A383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074352, "uuid": "bbb0a096-9c65-41dc-bd96-926d1cbc4bc2", "value": "60defc48f74be2d9eec489bf122390fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074352, "uuid": "8800da3d-c5fb-4e85-8a14-89a179b78f24", "value": "393216:ApmKYez8e1VdIN/v0WHEbq0jLi+DOANGnDxZpO74d+p5FfPvu:AUKre0WmRNzfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781074352, "uuid": "68070420-a11c-4f03-b838-22ea196fb9ff", "value": 20615320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781074352, "uuid": "c7463752-206e-4f92-88df-0b2856df5fb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074352, "uuid": "c14f6b55-e99d-4d40-832d-3e559d3b185b", "value": "awesomium.dll.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff2aae9-64ac-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781082827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082827, "uuid": "36a3e926-3cfa-43f1-97a4-503834866d8c", "comment": "Malware payload (Mirai)", "value": "93ed334135b8d99fc2b63a4f583d19bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082827, "uuid": "5e55f93d-2df4-4cba-8836-2d0206f81785", "comment": "Malware payload (Mirai)", "value": "625881352b249686bd492871f96656d009d93e96b6a3cc9f9c43ee8cbe0f815b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082827, "uuid": "529a6fd4-48da-4b10-97ce-47f617b6ae38", "comment": "Malware payload (Mirai)", "value": "606d87d769cd9af2489e5b4f80112c0e6c357ff0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082827, "uuid": "0e5c9f12-4b10-472c-b8c6-701513150621", "comment": "Malware payload (Mirai)", "value": "c134325317c10fc032038824f11c7ae2a3994a4e9b2101923648055e9f887a37a34d2ac88baa48e4fd10d64d5b1ee553", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082827, "uuid": "0991c891-b3aa-4872-8851-7e7c468fb633", "value": "T161A35A63DC262FA8C565D570F0B48F796B639A9181831FAE0977C2748043DCEF846BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082827, "uuid": "192eb09c-6a45-433c-835e-e523e28cfec5", "value": "1536:pA8DWfZ3eontjC7KIA7xGzRWQ6DaxwnPWIGy9saQ4C9+qM:pZDDon5bIlWQ6DsyPWNy9bC9+qM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781082827, "uuid": "cdc6bfc5-e2d9-4809-b128-f6e1b4d186a8", "value": 103876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781082827, "uuid": "6ff91374-1c62-4353-b6e4-402a170fab3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082827, "uuid": "cd9b6e6e-41f0-4639-813a-6fb1135a4fea", "value": "CRY.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d81bc2-646f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781056476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056476, "uuid": "b715cdd7-e5be-4d6a-9ffd-d74ee4862483", "comment": "Malware payload (Mirai)", "value": "1b9a8cb7ac821b37ff54b20b323c5ed9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056476, "uuid": "4378d1f3-155b-425c-b026-4b7ab2e6a1a5", "comment": "Malware payload (Mirai)", "value": "62e2dd57d2ad43eff897c7d76ac23b6223fa67b1bc647bf6712bdee10c042a06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056476, "uuid": "3f945ff4-fcce-4c26-aff0-af305d98f918", "comment": "Malware payload (Mirai)", "value": "9d15080e54957cb8622b30120dffdd7e0cfb3d3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056476, "uuid": "d44e158c-7c81-4b4a-92c4-0feff7b16079", "comment": "Malware payload (Mirai)", "value": "9af41902061232a9418cb0c69b968f7e6b71e084cae3274a13f4f3ae3159ad400cde2a9760cd5a664e48040621e36ba6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056476, "uuid": "652954f5-a373-4cf2-885a-7f1febac1340", "value": "T17F146C02F70D4263D6535EF4497A0777932989D309F6E40E690A7B0A1633DBEA7C7B84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056476, "uuid": "6f7c3972-bd12-4298-ba21-ce26446518bf", "value": "6144:tP+jSzu411twxoHtzVMTpQJOC8edI4vDN6E:BPu4fUS1DNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781056476, "uuid": "abc793ac-6f46-495d-8a14-2dbfdd5d55da", "value": 198332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781056476, "uuid": "b056265a-d690-4ed4-bd47-390bf349cd47", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056476, "uuid": "1cc1b849-eea9-4b16-b0fd-615f21fae309", "value": "wife.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "558001ed-64a6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781080098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080098, "uuid": "bb561269-ed91-4385-821f-5c982791b06e", "comment": "Malware payload", "value": "b037a89d531286fe5df5fc538388b351", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080098, "uuid": "0a6cc1e3-d6fd-4029-b2be-5c4159c2544d", "comment": "Malware payload", "value": "637430a438550bcf9799d0a25b442c8d9937336a1fff812d5d05f006d191ce86", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080098, "uuid": "405f6420-511f-424e-88f0-dfc4c993d2c0", "comment": "Malware payload", "value": "639432b57a0992a7767c558c02b6eebe45fe08ab", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080098, "uuid": "1504a8bb-d86a-4f34-8777-7a814df87d13", "comment": "Malware payload", "value": "2a1970512db7fb2ff9d7da425a5ee887b82d3b5d9c0b6e22436e151ed852eb794006631b16a99a995363ef498d4eb65b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080098, "uuid": "d36140f7-49f0-4a23-bddb-7c77273c2fa3", "value": "T182F51297F9F2149B835E1A5CF57F110C8FE2B863BCA6E18633AC64E505A9D5F042881F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080098, "uuid": "d09fa5e2-38be-4df3-98d6-6dce0fd0248f", "value": "49152:jP4pkE/lAEQQbrtKXU6HhgZe0gUiSxz7dLo9NVyt/:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781080098, "uuid": "f4e80c8b-338d-4297-b74b-da6ec347acca", "value": 3354222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781080098, "uuid": "72924ec9-492e-48b7-ad82-80dbba71d29d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080098, "uuid": "395261b6-7688-438e-9c1b-e4293a5fe8e4", "value": "31agosto.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c04cba-64d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781101270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101270, "uuid": "234c6233-05bf-437c-9397-86151838db0f", "comment": "Malware payload (Vidar)", "value": "5a1c42caf24be6c9e1559111400e0a8f", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101270, "uuid": "14e61ecf-be0c-45d1-8362-36598607b336", "comment": "Malware payload (Vidar)", "value": "63aea327fe9c5da94d8170396d902f6e8f4bf185d8108b93dc3ca1f5996d749b", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101270, "uuid": "1e25d5d3-acd3-46b4-998c-1c603f47b61a", "comment": "Malware payload (Vidar)", "value": "2b1ef0102af14238f19296f4c5e09ad47cf4f049", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101270, "uuid": "ee6d15b5-6704-4a4c-b00e-0f97fcea7d38", "comment": "Malware payload (Vidar)", "value": "ed2c5555611d14811a470beeb583179278d17f26172b7a012f6e0581e553c08b0dcae1dfc2d4570c8ff359932deef960", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101270, "uuid": "8fbb1fbc-153a-4a16-9ae8-ecc7b018b2c4", "value": "T11F068D07FDE109EEC0AAB23188A762AA7B75BC041B3617C72E4177B82E367D06C75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101270, "uuid": "bcaffbbe-5d40-4469-9dcb-de30b2a52450", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101270, "uuid": "f8fa994a-3a66-4681-aea3-3be32f5244dd", "value": "49152:SLRgibJIUxA3RrVy0Jom5/JyYdH+7hzFDIQbkcWwvgVv89mk53X0ZD7iZc8d:SNaTya95ByYde7hzFDIQbVWJ4mk5H0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781101270, "uuid": "4da38613-864a-4d94-a2eb-9701c559c1d8", "value": 3741104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781101270, "uuid": "1f100dfa-56e4-4d4d-8a73-00748518662c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101270, "uuid": "9172e855-5e7c-4cfa-ad95-4cff00985fe3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f13abcf-6475-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781059042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059042, "uuid": "05207d65-66b0-446b-85ad-3573ff354e75", "comment": "Malware payload", "value": "53fab6741cd77214dd112015156a39bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059042, "uuid": "b7a32feb-bdde-4044-8412-fba1258d57ec", "comment": "Malware payload", "value": "6417c14bcd0f3c38b78a1f1647117f3b14fd8d0e533d4536eeb5cb610841399b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059042, "uuid": "fa401b25-4655-4854-aabc-8a77087bd81c", "comment": "Malware payload", "value": "a9d0c0d9c52668d4a03c477a24b0fc2f482329c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059042, "uuid": "c59ccad0-7558-4539-8551-afa46bafa154", "comment": "Malware payload", "value": "69a7e7b489e72129558d0ef8252d71335a5c5601f02fe696af3a2534e3513ba52eb681988a76606bfaed7761066bec64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059042, "uuid": "2f0fe4aa-5308-4adc-8cf6-1108bae8232f", "value": "T15546E107FCF108B6C0AAA23189726152BB71BC451F3163DBAE50B7782FB27D06975B58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059042, "uuid": "2928524a-dd33-427b-a0bd-47614e017e41", "value": "72d8fd7d53a64b79a1028f9534045520", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059042, "uuid": "718d3b5d-7a67-42fa-8d3b-a03fdcc9820c", "value": "98304:2GOFdZcSHh3doq4NGYjVDip5TX3I32VawZEFECEZEC7yaS:2GbWhNouYgpJWGawZEFECvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781059042, "uuid": "d8f03fd7-befe-48f8-8632-53068d92d5b6", "value": 5864752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781059042, "uuid": "41807f50-9e72-4d6a-bde7-a1a4aa934a18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059042, "uuid": "e3cf254f-b859-40ce-abd5-f5fb5f6ffb50", "value": "upd_helper.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f651b0-6511-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781126060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126060, "uuid": "1d24c606-f996-4c5d-a412-25e5c8823071", "comment": "Malware payload (Mirai)", "value": "de72eaba94a3aeaab5271428da177f54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126060, "uuid": "fcc392d2-12c8-4092-8fe3-6311b700ab24", "comment": "Malware payload (Mirai)", "value": "6441fdc0b476b78266f59ea7d823e529c705737c3f9ed5357eae6456c866bde4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126060, "uuid": "cfeb2fca-a017-4ced-967b-540c9eda8359", "comment": "Malware payload (Mirai)", "value": "5cf5be529316a68f9689cc8c3d9dec3354a6a557", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126060, "uuid": "58dd72cc-1333-444a-b146-79cde4a9dd2e", "comment": "Malware payload (Mirai)", "value": "f8bc1bbc5fe2ef399bc07841191a2f19cc29652c0909b287b3249c1fa111ba94c0bc72a05c3cee9ec4803b48d23bd6f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126060, "uuid": "3d0bf471-2d98-40e6-90b6-18af91f08d6c", "value": "T1E0F3180AFB408B17C4D61739BADF93023333DB64A7DB730A992C5BB43E8675A4E62505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126060, "uuid": "816fb0f1-69f1-4507-8784-da3a0b36f662", "value": "3072:Eurv7i3ef85vvffx+U+jVlmBPDn+8r16v8XbL/KtwJBHZ:EeDi3efQvHxLyVlmBPDXrovaL/Ktof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781126060, "uuid": "66944e9f-7c5c-4581-81de-ae904d71a1ca", "value": 162051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781126060, "uuid": "ee226b5d-f464-4b46-8051-324d8ffe78ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126060, "uuid": "f4959ea8-5889-48bb-bb53-ec57a8cb124a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a915984e-6491-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781071219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071219, "uuid": "11623181-7844-459e-87b0-82173f486216", "comment": "Malware payload", "value": "2cfd12cea93dabde04b9431b16230b01", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071219, "uuid": "9d8d9324-b922-4023-965f-f0b3fd5a851c", "comment": "Malware payload", "value": "66bdf27c0576654f37bd0c1122354ad5eb823c09eff5bd4caf1e713f21c436b3", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071219, "uuid": "6106f852-aa8c-48f4-88a3-5754aa8cae19", "comment": "Malware payload", "value": "1a3e7e5ef1cabcbc454a1d7dab459544dda6f3cd", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071219, "uuid": "ab17ea50-1fde-4959-9032-cab99c1cb862", "comment": "Malware payload", "value": "0aa15c984831af6c1779d1c7eb341b2a3c8b4836c358f17ad4f2ce9d942a9edde3822619afbbb0ac70e40f5e668efa39", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071219, "uuid": "602b1fd3-cc78-4893-8e11-f9c903efb17b", "value": "T18693022DF0019478D2F1E53ED344A8DA968C2013A929B50922E1DD4C1B4ADFF97DF5AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071219, "uuid": "9764f5ee-b9b0-4ac4-a299-db20b740d14b", "value": "1536:7YY5aFlXzsffjQ05omTlh8Ya4dfA5m3mOUwbGPrzF0OHGlf:MY5iljs/oGTFVAmFiPrVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781071219, "uuid": "32d3b668-40f0-4b42-8b98-47c6937379ca", "value": 95419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781071219, "uuid": "2060ebc9-9f48-4d8f-ae06-f4b199cb4742", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071219, "uuid": "f66852ea-c2e3-40e4-8563-1327f608cf8c", "value": "SI Form v13-lorie copy v2 (1).xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017dd82b-64a4-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1781079098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079098, "uuid": "fecbf3ce-9808-4752-8f43-4cfcfda7addc", "comment": "Malware payload (PureLogsStealer)", "value": "042a8cdb838422fd5c1271d214027298", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079098, "uuid": "e82cb1d1-58e5-4842-8be6-75a29e483c99", "comment": "Malware payload (PureLogsStealer)", "value": "6866bc5f6ab88e116b3f13fbe4891bd23e3145f16e52fd153af70c871bac6911", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079098, "uuid": "8c111f3d-de9a-4ccb-b234-779f7aeb76cd", "comment": "Malware payload (PureLogsStealer)", "value": "40b8cdf9f7f6a7463b4ea9e111bb7ed68cd30aaf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079098, "uuid": "386ddfcc-4791-4784-bee6-7041e4b0f131", "comment": "Malware payload (PureLogsStealer)", "value": "319356a3846c9e5136227105802d9d18f1f75820358429562be9613570d1d0319e94f77b0a181622d4204364d89f5328", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079098, "uuid": "f9e09ea1-f1a3-48ea-b7ad-4190a14f324b", "value": "T154F4F63DCD14012EE572CA19C899096FF8820A5B222CEA4750E72B5FAFB3543B7D725D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079098, "uuid": "53f7bd6c-3f7b-4c96-a415-67079df48c77", "value": "3072:uqu3sxljOWuGDo6Jpc21F5gGs6s9JHu5ASJGfY9t+jdugW2z3EIFPw6GeHKMQN+h:RxljjFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079098, "uuid": "ed05a112-81c4-4ab1-b802-3a1338e454eb", "value": 785564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079098, "uuid": "9ade3a25-fc5c-4e82-bc0c-f7dfd309625b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079098, "uuid": "4c16b19d-01aa-4344-a81d-3d958ec3f3e9", "value": "Payment_Receipt3688954.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "938c7733-64e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105972, "uuid": "277b23c2-87e0-43e2-9afd-d87601a0676b", "comment": "Malware payload (Mirai)", "value": "0e802a35c11830d961eba7454c7c4d7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105972, "uuid": "fe52139d-7d70-4c91-ada8-e2924dda0b9f", "comment": "Malware payload (Mirai)", "value": "69a633a0b5acf701a0d442af9544fda605db965d815c4faba2b8e37a28406bb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105972, "uuid": "5394bb06-f4fe-4e38-8900-f362d6c144e3", "comment": "Malware payload (Mirai)", "value": "05235cfde4a03cbb22cdf60ae5c5fd8cc0925638", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105972, "uuid": "211ea866-64e7-4626-9160-fcd4c287914b", "comment": "Malware payload (Mirai)", "value": "e065b83ccd41c23b94235ea88956de91c7d8a05b34f0c5b76bbd0ab1a00ed3acfd73b902c1c33958dc04e9d84f09db99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105972, "uuid": "75c05959-1a06-4386-a7b5-7ef4aac22876", "value": "T1EE533B02B2280A5FF9D319B0343F1FE197BEEAC035E0B689695ED7558635E332485E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105972, "uuid": "0af8fa1a-98b3-4626-8757-cdd8be1bf09f", "value": "768:PtMLxtiRFwLoDnud1kvSeq7Q4dPfGAsLmZ8BBSzjrYiyR7gHX1SPgIaalJ:VMLSBq14Se4GHLTBygfGXAgIVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105972, "uuid": "f7d47f71-47ea-49e5-8376-aff91cdb1601", "value": 64248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105972, "uuid": "014a1ab1-18d8-4464-82f0-09bf9ee9aec7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105972, "uuid": "617f3b81-0bea-4e58-8f9c-1708f8132b3c", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe21ac7b-64b3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781085965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085965, "uuid": "1a31276d-3dce-4ef5-aa38-5a66be2161ff", "comment": "Malware payload (Gafgyt)", "value": "511bf8490708b6f81d331c029e1f20f7", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085965, "uuid": "8106fcb1-a906-4bc2-9b75-8e01932f506d", "comment": "Malware payload (Gafgyt)", "value": "69c0fb33455ebdabd19703bd8024fbe9bd2d21c30772dac0968cd50751acf197", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085965, "uuid": "b52ce34a-e51e-4488-b872-5cdff06250a9", "comment": "Malware payload (Gafgyt)", "value": "ec5aa4a501b02e9a15fb915768e71c65d40c1df3", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085965, "uuid": "e56b10f4-626e-41f9-b382-966dedb8b171", "comment": "Malware payload (Gafgyt)", "value": "f9bed13bd11b1b53aa4a04d712b80c1beaf4a551dcc2374023ba76d5cdda8ad207a91676e1ab529d22a477c608142a23", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085965, "uuid": "87bf858c-70ab-44da-8e06-06be50afaa11", "value": "T1CFB312C9D63C8D65EFE8A47E8066129754D31CAEE0E9FBBA51D4D03CE244180D4BEB91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085965, "uuid": "da0f7ed1-06b4-438b-a93e-f972fbc7c34a", "value": "1536:ph4pyF9bRroMCKEnuziLEZEjZL2OLKuY/2FN4l/hKXWHlaIl8rD2zF7Rz888OiVm:3OyFlRf2Hnjh2v12FSlkYlaI8yzDY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781085965, "uuid": "05468e4b-f8ad-423e-b340-aead16d51b6a", "value": 113212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781085965, "uuid": "7ebfef19-95f6-4b6e-984b-88cba5d2875b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085965, "uuid": "3e7870a6-2917-4ee2-a8d6-fe883aa57d44", "value": "kworkerd-blkcg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d6b40a-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1781108732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108732, "uuid": "9d73119e-6dca-4db2-8e6e-11d172158588", "comment": "Malware payload (PhantomStealer)", "value": "8b9eefb985d6782290c534f7e71e36e8", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108732, "uuid": "6335a23e-1238-4373-9bcc-b48c3fec95ee", "comment": "Malware payload (PhantomStealer)", "value": "6a59318d58eb3a3cef3fbe65d8476d58e1535c3c8e546b12bfa7da6bdb3f039f", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108732, "uuid": "eb76479a-eda0-46bd-8311-32a1fb687088", "comment": "Malware payload (PhantomStealer)", "value": "c3b7b643c0126528a0e05fd349dc7d0cddf0d73a", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108732, "uuid": "08c45e97-98e7-40ee-9bb4-cb06d684ed48", "comment": "Malware payload (PhantomStealer)", "value": "def2a81728ccc22ad5e95866db272fa2ab81d8338dd904264bec0188941df61616295cb52f1dccd526aaa42a61e7d30a", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108732, "uuid": "a3da40fd-50bb-4801-80d0-7f737cf58c7c", "value": "T15143D7C932C5B4514713B57F2D36B0E7F16A9C8573584028FAD9F8ACF9A4B18C8366B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108732, "uuid": "2d4d850e-f534-41a7-96b7-0d215bc87918", "value": "768:yirFnf3UX3QDVUk3/CNtX6pcrV7s0K/tpBwBY15cIP09DVq6+To5Jp3DS+89:zUHQzq6qVrK/tTwYbPWDVq6+TwJp3y9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108732, "uuid": "8961492d-0740-4cbc-bd20-3737572927ef", "value": 55169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108732, "uuid": "a98c8022-8805-4312-94c6-f19cd0d18bae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108732, "uuid": "08803040-2bfd-46a6-afd9-19e34095553a", "value": "Somun siparis Teknik Resimler pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "833466a4-6493-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781072014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072014, "uuid": "cb2674fe-b566-4cff-a2fd-fccc9c480d06", "comment": "Malware payload (Gafgyt)", "value": "327e5616e3eaf94b2544e0ce7614631a", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072014, "uuid": "dfcd953c-6278-4c3d-af58-ba39a2e23e6e", "comment": "Malware payload (Gafgyt)", "value": "6a7bc46828a80805cb47fb41a10e86407b5f0e2ed8d2cd886724076cf2d7e6d5", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072014, "uuid": "13cf314f-324c-4379-8767-767ff39c05c6", "comment": "Malware payload (Gafgyt)", "value": "7dc9ae3cd09296882ad49d7b6bf5b17ee676c707", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072014, "uuid": "8f6dff4a-8e98-4a23-b60f-5c00e5b53fdc", "comment": "Malware payload (Gafgyt)", "value": "228ab1f8934bd414cd16c0be150c2ca49148332738f549c1aa664e5ed12cfd951409cac9969d0485297c46b1985f5b52", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072014, "uuid": "9e62336e-b47a-4232-8dde-3ec841e2116d", "value": "T1E1931A9BFA42CEB3C41310F112AA9F219D71F9FB4823D642E3646DB4DE154C25A16FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072014, "uuid": "e1b96d69-8fda-4b38-963a-f756212295bd", "value": "1536:Ws+k82vFol2qbZckmjWGw57fobEOQryVwCiUH1FVLx8rbrbUkmyukJ33xZTe0gw7:WsldFo2qbhpRfobEOLVBiUH1FVLx8rbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072014, "uuid": "6a8e88b5-25b2-4229-9644-b55635b201bf", "value": 91212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072014, "uuid": "b4730d3e-7857-4e11-8957-8de835c61ffd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072014, "uuid": "1443d6f8-f0ab-47ac-9103-e4f7896b33bc", "value": "FBI.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c11dfee-6492-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781071519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071519, "uuid": "cae968c2-a3b3-49c7-abf3-4378aad4801e", "comment": "Malware payload (RemcosRAT)", "value": "8c6c686596083b4622db906b83b58b73", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071519, "uuid": "976d2d1c-406d-467e-bd39-be49d7dd1c69", "comment": "Malware payload (RemcosRAT)", "value": "6c0a76a2483cbd28801162b6b5f7c048b01c53e0a65626a7c1fa6ac5dd7b6ebc", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071519, "uuid": "358eb246-a760-4920-b4a2-50ec7eaf26f3", "comment": "Malware payload (RemcosRAT)", "value": "625e0ba1ef37cb25d7e2ad0eb3dd03cc3a41a19a", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071519, "uuid": "1d1c8265-4be4-411f-aff9-9ae7e519b70c", "comment": "Malware payload (RemcosRAT)", "value": "6f920ee8a13205af76e20d9bb601d1059194bbff155ba54a06a315e37ad6c2ef05df6eb3c07d5e2b63e70b1f991792fd", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071519, "uuid": "bfc03832-e940-46b1-9cad-502d137ddc44", "value": "T194A246B9564607DBF84727BFBC84356076F8CBD3813914C8F9B03716A01C968BB69E98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071519, "uuid": "a8fde6ec-c0bd-44e5-b135-6e0b765f6d79", "value": "384:SGLvfkKwvsV3q+p73jTn5PD0O6ryVSvIwGHdWcRz:SIcUV6IwO6ryg1edWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781071519, "uuid": "65f51c17-4a82-449b-9eea-a54f0fdf74fb", "value": 21882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781071519, "uuid": "0c517cb1-4b11-4875-a43c-ed42b5884fa8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071519, "uuid": "bd2a4606-83a0-40b3-b071-f08e479b8e7c", "value": "Draft_Docs.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed554ed-64b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Jigsaw)", "timestamp": 1781088247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781088247, "uuid": "f97b7b1e-92ce-4e38-be07-b9a676710c3c", "comment": "Malware payload (Jigsaw)", "value": "9bc2d5806b24e49133120f6cd0e5aa29", "object_relation": "md5", "Tag": [ { "name": "Jigsaw", "colour": "#348701", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781088247, "uuid": "a599bf23-56b4-4852-8105-b2b8567d1850", "comment": "Malware payload (Jigsaw)", "value": "6c6d2bc2d895c9e0b8946c0d1ad5611632e479eecb481031e5f3744e1a6f65b0", "object_relation": "sha256", "Tag": [ { "name": "Jigsaw", "colour": "#348701", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781088247, "uuid": "74aa93e7-6050-4881-b685-099a4cb34031", "comment": "Malware payload (Jigsaw)", "value": "28f66810f1e863e4d1f245b9abdf502166a765a0", "object_relation": "sha1", "Tag": [ { "name": "Jigsaw", "colour": "#348701", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781088247, "uuid": "3b548e9e-34d0-47dc-9b5c-a3b2574e97f7", "comment": "Malware payload (Jigsaw)", "value": "9e21b3a1b311430708a0eafdc43e3ba260152edb7b4d177d65a710de4afb1231def08f51f2e1b394ab7c7bb17c896782", "object_relation": "sha3-384", "Tag": [ { "name": "Jigsaw", "colour": "#348701", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781088247, "uuid": "a6382c4a-fe66-401f-b56a-92b0315c4b5f", "value": "T1D7535B06B2F80713E3FB6FB82DB55590073AB957F535D7DD4994208E08E6B808A60BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781088247, "uuid": "8ab8dc9d-9f7d-4504-b6e9-fbe5e2e91d19", "value": "1536:n+LZHckPG3JkpJE9IZUY1sIzYi7D10Py70:n+LZH2ZkpJESZUYxYID65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781088247, "uuid": "23ba1b2a-7667-4d08-9080-f4907e936b77", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781088247, "uuid": "8a3b7d25-f530-4d34-aaf7-942e5468b463", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781088247, "uuid": "a5ebcc93-dc87-4a31-b9f5-ab05edff3fc3", "value": "hitclub.nagoya_1ae33ef5_r_teamviewer.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588fd4a0-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781108880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108880, "uuid": "c433fa2a-cc00-4483-990c-50de10562de5", "comment": "Malware payload", "value": "cf024181f262177cb9de23f80a882cc6", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108880, "uuid": "32447310-459a-484b-a572-3a18bde01b8e", "comment": "Malware payload", "value": "6c88277db6950bba079d692eb3f2a922878165a0e3a61111065e104c651b3fdd", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108880, "uuid": "56cb88e4-0114-4c17-938d-ebaa8e68767d", "comment": "Malware payload", "value": "2799875643eca029c0e378718400721e246422cb", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108880, "uuid": "e4dc9a81-f336-431c-b82c-76340dcf8ad2", "comment": "Malware payload", "value": "45af08cc56f5e3002e4a5fd7643233ab617186b60df96a63eec30a8579447bf098479a397604768316f2fe55a4ca2ac7", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108880, "uuid": "6a035e9b-d400-414f-bf0a-1e58780cd637", "value": "T1D1519307BF124379D6F0A27802FD592CDA71C34B0827CD30F58C88101B326EA8A984FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108880, "uuid": "13827462-e0f8-4db0-bcbd-5ecc66dcc96c", "value": "48:oXOkglNIgORudAfDcCp5iceL2hjNLD5MWWg/BxRxkZSJE+gUAd9A9/C22Ac/AfzC:hHtAfD1pYclJhqWWg/sZpUAHq/C1J/Am", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108880, "uuid": "9f520f05-c34a-4e2a-a2a7-3aa18d04951f", "value": 2808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108880, "uuid": "33a588da-63c2-4b02-a3ef-dc3955710d5c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108880, "uuid": "f9d24b1c-64d9-4319-943c-aa473018ada0", "value": "RobloxExploits.exe.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a34d162-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781108748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108748, "uuid": "c66da587-eb20-4152-8447-27d0b58b3fb1", "comment": "Malware payload (AgentTesla)", "value": "2516bbc3821704348246d7199338d98c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108748, "uuid": "1375cd6a-f928-485d-b512-9858a8c2217f", "comment": "Malware payload (AgentTesla)", "value": "6caa430455012ac218e8576830ed5d01e4beff6c9abf97583b42afbbea495016", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108748, "uuid": "404380ff-84d0-4122-8a6d-c83616f7524e", "comment": "Malware payload (AgentTesla)", "value": "6d18c87033a8f511c5470da155ec8586dbac1809", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108748, "uuid": "3b6ae324-27f4-4636-9de8-0504716ab1c9", "comment": "Malware payload (AgentTesla)", "value": "0c2bd43029e8a5569b2c664e9634d61f58d572648835daf0a0d402dc1ca96353ba8867c0ec2bb47174a9c593cb52d639", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108748, "uuid": "526137e6-e0c7-411c-9b7a-bc17e03b65b5", "value": "T1357621710364C671E2585F9A26B9B128540D5CCE94FAEB017A5EC7B0127E833E3BB7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108748, "uuid": "c86b0f63-d1f1-483f-9f85-273f76fee5ec", "value": "98304:c+t8V4rqkwpbhDOhlDcUdNQn0XcbJps9Fdr5C4TXJBrqA49aw9l/:bj69DclIeNQUcFS9fr84TZBOA49aUl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108748, "uuid": "91e5bfd1-1a9f-42c3-86bb-7644b6a62092", "value": 7198846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108748, "uuid": "ca0600cd-9181-48f3-8637-05f7ccd08ca4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108748, "uuid": "523fe236-f5f3-44c8-bee1-eaf6a20d66f3", "value": "DHL Pickup Confirmation.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c58dcf63-6498-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781074273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074273, "uuid": "ea3237a2-3949-4d7a-bd67-7422cfa3d08f", "comment": "Malware payload", "value": "5183ece3283d4d076fd6594b2e1b0bf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074273, "uuid": "61244be5-fac9-408d-bbb6-fef47a1683bd", "comment": "Malware payload", "value": "6d2fa43545dac5a71f54b05a7ca0f1a4562493ed1b28ddbc3656acd9790c1bda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074273, "uuid": "e7f1dcca-864b-46f3-a4a1-c597bc45f142", "comment": "Malware payload", "value": "08f86ff2579caaf04ea3f3dcf94b19ce6ba32fe4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074273, "uuid": "97054a1d-dde2-4751-8e65-335103f2b43a", "comment": "Malware payload", "value": "e21bbf0858876ebfebef595a5e4ae2f6f6085cd195ed3b6bdf9083a39fdbedb173d71a9eac43c80cc5249f95c65110a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074273, "uuid": "55f29a7c-61d0-4f77-a48f-5a96767da8aa", "value": "T190B4294E7A700AF7C98BE9788E17C952D6F2F8450963870311A2C76F2E63BA19D0DF15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074273, "uuid": "bbd631f2-2ae9-4f4c-8b98-3961977667ce", "value": "dbef93bc241dc82d4eb76dd7271f47ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074273, "uuid": "258b756d-a53d-4fb7-8ed5-88649b81d0d4", "value": "6144:bugoAFAOGdWrL3ErUtscMK6z1ZTFSI6tRyzhHIwa49vljBmC1ZU8G7VD4/A1Vbrd:HoDWrTErUGcMZzBZh3A5LP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781074273, "uuid": "b14759e9-4cf5-4067-aa60-b265f378dc82", "value": 539808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781074273, "uuid": "5ea0c653-4922-474c-9f6f-13f6bf402b52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074273, "uuid": "8bae8f4a-ae5e-4e0d-bc25-4c4c6c4a9ff0", "value": "CDLMSO.DLL.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df1f8ee-64a4-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1781079227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079227, "uuid": "a19e5621-bfd3-4d15-b8f3-89c801831445", "comment": "Malware payload (MassLogger)", "value": "4b8e582852587574142eb5e5c763c7d5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079227, "uuid": "a36e69f3-685a-4eda-ac2e-c884f764d67e", "comment": "Malware payload (MassLogger)", "value": "6d44c9589bdecf7b154afc5872f4f4b85d437dd8b182c670f1a368fc5f9b44c3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079227, "uuid": "80b253f8-5060-41cc-ab37-99facab114c5", "comment": "Malware payload (MassLogger)", "value": "5b9fbfe3aa856c47a0b3654aac70658cec7cd406", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079227, "uuid": "610e44d4-e7bf-43df-9d5a-c0d60f93ea9c", "comment": "Malware payload (MassLogger)", "value": "2eea06b61e6d00b94044406b07293e63dcf27c354e71fe3fe1e036bcc53a7bc4da729ac291e604a586c99fd3b395e6cc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079227, "uuid": "05aec15f-34a8-4ca2-8f9b-5269975aeb0a", "value": "T10DB56C17D66F974E180A3B61106A5D9AFE89CEFCEF726BC4E0CF90B110EA1110B855B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079227, "uuid": "668ba195-c91b-4695-b338-2c546b363f4b", "value": "49152:KUGaRo10c/xyqiEcrNyf0V6EXZKOK61mGqfqvmFA7nTPK5CtOVWGG6:W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079227, "uuid": "10ff7833-9952-438c-a336-395be776fc99", "value": 2474415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079227, "uuid": "78e3a9c9-dcae-4efe-baab-f509e1ba781e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079227, "uuid": "640f457c-54c8-4ec9-b9fb-0f8128127327", "value": "JWSK-6I1M1S1R3A2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e46f46-6495-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1781072658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072658, "uuid": "97828e08-8c5c-4591-b898-e2fc511904e9", "comment": "Malware payload (DDoSAgent)", "value": "303b9902f3285d13484c9022adea2657", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072658, "uuid": "4c1edb2d-1e3f-4d36-a5e2-c94cbea453ff", "comment": "Malware payload (DDoSAgent)", "value": "6d45e90c266e3268e1af13e23034a1d7625186a886f6ba6df129ba0baeb5c7f5", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072658, "uuid": "2040a9f9-422e-431b-844b-67091257f8cc", "comment": "Malware payload (DDoSAgent)", "value": "035de4a030ff1e75036f9f1aa26ba046c5604752", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072658, "uuid": "3a141e0b-47d3-4474-b666-cf8f0f0962ba", "comment": "Malware payload (DDoSAgent)", "value": "791cf8fe1cfb19afdcb5db969d46e1f4596c9eeeb850cb0c28b45a0c2ad0d56585d8e2ed6a808b9eb497c3ae2202cf95", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072658, "uuid": "2ef9c480-f822-434e-a5cd-4c881d2640e9", "value": "T157A5331762E7E09D58AA0B331527BCD9CD6271F9220821977915F311FBEC21E17873AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072658, "uuid": "08fd2124-ddec-444d-9d85-0254c58075fe", "value": "49152:PuwAa95GFWOMvDuQJrNo4lKxXKBfAmjeoL2NtcJ+vxfDn3Ab:lZIguQs4saBf5eOcty+ab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072658, "uuid": "812aa810-590d-431b-a236-bab7308a7add", "value": 2249676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072658, "uuid": "8c0585b6-cb0a-428d-bff9-fb499c7b3448", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072658, "uuid": "891f8ced-5727-478d-8b75-c0b897ac2c55", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "864a5bf7-6493-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781072020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072020, "uuid": "4c5a5956-e88a-42a8-885e-066aa1f110cd", "comment": "Malware payload (Mirai)", "value": "660b8927365363582927718b69be508e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072020, "uuid": "28ad7dd3-df1f-4dff-b729-566ca50b66e8", "comment": "Malware payload (Mirai)", "value": "6dfc1a7b93c7b344c87fa706f43efb2700977a75c7c392f5b1a590991a55aec1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072020, "uuid": "ed794f2a-2b61-49fc-a87e-7b4cf509b72e", "comment": "Malware payload (Mirai)", "value": "89cda5f0be060b1ec3b5c546f67547677eced174", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072020, "uuid": "96e4cae8-1ebc-4bfd-bb83-a21a15f9d86c", "comment": "Malware payload (Mirai)", "value": "b213f595137f792142073a15e58fdd3ebeb2346fda05ad5581f0c538c56e1f8e645dcd27ccd7bfa8a5fadd378781bdb4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072020, "uuid": "21a5363a-ae70-4873-bd3d-62520f771e3d", "value": "T12A933BDAFA42CEB3D06310F116BA6B218971F9FB1C23D682D7647DB09D111C19A16FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072020, "uuid": "5e6f849b-dbc6-4bf0-bdf6-03843549a886", "value": "1536:ODFHhBPQBM6FXMar9wEeHo7mUvsEyabYB5bqNd2xOyQJ33+ZPEg:mLepMar9eo7MEY/qbVJ3uZPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072020, "uuid": "42636e59-6d69-4687-bc18-ab7193675b44", "value": 91212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072020, "uuid": "7a902ccc-f130-4dac-beb7-302288aa36b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072020, "uuid": "802952b8-54d1-4e62-bf14-f6c1c2d9209e", "value": "FBI.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a9bd60-6491-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781071151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071151, "uuid": "98bf9cb6-fd7d-45ef-8e99-88acde7645b7", "comment": "Malware payload (RemcosRAT)", "value": "788076bced6f376d36acda3fe7e9947d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071151, "uuid": "d7833bf3-e4be-4099-a752-11f5ef231387", "comment": "Malware payload (RemcosRAT)", "value": "6e0249955b794fde528a0da09a6a54cca6c9ff64b1aa11a3913e065c54836c89", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071151, "uuid": "d43f81c3-11b3-4b15-b662-76090dae5164", "comment": "Malware payload (RemcosRAT)", "value": "1e3463c68fbcd6639492fcbac87cef4450106870", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071151, "uuid": "1f4ccd2f-9026-488b-b885-1c7aaa3b463d", "comment": "Malware payload (RemcosRAT)", "value": "63762b660524e98e4692998fdbe7bfaf832e813daa348bd8715e5359208e1df1d8f1644907a2e81634069df0399aa647", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071151, "uuid": "22e0343f-4dbb-4f49-9d7c-5bbdd211e1d3", "value": "T1B8842870DA20017B4F83BB9CBCA54661C66DD325862705F0F6D98B0D900E9ECF7BD66A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071151, "uuid": "2cdae2b7-ecca-4991-ab11-7c336fdcb39a", "value": "6144:j1Ck6gPYjuE/JSzRKIVMU/3MwK23QkoqW0i6ltFp3DMze55h5WqAQ5uxumhO49w0:j1PYKCJSzAIVL3zKiQkvFDtFpO+AlQ5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781071151, "uuid": "730c18d3-4a8e-4430-a5bc-5acba43c5e63", "value": 376220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781071151, "uuid": "95034621-0194-4e6c-a97b-5ac423125b4b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071151, "uuid": "a73defc7-11df-467e-b55c-c5ccd3174c1a", "value": "awb_tracking#_shipping_documents_bl_packing_list_commercial_inv_10_06_2026_000000.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f619689-6506-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781121427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121427, "uuid": "83211c56-e429-43bb-a0a1-bcc06f276018", "comment": "Malware payload (Mirai)", "value": "303b80f71f5bafe73b0a12dbbcaceced", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121427, "uuid": "c850a6d7-b9fc-4831-ad3a-31d82c5bf09b", "comment": "Malware payload (Mirai)", "value": "6f65d06ce3f7275b958bcfc641dd0365b4f9e5963df171ad5ce6402fc4a5b3af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121427, "uuid": "3ad1c8e5-fb42-4d48-bde6-5500f9c8f1ee", "comment": "Malware payload (Mirai)", "value": "74af0cd506176c7b087fd8745f3dcc0cdefd5365", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121427, "uuid": "927e4e47-9aee-4299-9b4e-94200cb888f7", "comment": "Malware payload (Mirai)", "value": "b032ba305c5c11447021cfb5e8f03b134166dafcdc0fc16c6558ba8f5ef7bbc7dbf6f30049b8d6e6e46cc6825e83040c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781121427, "uuid": "815e3f42-f793-428a-8153-d60764d92097", "value": "T120256D02BF905FEBC4AFCD71492EC31700DDE98786D5A62A71FC8B8CBA596490EC7584", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781121427, "uuid": "60d7d18d-0ac7-4444-84aa-b4be5df41dcf", "value": "24576:ONWnau3iQfkyEolO6+KOqm15W5TYYgEi:OcaNecqq5W5TYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781121427, "uuid": "c9ea6176-0792-437d-85ed-15f7d5e622aa", "value": 976652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781121427, "uuid": "42920ac1-dcb2-464d-93d3-d59e1ce3ee78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781121427, "uuid": "97884448-8e59-4b55-98ec-3a5c76c9e6b0", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "077945e3-64a5-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1781079538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079538, "uuid": "1c2cd446-dbd2-4e1f-9f88-44db76f729a6", "comment": "Malware payload (PureLogsStealer)", "value": "15f53a83eaf0ffe55373c30f78ceeff2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079538, "uuid": "a99b0818-c91b-4377-966a-75c972d6d2ac", "comment": "Malware payload (PureLogsStealer)", "value": "6fd8cf9b6c48349c807dd1f76da1a2ccf0216b7a633d5a7f6b067e38f1061e97", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079538, "uuid": "0df5c3b3-083f-454c-ac97-6b0ac906c165", "comment": "Malware payload (PureLogsStealer)", "value": "a23d771fd006976565aa2695878ae14e65ba2d56", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079538, "uuid": "da0701a0-8b52-41a0-8c8f-f71cfa05d45d", "comment": "Malware payload (PureLogsStealer)", "value": "b66b2abe1752a2bf222771d25fcf75e3485a4db8bc51c4cdc13ce9408ab11562fd037630f0856494aaf5f48418ec775b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079538, "uuid": "e21d2157-0f10-4e58-9b16-fdb9f278d592", "value": "T16FF4E53ECD54412EF976C519C498485FF482269B622CEA47D0CB2F5FAE72846B3C325E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079538, "uuid": "892521d2-00bd-4e14-a9a2-27f0020d3761", "value": "3072:K1TRi1Tve3ZdK47Z3MqxqkKVDqeNQ1sxcL+oDEPNRFmysPSLemmSmJvchvwY3e5r:Z1Oc7h6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079538, "uuid": "012c5f2e-ca9d-4957-b6aa-b2693b9f29a2", "value": 793424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079538, "uuid": "505df2d0-baf7-4a44-a70f-5ccf520f9174", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079538, "uuid": "5b1e8afd-016a-45eb-932a-f5fb13adf330", "value": "Revised_Purchase Order [No0116348].js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad74b66-646e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781056190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056190, "uuid": "1a90ccdd-3dee-4a58-b4c0-a137462762dc", "comment": "Malware payload (Mirai)", "value": "6f4fb5df84ad6a67b7fbf61a03be9619", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056190, "uuid": "39ed8428-76f5-48f0-acc9-43a43de81f89", "comment": "Malware payload (Mirai)", "value": "706b03225ccdc0359ccd1da1171362d1e6431ea3c9364176f4e6814e11f85c9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056190, "uuid": "18539d11-73fc-417d-86e7-c2379f5e4561", "comment": "Malware payload (Mirai)", "value": "957c9cfcfc6f1a1b30a06033a57f663b023b1551", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056190, "uuid": "e498a6ca-ac7f-413b-9705-99b7f1036ee8", "comment": "Malware payload (Mirai)", "value": "3b02bc0efb413b5f3d73101499bd8d86d668c2b52ae38075dc1ac9cbd7644b499542e9e06dcb1e210ffd88b0f6df8566", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056190, "uuid": "01ad1b11-cf8d-4d50-abd2-c4065c3562ff", "value": "T1C7D3775A2E228FAEF66C873147F74925976C23DA33E0D684D29CC1146F2039E545FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056190, "uuid": "a94d5da7-ab90-4ea9-b1ad-01fc061ffa44", "value": "1536:M6Fl5zuOh2HjUz4nr0DeU0IBSgN1ETiYIK8tr3nvr:M6172DUz4nru0IBBuIXtr/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781056190, "uuid": "f2c59f1b-94e7-4bf1-beaf-7f31643c5f8f", "value": 137304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781056190, "uuid": "aaa9c20a-3d48-40e9-ba45-42479e20b582", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056190, "uuid": "76c552f7-c7a4-4c95-9a68-14dd74c51352", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d8f3086-649a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781074850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074850, "uuid": "62aa6bfd-5ff3-4425-b70a-b9175fb4deab", "comment": "Malware payload", "value": "a0ca75a7131009e2c9f956cc986c2902", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074850, "uuid": "a2691e5d-c52e-46e7-954a-072afb1dd57f", "comment": "Malware payload", "value": "70b2a890ecba4ad593b9f07e4010f06e12f2e9d1d9663b58c43858319c2af69c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074850, "uuid": "1dc6e19d-fa5d-4014-9a2b-f4c2ce7890e4", "comment": "Malware payload", "value": "2b6b6c90158c108bd4658794bce68638898daf23", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074850, "uuid": "f5cb5658-55f4-466d-9900-d383296d23f6", "comment": "Malware payload", "value": "210aa997149b05858bafc4fffeb53e2bb643028a05f344c730c392ad169975c663875991379d496a21d9dfae875533e1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074850, "uuid": "6dec27d0-fba1-4a98-8df6-735a44ff10f7", "value": "T1F0137D6966857C24AE99883B1C7E2F0CB9A983E1310451DDBFCB3CF58C19B9CD219B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074850, "uuid": "f662bcb8-5a5b-4471-a5d7-1358616410f5", "value": "768:N+AT9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:N+A0co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781074850, "uuid": "ef25ca44-df06-4c8d-ba2b-ff5587ca8d1e", "value": 45505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781074850, "uuid": "a193ae21-0c65-4194-b684-764485166240", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074850, "uuid": "136bf889-b7f3-4799-8e0f-63ca08476c46", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e8dacd-6493-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781072014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072014, "uuid": "97f0f9c1-e36e-4814-b59a-ee116273af4f", "comment": "Malware payload (Gafgyt)", "value": "a6aa87675e21f7c82f00824132ac6826", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072014, "uuid": "78dc3eed-8b1b-42de-9984-a66f4bf318f6", "comment": "Malware payload (Gafgyt)", "value": "70d5a9d918cadc7f6e2d79e9c66efd2920bd9fa8aefcedbd94b915e648b37db2", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072014, "uuid": "d26cab14-4305-4575-84ec-4ee01186d90e", "comment": "Malware payload (Gafgyt)", "value": "6343764a2591c49e4babdf621863cfc9742ba077", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072014, "uuid": "71edb5bb-d505-48de-8d3b-c25746d70fb3", "comment": "Malware payload (Gafgyt)", "value": "2fe74eafd55ae9ff221946156e38532ca1d115a513fcbd5c5ce513dab85b65dc501c02426b1cfa361b123dae03b2b0e1", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072014, "uuid": "627d396f-5749-401c-8ba4-98437dad1467", "value": "T12BB30997F801DEBBF40BA67600A708157130BBF60E931672B2667997EE761D12833F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072014, "uuid": "56850dc0-287e-457a-a571-a90cbf69a448", "value": "3072:87UZoUl+fZV8yTd0+kU9ZjFILNOxsJ3MZC91:0US86wyTq+kU9hgnJ3f91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072014, "uuid": "4f7b6c68-96cf-4bd3-b8b6-3167066aa89c", "value": 114596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072014, "uuid": "e32da90d-e905-4316-8f44-87ae5a5bfa23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072014, "uuid": "445bc41e-7533-4565-84fa-55e48656f95b", "value": "FBI.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de685c87-647f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781063578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781063578, "uuid": "628c71dd-4151-45e5-8a7d-171593eaa902", "comment": "Malware payload (AgentTesla)", "value": "a19bfe3d610d2c0735189517992e6d80", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781063578, "uuid": "6c3dbd62-e694-4749-a198-69fa57c51ffe", "comment": "Malware payload (AgentTesla)", "value": "70f13f4ba8532d3b876a5279f1c63d80c75f568a37e6e96ad8e27e0f24fc3685", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781063578, "uuid": "a4b8163d-18c5-4b2e-9cd4-52dd2a6ce92d", "comment": "Malware payload (AgentTesla)", "value": "4d3cc9e2b53749ce1fe168defbd2338b6373d8e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781063578, "uuid": "d0aeb853-ca55-4eb5-a549-3366c2767bc7", "comment": "Malware payload (AgentTesla)", "value": "c71c773e11a5cbf253ee73ad9e3d3d7968da6166dfda36d3081354e22980bd4f5ef5e5ad6c2386bf4f2350cdb47167b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781063578, "uuid": "c6d2bee6-2fc2-4fd4-81f0-bc15dd8e106d", "value": "T12A953377C565BA06F38A0D47B0C533E6A2E83354738FA5020776D93854AF7BA9A43CE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781063578, "uuid": "e132a6c5-7a3c-41fd-b367-61c11bca4e18", "value": "49152:/RAb5qMfdbL8S8In44IRDBjQVELpPtzEqcAFF1EGArj:yb5VfdbP8R4IRdHF1IqcWcG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781063578, "uuid": "e02d316e-27c6-40b6-82e2-c88f5f515263", "value": 1903279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781063578, "uuid": "7449a28a-c60f-4cc3-bd12-9511bf95168c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781063578, "uuid": "481449a9-35b8-4317-a3a8-e54d6d135709", "value": "Purchase Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2460994d-64a6-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781080016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080016, "uuid": "b199eed8-ce22-4462-93c0-e27953104fa5", "comment": "Malware payload (RemcosRAT)", "value": "0d29a07139b9020092e97cd8c73272ab", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080016, "uuid": "40351279-6502-4574-8dd5-84e0c244bc4f", "comment": "Malware payload (RemcosRAT)", "value": "71557c39e8e2ad284bbc90ccb118e38e2d5eadc9ac9fb538f981c6959027c9cc", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080016, "uuid": "6a44eb1b-5c86-4f26-bf7c-a3d149d5100e", "comment": "Malware payload (RemcosRAT)", "value": "270022eb589225dac114110d67cf8cb474ed53b8", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080016, "uuid": "cdd250ad-3e38-481d-91ae-03e7a854d8cd", "comment": "Malware payload (RemcosRAT)", "value": "b06ff904c38e901d73ee0844848760e32a5bbfaaf7f9a81f6c69c8df0423c04456358643e867e164e7c92e260844ffda", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080016, "uuid": "ea39afc6-79fa-4502-8266-4ef1c91e6598", "value": "T1ADE6C7C2E1F360AFFF7C7B12AAF01020031D79CA6C16EB6454DB664E56BDE68C05598B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080016, "uuid": "0bf1af55-62c1-4288-9ee0-e8b28a3e46cb", "value": "768:JiKo39c1HAndXBqDea5j4ghbZKhCJzZXvHUsCEeQ1amUITpF+vbkTITomS1q4d0W:9IBXRG9HIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781080016, "uuid": "bc6255ec-1bd3-43ec-894b-ef7e07f9d390", "value": 14366206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781080016, "uuid": "c1bbe08d-2137-46bc-8a13-feda27affc49", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080016, "uuid": "74bd2129-b25b-4669-8377-5f25988852a3", "value": "task.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de932d1a-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105668, "uuid": "9a568b24-bd69-4fad-b35f-f6da4e4fe6e8", "comment": "Malware payload (Mirai)", "value": "db812566c9ae156190f0d1d7a72c5675", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105668, "uuid": "4bdea542-0a2f-4cb2-aa94-c4cedeae55b1", "comment": "Malware payload (Mirai)", "value": "71bf769be4920eb1479847f21b5e2a4abae7bfbbf53bbb4894d7eae86f5ffff3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105668, "uuid": "0d82b1ef-6553-4c5e-be5a-5f25eb3b9ed0", "comment": "Malware payload (Mirai)", "value": "5125333c33ff7bb44eaddd3ee8f2f1341b43f7d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105668, "uuid": "a7ffeb43-f615-4f49-b705-dce53d2f18a9", "comment": "Malware payload (Mirai)", "value": "c875d2a772f01ea0c2b26a884bc1f18d4237f2ceead0d69d69d5652f9a3a46e70df4d74861850df7a0104b9014a3f544", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105668, "uuid": "18020a33-b063-48a0-aabd-4cde1bf897df", "value": "T19CC2D030D994AFA6FFB85CB46C84C7C03FD95FDC26DA8E9031969F1453226AA83D41C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105668, "uuid": "b684d720-befa-461b-85c6-cebc02f97225", "value": "768:oKnqLiChP7gI5Eo6CuhOkQAsTFAvyUnkW4uVcqgw09I:oKqL1hooduhOkuAEW4u+qgw09I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105668, "uuid": "a86f0604-26bd-44d1-9428-6445232670c0", "value": 26232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105668, "uuid": "cb96150c-ed7e-4266-a1b6-63248b713a2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105668, "uuid": "f07b047b-08cb-4511-a93e-8492776f91e1", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feb4a5da-64b3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781085966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085966, "uuid": "9ff523ef-66cf-4c44-a5b9-8279626550ca", "comment": "Malware payload (Mirai)", "value": "ae8a95eb1108f48814ebc2a356022a32", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085966, "uuid": "1bdb6729-61a2-4892-9aa1-42f6ce9f6e66", "comment": "Malware payload (Mirai)", "value": "71e37c6e4cbf19e7ec6d984ba368a93ca63acb61c73d3ea03fdbdd6036fc9eea", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085966, "uuid": "72a486e4-d936-4c4b-8f5c-50add18bbe7c", "comment": "Malware payload (Mirai)", "value": "4b4f7fdd25ea21d600a2928e8214220849e1735c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085966, "uuid": "6745c852-b396-44e1-84f6-b6c67d425274", "comment": "Malware payload (Mirai)", "value": "adb94d2e975069df707c447cd9797a4f910e171aee302560a47fca748ba13f5717a11af64ea5f8327d35de6c881fd11e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085966, "uuid": "5b5fbea5-888a-4b8e-8c00-86b085743222", "value": "T1F4346D42AA43DAF2E01315F112EB5F635A32ED3A092FC5CAE7A43DB1CCA11D4961673D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085966, "uuid": "bb2568e4-b307-470c-8796-9bcc4d1aee5c", "value": "6144:LoVs7/oZhidFu2rmN05Ig3Rep+/ecRMo2+:Lcs7/IidEAmTssto2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781085966, "uuid": "96f4395a-66c6-4ccf-bdfa-c667dee57e4f", "value": 241492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781085966, "uuid": "3718baca-b021-46b7-9730-5d6d3cd7d362", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085966, "uuid": "f5a6621c-5053-4d9e-82b9-623dd6f652a1", "value": "kworkerd-events", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f991e0f-64a5-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781079632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079632, "uuid": "0f2ee555-c85b-4783-9c59-823214872047", "comment": "Malware payload (AgentTesla)", "value": "69cf30119fecabd955c097a8e13d5c50", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079632, "uuid": "6d22254f-d61b-4d46-b753-78a986b3b8ec", "comment": "Malware payload (AgentTesla)", "value": "7288d9fc8f2b22f24ec30867181f5b65f3b10447b6d3ad970f3784aae3c5572e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079632, "uuid": "76817963-3525-4b0c-9694-ee6ee4068d78", "comment": "Malware payload (AgentTesla)", "value": "b48a0a4d63b28a12349c3fab5881c85251063bd2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079632, "uuid": "2b045c1e-6dba-4bfc-bbcd-fd7b13848f91", "comment": "Malware payload (AgentTesla)", "value": "40cc8b272f3d96d56c6792d926a529ea7760ca76a963dc9776e5e65918ac45cdfe6a29298b17fdce922cd2705c123640", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079632, "uuid": "8b1d2a64-deda-4cbd-850c-451f2749b043", "value": "T113F5AB3782F123A7810DB1414F97AB9E9C44A4783AA025EC16239F771CE7CDAD599E3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079632, "uuid": "9d13754b-c46d-451b-8f07-df78debff9b0", "value": "768:F9Ysxd7WbBSSSx3s9klvi+q1HdSSSx3s9klvi+q4NgSSS0LSRPQfFB805BOEpSDu:sl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079632, "uuid": "8255bd89-5e5c-4154-98b6-fcaaa6c9c714", "value": 3343482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079632, "uuid": "7a72ad9e-9a4c-4fc3-bc9a-ff4b8d3b3038", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079632, "uuid": "b7b05c77-cdf5-401c-9303-40354ba24eab", "value": "AnnexRFQ.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf98c0a6-64fe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781118072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781118072, "uuid": "f49a0a66-8a5d-41ce-a257-2b91cfccc9e7", "comment": "Malware payload", "value": "e47195a08523a4759ddaf38483cd70da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781118072, "uuid": "e0842996-0c27-4e1f-a602-88fb8726335f", "comment": "Malware payload", "value": "72f368c7999cad924fe4463d9b0c2c084e310e573a806910a7887484ff7b72b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781118072, "uuid": "ab829ce1-e078-40a6-86e2-bc151a9f6961", "comment": "Malware payload", "value": "45b314b26404b108d8cf26b924d6f4d1cbedb253", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781118072, "uuid": "18662909-0a9a-4725-be22-402dbad4d86f", "comment": "Malware payload", "value": "e8750a822c35dff707de2c141835efe96c73a60217bb05a89a377ec2ce98260df460f9e35d9e5faac5462b93c7b5518c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781118072, "uuid": "a8ed410b-9433-4ac1-ba53-e7832dfd6144", "value": "T1EB22F804BBE88335D8BF8B781CB383105673FA029822CF9D5C98219E5C337418D52BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781118072, "uuid": "a723021f-90b1-4584-831e-d18c6308b995", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781118072, "uuid": "9844114f-ca9e-4b2b-9ecb-ee3492547adc", "value": "192:uJxBcXd6O9p6BOn7loLYZw6raOaC9eOfVNgDy22wp:05Oj7losZwcaOaC9eOkDylwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781118072, "uuid": "1a76803e-ed9f-4f39-b544-cc1b76ec88fa", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781118072, "uuid": "2c10376c-c6fd-49c7-9a7b-8cc0120335ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781118072, "uuid": "13291d6f-0558-444e-88ce-5fec61a5754f", "value": "rIsaacGuilhermeJuandaCunha.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e51d1c7-649a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781074852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074852, "uuid": "1cf54fd3-431f-4afa-b8c7-8e280f5d806b", "comment": "Malware payload", "value": "bab936f45a62c8e7ead79e4cc8d0d008", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074852, "uuid": "fa15ceb1-b62f-4f19-8938-a564b9b56907", "comment": "Malware payload", "value": "7334b8ec8d221e63e585f72610eb129520c1138b1b7907d28798189b17d3b23f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074852, "uuid": "85d3e413-85c5-4481-b911-68fd111fccf3", "comment": "Malware payload", "value": "cee978dcba36be3e50f56d095282fcab59515ee7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074852, "uuid": "695608c0-94d2-4e89-b0f8-4b0f14e9a3cf", "comment": "Malware payload", "value": "0df6d0ec73d54177ea986775fb47e820aeb97b14720274a9d32d7514f338b19e54e67b070dd5594ba674465e98d78278", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074852, "uuid": "5be30f52-5f2a-4863-9f17-4505280492a0", "value": "T1D901ABCDC006976091C6FC5D22DB1044B821C3DB25468FBABFAC583DDBA5B98B019F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074852, "uuid": "d334b296-1b13-405b-acee-95e92144ce29", "value": "24:kXCKysE2hi0ziQvZohaDOhiqqHMj9EI4X:e9Qp+MsDkiFHMj9EI4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781074852, "uuid": "dbdc73db-1266-4f68-9bb9-88ee0c59d04f", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781074852, "uuid": "b1ffdf2e-bb0f-4e71-a4d8-34a36a765a37", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074852, "uuid": "d5ce39e7-8457-4bf4-b9fd-90cdbfdd5106", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef72efa-6493-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1781072007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072007, "uuid": "8161af00-7c4e-414c-bf7a-d0cf51b2ac0c", "comment": "Malware payload (SalatStealer)", "value": "2678527e743b83525aefbe53685360e5", "object_relation": "md5", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072007, "uuid": "f4801e39-9653-4bdc-8dd9-85e4649afc59", "comment": "Malware payload (SalatStealer)", "value": "737ddc8d56c2b8c5bf7844c15bfb31374924833eaedecc1fa0330477e6b2e151", "object_relation": "sha256", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072007, "uuid": "95481e52-3b38-4c09-b12b-6190caf4e998", "comment": "Malware payload (SalatStealer)", "value": "450056e6390dd579bb0baead961341b77cea9ee9", "object_relation": "sha1", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072007, "uuid": "df10ce23-dff9-4df5-bc23-225e12ce0143", "comment": "Malware payload (SalatStealer)", "value": "14a62f2a387c24c7b7989276c482403de87b35a014c1b621e06c30029121e456546eb2b7811518283d0ced36acce6aee", "object_relation": "sha3-384", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072007, "uuid": "3f769ffc-4c9d-46b3-b3c6-b360d3281e6c", "value": "T18EF533E3CA7BC4A7D5ED3B3F06B53BA894614420A739262B3A7407316F098E4191B5F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072007, "uuid": "ec490acd-d599-4f37-9a3f-cbd6add1d3a0", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072007, "uuid": "01469357-bdcb-47a2-895a-dab2a90d6441", "value": "98304:Fi4xVpmiJ9qG9ODlIVhyM4TsTiZfiMqK4f:AyjFJZ9OxIVhyM+o2fAZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072007, "uuid": "61b9c910-c658-428f-8841-062310473bb4", "value": 3596800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072007, "uuid": "291a026e-3dfe-4b05-b8cb-af73a0587395", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072007, "uuid": "a635423b-63a2-4d13-8de5-f9459ed4ad82", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca3fd67-64ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781082660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082660, "uuid": "a4b3d1e6-369a-4e6e-8ad5-2f598190f890", "comment": "Malware payload", "value": "21fad24764a0d624813fef891151cf95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082660, "uuid": "9c08bbe7-34dc-4483-9e59-b9a2273ad099", "comment": "Malware payload", "value": "737fdaf38ef022c78caea93e61b88c75056c8baf3a8d32dbb6ff708a8dbac3ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082660, "uuid": "c448bfaa-8e9f-4571-820a-ec87637ac652", "comment": "Malware payload", "value": "888c4f6c36a46660f84c84dd57e1fb8204da32ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082660, "uuid": "3e15605a-287c-41e0-b060-6941857d5995", "comment": "Malware payload", "value": "f4dccf21ba166fbe67c7a52e8cc84db776e03a5018389a613f1cace5b90899b35096f240e74c37e7573e175037f5d4d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082660, "uuid": "663b6c3c-4190-4cea-b57d-c70b59fd8b92", "value": "T191A30885F8509B16C6C652BBFF4E428D37261768D3EE32039D256F60379B96A0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082660, "uuid": "68e6a89f-f6bb-4449-b118-a3e1e8c51fd8", "value": "1536:zQITUj4JQPOJ/Lj4V1q7XlgKgl3MwywN1kXCVvFWGlNEvDp5qUiOmJzv9:zQkUVPOV4yR5CutMV9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781082660, "uuid": "56b5d25d-b430-43d0-81fa-a5ab4fb2f600", "value": 105996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781082660, "uuid": "a0b51eae-d46f-40b2-b436-c242639b1930", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082660, "uuid": "d05b3152-a44a-4d07-8aac-e2926976a842", "value": "zero.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474c6b4d-64db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781102838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781102838, "uuid": "a8c582c9-4c14-4538-8eba-ffcb285b3bc6", "comment": "Malware payload (Mirai)", "value": "5f88657a14d9c577976a2ebae252df6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781102838, "uuid": "a2633308-6c91-4151-899d-30121d541b09", "comment": "Malware payload (Mirai)", "value": "73a5885beb7e08d789b40b88c28d7acc44032ae08d1d7f5ff15d28721c657866", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781102838, "uuid": "1fc2e4ab-8168-4840-a64f-35220ff78354", "comment": "Malware payload (Mirai)", "value": "c6cf8e8441f0cc0684194c850d27640bd0b6e86d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781102838, "uuid": "5e1ab726-cbf0-4195-a0ea-f231351ce0c1", "comment": "Malware payload (Mirai)", "value": "ef4f25db063f8b60971aece01e7fee13bc65cf586df7991bcb1d22759de132db652997caedb52a5efe9e6a7a8e2f93b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781102838, "uuid": "e45a2c60-c93e-4571-914a-9225e8216f3f", "value": "T117B3C509BFA00EFBECABCD3709A9074628CD581725A92F76B934C918B54F64F16D3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781102838, "uuid": "4742b1c7-4e06-4ca2-9458-f83facb584e5", "value": "1536:jBS7j/z2Yc5tXjEb/7TvxJuHxjwRBVMbeNgmcp+2whp:jKj/zMz9RjwR23S/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781102838, "uuid": "7685741f-e4e9-4eea-aafb-5888ccf12b79", "value": 116704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781102838, "uuid": "f0386f1d-7ce4-44df-8a9a-c40837557c7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781102838, "uuid": "51896c02-2371-49fa-a11e-f050650bce66", "value": "kznpkpoyh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb6b0e3-64d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781099577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099577, "uuid": "6c374058-3ef0-4191-af2c-2146e6d8be4a", "comment": "Malware payload", "value": "5395b7e66d038af769df4e152a14a185", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099577, "uuid": "223d3a85-26d1-4568-bd35-364036e83749", "comment": "Malware payload", "value": "73be5b7fd734af7c79cba92ee625d09175dc7240952880765307ff042510484f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099577, "uuid": "b6efae8d-5207-4ad1-a9d9-30303cefd2ca", "comment": "Malware payload", "value": "a8034c5f5ae20e97a47cd33cfb7d50aa5436ff8e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099577, "uuid": "f14025bc-c96c-4bef-8f50-312cc755e0ca", "comment": "Malware payload", "value": "f3b80e80642daf411bc2fe76d2dccced24dda1d75d0cecc6d91d55ab9a03f30e7a314df21773c93eb50ebb15548a9954", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099577, "uuid": "1b1e9b30-5436-49e2-b00e-0ffb71d138c0", "value": "T15801AFCEC519DB5041C6E45D22975594F820C3CF2A468BE5BF9D583E8BA9A48701AF84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099577, "uuid": "90b63899-a551-47db-849e-9814c09314d0", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaTIGIvxqFI++k9ISJ24I4tEXIjomX:kXCKysE2hi0ziQvZohaTuv4Xh19ekhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781099577, "uuid": "96793783-fac6-4ef1-80ae-7cbf13c852d9", "value": 843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781099577, "uuid": "fb60e165-fa45-4587-8ac9-79c8b98cb299", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099577, "uuid": "9314d86e-af92-4c89-aaac-5f7d84314f0d", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8030f361-64cc-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1781096491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096491, "uuid": "16b18c0c-d013-423a-a51b-1b7774487f9e", "comment": "Malware payload (BlackMatter)", "value": "5d95e6e32d473f64b1de80e91806e5f8", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096491, "uuid": "9d31810a-8cf2-462b-bb3c-4a0eb67aeb62", "comment": "Malware payload (BlackMatter)", "value": "7494ad77dfaef8c1d03c3025d442477b4a645f263bcf997114e66eb53422efa2", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096491, "uuid": "a4049eb5-4bf9-4cff-a11d-a16a33188777", "comment": "Malware payload (BlackMatter)", "value": "525cca9bdd7afd6d4562fb9a570487be2d486e81", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096491, "uuid": "292b9812-fa8f-4f5f-bbe3-e3eaf26bba6b", "comment": "Malware payload (BlackMatter)", "value": "7b07e0fefb2df82811e5c3bb20ee2e3bdca9a08fde6e790c5376a720ca406ad4d84412ed674995128120f7cf8fb06fd8", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096491, "uuid": "b50e897a-c008-4d55-9c74-36b02c06a39a", "value": "T10BE37D21F212D0B3C83718F13736B572B39E4E6C19A56847EAD80F9DBC658232F45A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096491, "uuid": "6d12bedd-2a72-45ef-b40a-2c5b224f0ea5", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096491, "uuid": "786b131a-5da8-47c9-9ef1-4b198033e075", "value": "3072:W6glyuxE4GsUPnliByocWepNc8TF/wDop:W6gDBGpvEByocWeD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096491, "uuid": "f68da506-7b20-4909-8f70-38d4e8af89e8", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096491, "uuid": "b241825b-918e-4fac-a6cb-5d06893c780c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096491, "uuid": "cdf55fe7-0310-4f48-ad6d-50547876ef01", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb925f0-64ac-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1781082927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082927, "uuid": "dd4b2c37-cf77-4e7e-a0f5-b8ecc6eee8e1", "comment": "Malware payload (WannaCry)", "value": "35e816b57ae7d03a2bb6e18ee924b211", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082927, "uuid": "ab6c5c66-7f98-42fe-9ab3-7b722d615e38", "comment": "Malware payload (WannaCry)", "value": "75ea715b4d385853655bd7ae0b121fe4c488abf531c514342e7b44a09746e1a9", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082927, "uuid": "2c1f8448-6187-4a83-8047-f4c1e08df12a", "comment": "Malware payload (WannaCry)", "value": "fd49704845a68127b6e9311f82e5630862012e0f", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082927, "uuid": "15739f2d-dc87-4429-b380-f7476ba573be", "comment": "Malware payload (WannaCry)", "value": "395897c727e788a4e2ce1da25fe5d909e654d1af0373658c87d37fcc46d7c0584b9c7b26ed15b31ee7d867850d501fff", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082927, "uuid": "67eabe2a-925e-4e90-9ddd-5b9f8788e9c0", "value": "T1BB36239931BC81FCD106297484B78E22F3B37C6A22FE5B0F9B40457A2E53B56B750B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082927, "uuid": "ba219c5e-dc70-45eb-8e22-d7d85b6d4f26", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082927, "uuid": "2f3b3dc9-378f-4fdb-857e-77902d308461", "value": "49152:jnRnnMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:D1nPoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781082927, "uuid": "2c0c8b56-074e-43fb-9fa0-13170e43e525", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781082927, "uuid": "0a446ffa-aff3-4f5b-b84f-93f9d723b68b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082927, "uuid": "04565f9d-7430-492f-95b4-ce71e0f527d7", "value": "75ea715b4d385853655bd7ae0b121fe4c488abf531c514342e7b44a09746e1a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cca84a2-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1781108806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108806, "uuid": "907cca12-f402-4b2a-bae2-9d958f3cd67b", "comment": "Malware payload (PureLogsStealer)", "value": "9993b55462dd165865136ed8ded49e24", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108806, "uuid": "45a1fed5-8424-4ecb-abfc-84be20b3e40a", "comment": "Malware payload (PureLogsStealer)", "value": "761745042e6ba4fadd0bf1ef4a28df72d34caefddd294cd022a37cd6e282faea", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108806, "uuid": "33d0eb3c-4f2b-40b5-adfd-9bbdff0fd9de", "comment": "Malware payload (PureLogsStealer)", "value": "111cdc61df052148e56dcc8a2c860edd3250d544", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108806, "uuid": "37c243ef-7bea-4914-8bcb-32e27c7fc2f3", "comment": "Malware payload (PureLogsStealer)", "value": "c175609f119cce47d2ebd444ec640f89f20e6c0af096a6c1854df7428cb2ceec98d849f9906b38baddff650a6826be26", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108806, "uuid": "88de3d59-17df-49a8-8bcd-8e87c4ddbedc", "value": "T129F4F63DCD14013EE972C629C89A096FF4921A5B222CEA4750D73B5FAF73442B3D625E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108806, "uuid": "8bf26f0e-f276-4307-84f2-e4e04229f97d", "value": "3072:a2/rdrQ0IsihywnjDgRJyxfpPvES1kx/Ysx8edhSgqU++QnOB/uupPalNXfWx+Fo:ToDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108806, "uuid": "0a128fe2-f6c2-4634-b489-6e3d3a032986", "value": 781828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108806, "uuid": "ce72cb41-ec99-4f74-b304-73bf67f093c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108806, "uuid": "f8fb4211-e4e5-46db-82fc-f082f1c4c907", "value": "Payment_Advice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bca3cfb-64e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105986, "uuid": "d82f82a0-3172-4eab-b5e3-c13732bc024c", "comment": "Malware payload (Mirai)", "value": "9d3006b3bd94af9dccc9c81a16ba487a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105986, "uuid": "b6b1d7bd-ce6f-4b6b-80c7-347c427185f8", "comment": "Malware payload (Mirai)", "value": "7683a76aaffb156dfcf921646cd3964582d23e17880cfd9dde86f851e1861ed0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105986, "uuid": "8083cefb-5bb5-4f39-b3e3-75b554fba322", "comment": "Malware payload (Mirai)", "value": "27d7bf25ee872e6edda762e1796500187943d452", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105986, "uuid": "379139b7-ef80-4ad1-849a-3a525af89a57", "comment": "Malware payload (Mirai)", "value": "52ad914f9f6280b814f958cc144fa659fed2c7adc2bd8059b91e53ce9bdeea381b71a072be3895e88a70862b363fc7e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105986, "uuid": "d282d83d-b359-4f26-ac06-4cf3bdb99b74", "value": "T19D730A85B9819B25C6D513BBF91F018E331657E8E3DE73129D201B607BCA91B0E27E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105986, "uuid": "033faba5-01d3-48b6-80de-bd20212146db", "value": "1536:q9KnGSGYfkiu/ZwQNCJEHQXglNU6bO3d5yAMw1f91uwcWIWinluUsPMrQ:CEkiUZJNZHKMNU6ba4XwtsluUsPMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105986, "uuid": "b1921117-353e-40a6-a0d7-db582724ad54", "value": 79764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105986, "uuid": "6e6f37ab-ccc7-4a3a-9c2c-61912f2807d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105986, "uuid": "04752191-0afa-4398-80eb-9c8d9165e52d", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8310bdf0-650f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781125272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781125272, "uuid": "1af93d05-68f6-443a-9add-bed273678228", "comment": "Malware payload", "value": "2bac693e27b23f168a2d8112eda1eb8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781125272, "uuid": "333a4aa7-c3bd-4781-898e-cc9026c2e816", "comment": "Malware payload", "value": "7685075191503c83fff83b7edc886e02d3353ac2397c689a36cd3fda37b109b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781125272, "uuid": "577134e5-aaa3-441e-9b38-abad4bdc7499", "comment": "Malware payload", "value": "77d31a665ece160c078e7afaf9fcfd0f28f20a72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781125272, "uuid": "57e2eda5-ec45-4a22-b890-a642f2bafea9", "comment": "Malware payload", "value": "7473015018a5393901ccdb4abe0412e5bb9dfc8909785a5d9685d7cf8f413c6d74676d06116f4b7d03c67d133ef2120d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781125272, "uuid": "cbd87c5a-a310-4ccb-982d-611c3bad27cb", "value": "T1E822D504BBE98636E4BF4B78587383145277F6069922CF9E9C98119E4C72740CD82BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781125272, "uuid": "0dc1a131-bb74-41ca-9471-8d5cb0ca59f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781125272, "uuid": "bbc87d84-4c09-4fbc-bfe9-2de42fd0a720", "value": "192:UUseZoc2EGFow1poz45QLYZw6IaOaC9FVGIDoy2FR:dNjGqGo45QsZwvaOaC9FV3oyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781125272, "uuid": "0a483cf6-d817-41c3-a5a5-cd1e8a8a6771", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781125272, "uuid": "c5a12bfc-5022-4451-ba8b-d4076d1c5bc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781125272, "uuid": "e5eee322-35f6-4d2a-8314-6be4b5d52a6d", "value": "rLizMarianaMoura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef907bb2-64cd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781097107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781097107, "uuid": "57877592-7295-4c0b-ba68-831bbf820354", "comment": "Malware payload", "value": "796fd4e9d7da619b8330d902e9f3b7ec", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781097107, "uuid": "2d64e58d-36b6-409b-bea2-073fd41c8b91", "comment": "Malware payload", "value": "76978f9961656e129e7ea7eb054362383fbdc7ba28172a19208ebc0dd4e8eb60", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781097107, "uuid": "bf8bc997-8f17-4228-93b3-8657aee6ca3d", "comment": "Malware payload", "value": "42e0ab37c0db1d941098802edb0952ac7434dc6c", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781097107, "uuid": "804c615e-2c69-45f3-9e78-3195a386626e", "comment": "Malware payload", "value": "878f478be12ef0c09f9791758a33f962381678307011631ff063df5afdf1e327f3873133a00d0d5537c9aef7c71d7d99", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781097107, "uuid": "d3e48324-ce2c-4eba-a5c8-b0626c0ae65e", "value": "T1DAE533CE5AF822B7F0A11BF4BDFCC993972DE76932C49193688386DD2851D74F48124A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781097107, "uuid": "38648068-47f2-44fe-b36a-c336dd94e63b", "value": "31d397f35586b7be22be72ee489bb6b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781097107, "uuid": "67b43ba8-5495-489e-a602-5e25177f1ccc", "value": "49152:OtjSh2Wy3BVkTcnScAgtJ0bG3LDdarO75EUPPZKCb1jGeg8brLZ:Otjq230AJ0y3/wr0Px/HgGrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781097107, "uuid": "3971be01-c4a9-4cf1-b825-17c3cb28d1b8", "value": 3249544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781097107, "uuid": "fd5d0c78-e706-41e6-aca0-a15d59772ce6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781097107, "uuid": "59729ac4-0669-4929-b87d-63daef9ec1fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2acf44da-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781108803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108803, "uuid": "ee369818-3d8c-45ec-973d-8d1ec3e38bb1", "comment": "Malware payload (RemcosRAT)", "value": "d37a4e83d446faf9c80af192cfeaceb2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108803, "uuid": "a31d4d3d-4209-4b8c-8026-3a1d936b3395", "comment": "Malware payload (RemcosRAT)", "value": "76d2edaf0b7a84678b332bb884ae65612e28e7ad64e2330ee3708e311bef52f1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108803, "uuid": "ccee6e93-034a-48c3-a525-cbbbd8709bb1", "comment": "Malware payload (RemcosRAT)", "value": "36ed9960d4c8783970c096cd9de7ca8d7979c085", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108803, "uuid": "e9447e4b-d8ed-45e7-8502-6004438da2a2", "comment": "Malware payload (RemcosRAT)", "value": "75bc52aaba55bc3f0687437a8ab826b8f4740b60dab60eb1d844bd672c3d9c6af9a7ffd4e98a740b2dc09eb3a6a4ecff", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108803, "uuid": "461005ea-1069-4e54-9179-aad481a08a18", "value": "T106365C17D66F974E280D7B61006A5D9AFE89CAFCEF726BC4E0CF90B610EA1110B451B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108803, "uuid": "c437999b-19b2-4a63-b855-bacb553350c9", "value": "49152:e+o1p7ZQsM51RuGyRqesrN/eEYyRypzxWTiAJQ0Rgi4OvsiVXXEq7PZxz/3P/APC:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108803, "uuid": "f03c9cac-9fd7-41f8-8662-140c65e0b56a", "value": 5067653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108803, "uuid": "7695da69-a3ec-4d5d-adf6-d51a04eed7d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108803, "uuid": "47e8c2fc-ff7a-4261-8317-79abb501b044", "value": "Request for Quotation001_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb7e04f5-6495-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781072995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072995, "uuid": "aa24f970-c108-4229-89f6-91143d38dfe9", "comment": "Malware payload", "value": "9d6dcfaadea2fcd8e347f5e9ec5b6a9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072995, "uuid": "a0bd3bb5-a87d-43a3-9ca2-94d8a7bc7611", "comment": "Malware payload", "value": "77229108d9ee0d3b63e7a81dcb5a348e67f52326b7fd32a4b0a3f81431152e77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072995, "uuid": "ed3a11bf-4bea-43d4-a39e-3dd2429ae398", "comment": "Malware payload", "value": "e346f365e139de20b46eb406f98138911d8b1c02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072995, "uuid": "b376965e-3bd9-458e-83ff-4b8213fd8d90", "comment": "Malware payload", "value": "0817dd9196f0a83d695715532e06be740a00ded782af633e3c14c23591fc557b8bf87ddaa8808f82175859e374edd81d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072995, "uuid": "676cef92-0280-4900-b40e-feff3ab862a2", "value": "T102762957B8924952C4E43A37B8BE81C432634EBA8BC716576D04FE383EBE5DA0E35744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072995, "uuid": "2a695c48-5f8a-4337-a63c-2d839954980f", "value": "49152:EYctxZGzi3k6YijBSxEyDiIqzdf8wlmWQs4IUB9OolH5EN:E1FhYGBSxEyDi5y9OMZEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072995, "uuid": "df87809e-08fd-4a32-aac2-a39f1f3eb570", "value": 7340216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072995, "uuid": "b953ffa9-40aa-4e08-86f1-6d62cc247e1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072995, "uuid": "77ba9a0c-e281-42f8-8bf7-c1a1a444265b", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b0c09fe-64e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105985, "uuid": "c5d3e4b6-6882-4c43-bded-b3d4c7db921f", "comment": "Malware payload (Mirai)", "value": "33121a0cc45acbe26b6fbb5c079dedde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105985, "uuid": "f898daed-cecd-4916-862a-375c8288b8d1", "comment": "Malware payload (Mirai)", "value": "77324931256d43d5e17fe8c01222a44a4e5b2d5408cf61abc7fec5cc1d4724ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105985, "uuid": "91a5e4b5-9a1d-4375-94e6-136c0bb84f13", "comment": "Malware payload (Mirai)", "value": "b18b581a6c1aa8fa760cb47af26524f0dae82476", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105985, "uuid": "b5d072d1-461c-46ea-87bb-b1fdce9617d1", "comment": "Malware payload (Mirai)", "value": "49a7c749438d05295b868582ab573e927cbbd75e74afeed868a9f09cee1224b183472a6c3e46c0de6a4ad67a54143e6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105985, "uuid": "41126654-5c1f-4d6d-99cb-d8953d166c97", "value": "T1B2434AC4B183F9F1DC05017C306AEB326E33F0B6713AED9BD7E455B3A855606960AA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105985, "uuid": "b712fba0-3d7a-4390-9996-ccfc10a6d554", "value": "1536:MOssuiundFq4ZthwLi/pXUfx0WbVGoPCdgZl7dbFfGW:xzuXndFq4ZthB/VUfOWhGoPKgj7dpOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105985, "uuid": "807ca359-5a70-4039-b0b7-5ca0d006e51a", "value": 59984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105985, "uuid": "f8c2f4fb-d3e9-4c2a-9835-c8a12b7e6f0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105985, "uuid": "52ead5d8-fd6b-4a98-9051-f7f32c08c40b", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25495dad-64f2-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1781112659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781112659, "uuid": "d2cc6d26-6e2d-4e0b-a542-660af6cfcc8c", "comment": "Malware payload (RemusStealer)", "value": "9eea9dd7c547eacff38707961c4cabf4", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781112659, "uuid": "3f0adb45-bdcb-4cb0-a772-a8647c4245e2", "comment": "Malware payload (RemusStealer)", "value": "783008a032b58cbc5b194bfdb579e392b8519db1482f60ce7cf6084f599c3b75", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781112659, "uuid": "ec0549c5-edc2-4537-a930-d417115043c8", "comment": "Malware payload (RemusStealer)", "value": "3dbdd6268d958ec120b48581aae047b77218bec8", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781112659, "uuid": "10878266-af13-4d61-a48d-4b8acfacb72e", "comment": "Malware payload (RemusStealer)", "value": "ae66fa30bbee6889f3f8cce638f97e58db868ce7a0a66f2d317dc801e2a9d12fbe2b924d4adb1896756ecea04571abd1", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781112659, "uuid": "fdb34a2b-1813-4eca-954d-b49b64d66afa", "value": "T1561622CE567289F49BFD624196390F2787B143E00C924941A1FC8B607E16FA76C9AD3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781112659, "uuid": "fe3a8fa2-cda9-4353-b87e-4bcc62822bb0", "value": "24576:cHiPC3iD0twQgHn38q7Sqtas+owGBQdUmB463YQC/xF0o6SEwzOslHfoD:cHxSD0tEn38pqtaqzSB7acotOcgD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781112659, "uuid": "8bc0af38-278a-4f66-b3ee-30d19e4b37d6", "value": 4039292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781112659, "uuid": "c6e50830-161c-48ca-aa55-97207a6e30eb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781112659, "uuid": "887a3f09-5812-4b91-93c1-6d6039978ed8", "value": "WStartereXL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083fa26b-650c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781123777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781123777, "uuid": "216e51e4-d8b9-40d6-9227-9a24c9f15ab6", "comment": "Malware payload (Mirai)", "value": "3bf95a891e6e73c9c1db37a5db60eeeb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781123777, "uuid": "45cc5de3-21d3-461b-8d9e-fc3a782cde6e", "comment": "Malware payload (Mirai)", "value": "78979a82a8d06eecac13d9b5044ef1361dfff33850966a655fac6a712015fe78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781123777, "uuid": "c6590dec-75b9-44da-a863-7bb82deb0609", "comment": "Malware payload (Mirai)", "value": "9ad2b42f41a279d7fd30aa735e2c098cd5417128", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781123777, "uuid": "2f867f23-3ec0-40d7-87d4-5cc7843efdff", "comment": "Malware payload (Mirai)", "value": "506c40e0e81bd74d3da82d48c89142a9c6c64bd1bf4af4d1be38abcd08c7f86bb2bbddf154c55153c1b212739f87022e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781123777, "uuid": "3bc7e073-cbc0-4d3b-9868-86d06ede76b3", "value": "T10D041A46EA404B13C0D727B9F6DF42463323AB5497EB73069528AFB43F8679E4F22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781123777, "uuid": "04294c05-3ae0-4029-baa0-0c483b7be1ba", "value": "3072:8xmEvTwGiF61K1uTa9nPorjHycsbsL50mUzNopM/R01L:8gEvT6F6MITa9nPorjS4L50msapM/R0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781123777, "uuid": "401bfce5-435d-4b62-b8be-dedc97fa0af2", "value": 188274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781123777, "uuid": "44417e2f-62a4-42a8-a2fd-65db6b7f432c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781123777, "uuid": "89d19f77-7941-46dc-8e83-25748979a5e6", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "680193d8-64a6-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781080129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080129, "uuid": "4785385f-a26c-4ed3-9347-8abd0bb96c90", "comment": "Malware payload (RemcosRAT)", "value": "6519d5e07dd4774d63626c9a2a4f198d", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080129, "uuid": "239a4685-53e9-42f4-b5a2-197d3691fa2b", "comment": "Malware payload (RemcosRAT)", "value": "78a6f4da6010053bfcba304e6a01a0c47bba05bec370b775007a8a03e4150ec7", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080129, "uuid": "663eaeea-ad90-42ba-8d4c-19c1b7c6b38f", "comment": "Malware payload (RemcosRAT)", "value": "390894f0755e30c010173c886437d110a28d40a5", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080129, "uuid": "dea9fcdf-9b47-481f-b6db-c205ce6f2685", "comment": "Malware payload (RemcosRAT)", "value": "6512008291dadb0387feb7db2df14a60bdb9b606186508ca788d0322e5d8d802a0d251d932a60ef3bf6eff6b2604f7a8", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080129, "uuid": "00bc8aed-49c0-4785-abf2-7991a3ebfb0a", "value": "T1D29242E2EAEA3BA5B847177C8CC83A417274CBA0413748E8FDD05F84EC5D8347B59998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080129, "uuid": "8f0fb17f-ef97-4d8e-b7e7-84f69e3a0104", "value": "384:Kj6HoX5vQxS3YYUguGj0UZnmyFOJqiML8OTUQmfEU:KjqoXKWfUguGj0UJmyFOJqiMLxLLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781080129, "uuid": "df84f4d7-4a86-4638-a510-56dde867690f", "value": 20612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781080129, "uuid": "e1d24498-224d-4b5d-81ad-ce4e23d40493", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080129, "uuid": "a7f0b71d-f972-4d23-9f16-bb32c013ba22", "value": "HR_Employee_Performance_Report_May_2026.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f02f8f2-648d-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1781069484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781069484, "uuid": "047dff87-e496-4c6e-a50a-602710b481f2", "comment": "Malware payload (MassLogger)", "value": "9405d8e15f1dd435c25eed2b968296ad", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781069484, "uuid": "1ebe8eb3-34c6-427c-9ebc-79dee7161df4", "comment": "Malware payload (MassLogger)", "value": "78c375d37aeceb5da37845f1f9a499c7a17390f686fe1ff7895cff41931e9ef3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781069484, "uuid": "642ec75a-b221-416b-bb02-b1efcab818b8", "comment": "Malware payload (MassLogger)", "value": "e03406577242dd04b03b7685d73c8faf2d93f09f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781069484, "uuid": "a2fd5e23-c0ee-4049-9904-697d19136f14", "comment": "Malware payload (MassLogger)", "value": "05eb8103291b0ac1dddcbff002e9c41bba0ed045855618dba93415bbafebb7fad0bb19b5b040d0a621c36b93720ff410", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781069484, "uuid": "d950fa08-370e-44ab-abe8-068ae85e45b4", "value": "T18805D53DCE14412FE972C629C8A9449FF485659B222CED4790CB2F5FAE7288277C325D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781069484, "uuid": "96970d24-bc2f-4024-a1ab-ff9d714da913", "value": "3072:uUX+yHAquZ6rsISlbmGxyBesOzlvqriT8DZCkWZOO82qi/fffsS7v7MZPARChYjo:R+yCpY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781069484, "uuid": "5796a314-dc51-4014-bdd5-f96db184fbff", "value": 798932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781069484, "uuid": "f55d3f88-2f4f-42ff-808f-988adefc54ae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781069484, "uuid": "279edc68-4005-4b1d-921e-4abddfb0ef6e", "value": "Inquiry.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da69770f-6509-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781122841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781122841, "uuid": "de3126bb-85a1-41eb-b522-2d0421d576ed", "comment": "Malware payload (Mirai)", "value": "ecbe31e7aebd0b9faa0e29992c470fdb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781122841, "uuid": "e4f8f972-cd98-4eba-9a49-a8c63c6bcfbd", "comment": "Malware payload (Mirai)", "value": "7921be00bea5816a6a4075bd22a66433af01235b01515de033ac78b09a7d6c9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781122841, "uuid": "dc999bcb-0623-45f7-8946-a47847f34b6c", "comment": "Malware payload (Mirai)", "value": "22259a24eb6ebe06da153f5fd9f61b093c2bd2ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781122841, "uuid": "7aa90013-5ff0-4bef-94a7-2481ef225361", "comment": "Malware payload (Mirai)", "value": "e3d041281ed0e79118f927a6733368de837e81865bedb1ce3480addb8d007f65142592a02633de1e9dbd21e7c8b955e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781122841, "uuid": "069828ab-0d08-46c6-b4fb-3a2a099477c0", "value": "T1D7936CC4F243D5F5EC5301B1A137F7375B32F0A6112AEA53D3699936ECA2501E60ABAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781122841, "uuid": "ba65bd02-46b7-4ebf-924f-61530095ba2e", "value": "1536:kO5RYspvBzglf8rH1mHQfKSj1cTdpMV6kgp/BfF+SUJIVpo:kKRYspvBzgl0rHcHQf3j1Y3Mgko/LnDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781122841, "uuid": "d182cce9-4b73-4cec-94b4-ae0bb7601cac", "value": 93032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781122841, "uuid": "96e2bc76-fbe6-4349-90d6-e9a729a28ab2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781122841, "uuid": "141b43f7-6bb2-4578-9f70-fe89bea668b7", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "510b86ef-648f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781070212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781070212, "uuid": "2371501b-d662-450d-ba73-ed25d1f07519", "comment": "Malware payload", "value": "ed2dc8ed5482529e67f2275ba54029d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781070212, "uuid": "7bf29bc9-0e9d-4935-8e8e-a47cc6a2c926", "comment": "Malware payload", "value": "7960cddfdd122783e9eb4b2480a7d6881cf747f9a31eaf733bacba6a37893549", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781070212, "uuid": "422f1736-a72e-4375-8ff3-f232cbbfc8a6", "comment": "Malware payload", "value": "13ac4779f06158019055a89270cf0726178106b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781070212, "uuid": "9b2ef1a6-9601-4aa9-aa96-92531e2ecb31", "comment": "Malware payload", "value": "81743a5cc30fcd71e391dfdb494cb520eac17c4d1e16653a71b3e06b723db4babca32fb597864acbbcc0c50242b21d84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781070212, "uuid": "c21e5e99-c00c-48cb-b685-1ecec0d3f522", "value": "T173863A137B29EB0EC62920341CB2CA942B691C9642D7911BB345F30DF9F21BD59AECF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781070212, "uuid": "b4c0389d-724d-4f54-8338-bac79a234ed4", "value": "49152:xRyv1A5I5XqFNvT2qWzeR++wV94Y+V9v4/QXRrb1U+i3tVYVOxE9WRYt4Y2nDy+V:Cvp9ddLRYt4hDiuED+CUnUjEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781070212, "uuid": "11f7bc36-f7a1-4ad4-a1a0-de185d743fe8", "value": 8126679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781070212, "uuid": "22ff08b6-9da7-4b40-b015-68018bd04172", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781070212, "uuid": "ea00c1df-75bc-46a3-bc07-20ff7b1311bb", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75672250-6491-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781071132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071132, "uuid": "fb30d13a-863e-4589-8459-2767261b7f50", "comment": "Malware payload", "value": "23cb8d79d189c9e6869949a4585e5285", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071132, "uuid": "53bb1bb3-4e70-4d9c-87b3-9977ccb3478f", "comment": "Malware payload", "value": "798f233120b47f6a87cc294e03f8f21090d34983cb1e2c410e224973941fe4ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071132, "uuid": "ffd0b04e-b7c0-4bf2-8bc6-7df8228de06e", "comment": "Malware payload", "value": "2d5fd1fea2b93344e2f6989f1ec757065feb00f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071132, "uuid": "02552a05-e0f6-4526-aefd-4d47dc3779ba", "comment": "Malware payload", "value": "1e0bae473dd1c7739021e1ff7664ec4c0cc8e19bdb8263e8940b2241c50f697debfe0be9ead3e0df57891da91d14c31c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071132, "uuid": "fcacaa9b-4126-44bf-9efd-ba42a367e3ab", "value": "T1D0F57C2666E986ECD077D2BCAB164D12DEB2380503756CEF07D088754E77EE05E3A3A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071132, "uuid": "a5fcee15-086a-4ea9-a4fa-baefdd4b8090", "value": "4df683c3b0f76d1276210282e03a483e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071132, "uuid": "78ec9a02-4006-4660-b102-2719fd690d49", "value": "49152:qxChudhykoTNayIW9oKWM3DGgiFPNnZHKm138r3TPVUVTRNB5A:rhsWo91n9ajVUhw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781071132, "uuid": "97b8ddc4-de43-4f70-a4ca-e17a80d3f9ff", "value": 3372048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781071132, "uuid": "f0a710ef-72f7-4296-89eb-2aa846a2ab29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071132, "uuid": "e05f4b4a-6f77-4a8a-b8f0-c30d5311da5a", "value": "23cb8d79d189c9e6869949a4585e5285.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ab6c42-64aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781081684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781081684, "uuid": "9495292f-32d4-432f-8744-868cca1a043a", "comment": "Malware payload (Mirai)", "value": "33ff57236952c64444fa362109c5020e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781081684, "uuid": "3db5c81e-9ca6-458d-a51c-7bb4954635fd", "comment": "Malware payload (Mirai)", "value": "79a9001092f67e9c55da026f7d5bab586ab984b9199537e379101eb145884077", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781081684, "uuid": "758e1a75-c4ef-4348-b774-9db47cb088f2", "comment": "Malware payload (Mirai)", "value": "72e5c42b9ca8f5914bd5f61476b3197f8d5df8da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781081684, "uuid": "3217fb4f-1196-429b-b183-d0d256d150fb", "comment": "Malware payload (Mirai)", "value": "f119d268382c7845ddc66de29faeaae6835c10f6cf74fff36492b543bf732dc01c04f6e08100f4dd0f0407fafc1be9c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781081684, "uuid": "d885f229-0af9-4a0b-b7b3-3c54f2ee90f8", "value": "T1D1734AC5BB83D0F6FD8305F6603BD7728773E42A2055EA41C7299836DE92815A71B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781081684, "uuid": "bc972f05-8843-4980-9133-264c4e55fd59", "value": "768:6qSi9EGd0YhoJD2L0zVVNZjs4xuOnvh8r41CsxjhSE2R9fBUWyjiIHO:qUd3oJD2YQ4QOvkj2lSHB+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781081684, "uuid": "f5ae792c-c463-4e59-9a08-c88651526484", "value": 76008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781081684, "uuid": "8190e7ce-23ab-420e-ac9f-6d92c149cdf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781081684, "uuid": "07203e65-c4f2-42e1-9bf2-a722de433928", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea500a2-64a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1781077456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077456, "uuid": "d4f6f90f-245d-4c73-9732-9f57358077a4", "comment": "Malware payload (Prometei)", "value": "f5ea455319be942b684d69186afc0b8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077456, "uuid": "d758d58a-34c4-4347-aa57-6fc4f92ecff7", "comment": "Malware payload (Prometei)", "value": "7a2de7d67a4405f6375497d40c0b225c545bf44a252a505e5a0cb610c34848d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077456, "uuid": "a3bb25f2-7756-454a-9f48-c66e085deb3a", "comment": "Malware payload (Prometei)", "value": "c10f704474eb0ac594b145fbb36abc6340ac629f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077456, "uuid": "cc71d723-4400-4d85-a6ae-e1c5af9a4b7d", "comment": "Malware payload (Prometei)", "value": "b8b9fc3ce421ffb7471756ad566d484752d1ae0797e8a04556e7e4258fcd04daea292224c46c32180310c3bc22e787ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077456, "uuid": "20991f0b-1e80-41a3-bc13-3105aa865f4b", "value": "T1ABA423B4F9219E9F6DD769B91B24831DE181C172689D4C2313AE94A34F3D732AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077456, "uuid": "59a0ece5-6cfb-4a4e-93c7-1cbb1501a450", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdH:Fs6pyCC/Ya2hpi6T6N41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781077456, "uuid": "2e912965-f361-4a27-935b-47444bfac213", "value": 449087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781077456, "uuid": "a817ac9b-3583-4762-99de-7393e9b28160", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077456, "uuid": "8ca6cff9-13c9-4a19-a2dd-dc868e54ea7e", "value": "7a2de7d67a4405f6375497d40c0b225c545bf44a252a505e5a0cb610c34848d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53505c95-64a4-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781079236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079236, "uuid": "d72106d1-1ea9-4c5f-8b73-58e1e958a3a2", "comment": "Malware payload (AgentTesla)", "value": "c433e8c96f1d2aeee9b2db5b4551f29e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079236, "uuid": "c69bdb54-cda7-4353-84f7-3d4c0cb9b404", "comment": "Malware payload (AgentTesla)", "value": "7a48766df7441a83b64c58167443a3c6f7312e6c12d83ab47081e3adbcafa74a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079236, "uuid": "1f0b044e-8bc1-401a-b3c0-4d73529e9b02", "comment": "Malware payload (AgentTesla)", "value": "ca1a95c395b854326323cd73c901707ce4110e04", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079236, "uuid": "4652d58b-24ed-4170-990c-e314389e2801", "comment": "Malware payload (AgentTesla)", "value": "302697fed842f5d43cddf14368562b15597a13de013004b52c4469ce99120d44c6d8de2a5ff5de837ad7f4aee467b635", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079236, "uuid": "cce558ce-6ff2-4cad-bf48-a95c3d446c0c", "value": "T1997653700758D671C2985EA32A997158140D8DCF98F9BB027A6F87F502BB832E37B771", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079236, "uuid": "ba055061-f3c0-44dc-8886-b0d160671b0e", "value": "98304:elbl+TFTw+/xmAb0hKB9DYlCs+YoRANS850eJmdm+L576hyOuhoBOBaGi99a:nw40MDYHNtGeJQmC5+hyOuhO069a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079236, "uuid": "a5df2e8b-b818-4dd0-85a3-a642f966d6a3", "value": 7198846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079236, "uuid": "2db65a9f-ae9b-4e45-9181-9ba4b29b8cbc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079236, "uuid": "809c658b-7719-4228-9327-c441cd968ea1", "value": "Advice Ref.G91222721471.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c4b618-64af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781084129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084129, "uuid": "d1c8e39f-0f1c-497a-b485-16b77d714759", "comment": "Malware payload", "value": "554f3ca6879442be48844f54a1ae76d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084129, "uuid": "9f0c787c-b191-4fe2-8953-38d4a4071ed9", "comment": "Malware payload", "value": "7a5a727d377820868b2f332617991e6ff20d961e63cce609827bdb3f235f4d3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084129, "uuid": "2c47687d-f839-4ec0-952a-415ec013e33a", "comment": "Malware payload", "value": "407e0d54c35da83c15428da0e87a1f0afc968dbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084129, "uuid": "f77e74a5-10e3-48e2-a60b-f4d5f091e75a", "comment": "Malware payload", "value": "dcdcf7dca3cecdff1ee016fd5fe213d619de65970b8c8e36a348bdc741f1a9b818f3f6ea47223d1ba234dd7c61c5cb2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084129, "uuid": "3679ddf6-4969-4d7a-8d86-37cbb88b285c", "value": "T17A0833993BC06884E89C93BB538ECD3DAD19792DD64600CA97644C671D1F2E8CE7FE60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084129, "uuid": "176f352e-1222-49a4-998b-f5e4d9a6b85d", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084129, "uuid": "7649b6fe-c583-4647-9d16-d24fb1d07e02", "value": "1572864:5wSEdEWkWrzbWm6/LjZwV1JMjZAxH0R51gqTcaNH21A/0iIyK4cNhZG9luT/Q3:5rEdEWkMzbWtLFwbRH0R5L7lx2/4cb8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781084129, "uuid": "2f29fdc5-f7c3-4f94-bc6e-a4d636ee161a", "value": 83665204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781084129, "uuid": "bf091792-245b-434c-8c1f-accd9da79304", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084129, "uuid": "1582e38b-daf9-45d4-a147-2f9a97a67022", "value": "mullvad-crack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f57eb2c-6493-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1781072008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072008, "uuid": "7896fdaf-4142-498c-88ed-83424d05bec3", "comment": "Malware payload (SalatStealer)", "value": "65f844130c1325fff79bd453e481cb16", "object_relation": "md5", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072008, "uuid": "8e9d95c8-1642-4629-bf52-e8ea8f8dca52", "comment": "Malware payload (SalatStealer)", "value": "7a9c9837e5475c25b5406c4b5509ab51f6ab4c43d92eaea435641f7485ae7f99", "object_relation": "sha256", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072008, "uuid": "c776612b-8b1e-48ad-a4c3-cb02a98719d9", "comment": "Malware payload (SalatStealer)", "value": "8f35c877c008c052f01ec5540ee4200b02c72ed3", "object_relation": "sha1", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072008, "uuid": "2c748741-9ec2-46f6-8155-222c7c45cd5d", "comment": "Malware payload (SalatStealer)", "value": "3f2b59e73ee39aa09b83d463add02000831b2b2edb7e0d6ed1391c0e606f6a63de8ba60b9251e1774b1db506c3a53a31", "object_relation": "sha3-384", "Tag": [ { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072008, "uuid": "7e71430e-afa5-4fb5-91db-0def872ac91d", "value": "T12DF53361E2190422E0D3BB73897B27B4428D6BC3A45F7B035CE10759CFEA71816E96B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072008, "uuid": "546c72d7-bf03-464b-8dfa-9af770e95f0e", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072008, "uuid": "02dd13c9-ec79-4004-b7bb-f39c8f4dd3d2", "value": "98304:56OsO+lUFgdqvDb0qa2g8M7FHpeSrfwpgeaIGE:56Ob+SFgdpTt80ESrfsgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072008, "uuid": "94ea6074-04cf-4e1a-9728-2f09cad8b15f", "value": 3595264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072008, "uuid": "e989dc03-6407-4c39-977c-46e62f976041", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072008, "uuid": "fa5a20b0-7e94-40a0-9687-5f90ec164153", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8314b072-64cc-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1781096496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096496, "uuid": "7adfd255-c776-484d-80c7-4c6d367aa08f", "comment": "Malware payload (BlackMatter)", "value": "0478b4bf917832fc347fd4868c3f3542", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096496, "uuid": "960497a0-ee43-415b-acf7-1736ee4c3706", "comment": "Malware payload (BlackMatter)", "value": "7ac9fb3016067239ef2215fa65d2b82346a061fdb6f385e513f07c35936a4476", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096496, "uuid": "2e3c1565-bdd1-4d2d-8825-49a3d31bd291", "comment": "Malware payload (BlackMatter)", "value": "94970f53f6ac5d6ddbea52b35105ff7799e60078", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096496, "uuid": "77754ff6-c3d5-46d8-977b-e953ddb1b293", "comment": "Malware payload (BlackMatter)", "value": "ca14aca54a32e03c1a7ae0efc3d9ef7e263464288b8b2c33a25b07304b40673781e0cf36fc8023f1d55aa95e6c172e67", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096496, "uuid": "95854d4c-08a2-4b89-9799-d1196c1ffd3e", "value": "T165E36D21B212D0B3C83718F13736B571F39E8E2C19A56847E6D80F9DBCA58236F45A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096496, "uuid": "09435174-f4ae-43f3-9bb2-7a167b34de31", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096496, "uuid": "fcba1f7a-4838-4982-8a59-f81f7c0534b6", "value": "3072:s6glyuxE4GsUPnliByocWepipzSB6cwHD8ESSR+wfiPCjg:s6gDBGpvEByocWessjeAESQFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096496, "uuid": "520f7348-fb60-4fb9-9e97-438a9a68d3c9", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096496, "uuid": "0e48cf05-e18a-4f5a-bfe6-e76c7423d60d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096496, "uuid": "1e189dc6-54e8-4c09-8a48-50b4f4dd3583", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308202fc-64b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1781086479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781086479, "uuid": "a92f20a9-eb90-4706-b309-b5a3754c33eb", "comment": "Malware payload (Prometei)", "value": "38e39e77872cbc9a7f10132fcc74bd98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781086479, "uuid": "48a014cf-dd0b-4e10-a065-590a66d86339", "comment": "Malware payload (Prometei)", "value": "7b1a94c7e5dc71a25b5fd7992793977ac034c3279fb4b30ba834597cda33e41a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781086479, "uuid": "64beda15-6f2b-498c-9758-ebfa421d7d37", "comment": "Malware payload (Prometei)", "value": "a909eb5de613e961f72a0696a185c77f3b48e908", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781086479, "uuid": "2e454f13-05bd-4ce4-a93d-e6f0248ac16b", "comment": "Malware payload (Prometei)", "value": "fb4866f5cec97bbea7fb91f06cfe776094149b9f696fa38c226bc51bb3f40f50d0a9358088de9275ce7216ea56fe9e6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781086479, "uuid": "522db165-c7c0-4999-ac9a-9a533d936dac", "value": "T19D967C73945224D8E1A9C9B4D51416527DB83C8B573873CBBAC472F61BBABE48E78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781086479, "uuid": "f05500cb-dfcc-45f2-9302-6937b23a05e8", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ3:cqYUQuVDt0TZE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781086479, "uuid": "9873fcb8-0d96-4f4a-9c89-fb85984f732b", "value": 8880128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781086479, "uuid": "fca73ed1-7d13-4165-9ccd-ede8e7be83ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781086479, "uuid": "f50d4ca5-fb9c-415d-90d0-4f6769867e99", "value": "7b1a94c7e5dc71a25b5fd7992793977ac034c3279fb4b30ba834597cda33e41a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3794e22d-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781108824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108824, "uuid": "573f2248-9818-4f12-8be5-ac185e72b185", "comment": "Malware payload (Formbook)", "value": "956d58ca4bfb91daf717e38de048e30d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108824, "uuid": "37ae5cb3-f958-43a3-90d5-a52966e0fc40", "comment": "Malware payload (Formbook)", "value": "7b1e8b201a6cd8f1ea47de52357ba169078c6ea77a84d496e1370629c3157d7e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108824, "uuid": "d4482aed-57a5-4a8a-b087-9e9a8b9fa6c9", "comment": "Malware payload (Formbook)", "value": "cb5a8acf6011a5957ba036e0dbb3e32a46196bb2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108824, "uuid": "aaf22b5a-9aa4-4829-87ea-55aa86379a06", "comment": "Malware payload (Formbook)", "value": "fc28cbe184855cf4c21230b4293c042b6d226ae22399e1873320204b5b3108e14ab595a85261878a5c64d4bcd607f696", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108824, "uuid": "654aa6d8-ea64-4768-9768-44ccee7941b9", "value": "T1C5E55C17D66F974D180E3B61106A5D9AFE89CAFCEF726BC4E08F90B210EE1110B855B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108824, "uuid": "ce61a886-eda0-482c-8e0a-6bf511cfbdd2", "value": "49152:u3bsm/jbMa80fNc18ilnoW3nYkQIGiwEk1AKf/DnDEpv1fze0pDjIu4No:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108824, "uuid": "0bca6f53-2acf-4d77-b61e-f9ba88bf2ca0", "value": 3146916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108824, "uuid": "cd4b1105-94e9-4a8d-b7f4-c5e834b405e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108824, "uuid": "37a0eb04-644e-4973-832a-62b0910aec79", "value": "Nostro Ordine 264418 PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df769b6d-64b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Jigsaw)", "timestamp": 1781087631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087631, "uuid": "26a265a5-0ae4-48e6-b374-5846c972de0e", "comment": "Malware payload (Jigsaw)", "value": "a4c410b6ac9a5a3436e2b71db4fd849d", "object_relation": "md5", "Tag": [ { "name": "Jigsaw", "colour": "#348701", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087631, "uuid": "318a213a-f4ba-400b-b465-1e1c1c97785a", "comment": "Malware payload (Jigsaw)", "value": "7b2314d6af6b3df7723dbd88439b29fb990e8133cba441c76b9683b68a5adfd1", "object_relation": "sha256", "Tag": [ { "name": "Jigsaw", "colour": "#348701", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087631, "uuid": "ad0426db-3fb0-4ffb-aa64-db796092da97", "comment": "Malware payload (Jigsaw)", "value": "7f85e3c4c5b00b1365d22277cb5de8f413c06637", "object_relation": "sha1", "Tag": [ { "name": "Jigsaw", "colour": "#348701", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087631, "uuid": "d13ea174-e6a8-4ca4-a7cf-78224aa75e3c", "comment": "Malware payload (Jigsaw)", "value": "c1f0c1d3e7073bc82968c5e215c11c6b9e1a1841ea798eeaa700094d94cdc46d2da61ee86afd236a45a484cfcd7b2cdc", "object_relation": "sha3-384", "Tag": [ { "name": "Jigsaw", "colour": "#348701", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087631, "uuid": "c7dd65d0-12fb-4540-a57d-b028e9176af8", "value": "T15C536C05B3FC1753F3FA4FB96C759144077A795BE879D7AC0D88118E08E6B908A20BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087631, "uuid": "f1774a0a-bdc7-4716-a962-995aa7c3c6ea", "value": "768:qHmNjKqmrUHyq4XsipdphLOZuDZk2eK/Sw/RSIEALDTIZUY2QRT/b4I19Yi6WrGt:hmrUHSnpNIiIZUY1sIzYi7D10Py7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781087631, "uuid": "f6c853c5-e923-4e33-af12-3d2a4d0ac5ed", "value": 64000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781087631, "uuid": "37c09140-5858-41a0-b6a8-18f8be599db3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087631, "uuid": "bbad6d11-6f1f-4866-b7fd-af0a577db5d7", "value": "citrum.io_6dce400a_r_microsoft-edge.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f92d052-64a5-11f1-a769-42010a9c0008", "comment": "Malware payload (DiscordTokenStealer)", "timestamp": 1781079551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079551, "uuid": "4c97c8fe-1314-4675-9d31-feb900c6eb23", "comment": "Malware payload (DiscordTokenStealer)", "value": "3978420e17da384f62abd53c34c8d36c", "object_relation": "md5", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079551, "uuid": "3d344bca-d173-4cb5-9e4a-684fe7074e22", "comment": "Malware payload (DiscordTokenStealer)", "value": "7b94dd5269ed976687b8f7a8050ec2987019af43c2a761908a2404f061e3929c", "object_relation": "sha256", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079551, "uuid": "7a26c785-65d0-4dea-b1fc-977a07ff6da5", "comment": "Malware payload (DiscordTokenStealer)", "value": "b4b144d511da4bc0e20b304b47fea79b414920e2", "object_relation": "sha1", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079551, "uuid": "9f730aa0-ad7f-4d61-a9e1-9bbdbc33d28b", "comment": "Malware payload (DiscordTokenStealer)", "value": "0909a065b9a2e9e45911ceb16efdd19b077d62002d55465e9a9fe9fcc42869f4ea3cae83d8b170f53f59021a46efb5c6", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079551, "uuid": "9ed3639a-def3-484f-a79c-e01e9d41786a", "value": "T148C5275303851BBDF68D0EC9C94B255B20F2D4677D291298EBB36EEBBC3B9845430636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079551, "uuid": "fa63e67b-2dec-4099-b15f-d5bb65075723", "value": "1536:HqVGRWpNG540FXtWxh5y7U5JnutaUDKb8jSH53lgIHmBj3+huEppFAv4eaMWpHtq:n9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079551, "uuid": "ae057c34-d188-4bdd-b469-153f1a99d47c", "value": 2628305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079551, "uuid": "aa5456a4-355a-4ee2-993e-2a1f374185de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079551, "uuid": "e9f3b202-5824-4df6-be08-b60a03c17cfe", "value": "Vietcombank Bi\u00ean nh\u1eadn thanh to\u00e1n -.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e112a7f8-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105673, "uuid": "1dc165ed-9df2-47d6-9268-fbcf2b2702cb", "comment": "Malware payload (Mirai)", "value": "f985cbc9d0b975c4afdbd0a28214729c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105673, "uuid": "c681ce43-92fa-42f9-817a-12b4562bc37d", "comment": "Malware payload (Mirai)", "value": "7c28b2fae9535e197f062df46b241cf9772b6915a8996ede621e3826b74c1304", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105673, "uuid": "3b7126be-8d20-4e2d-ad66-b01e63cf6d62", "comment": "Malware payload (Mirai)", "value": "6c13a76b6b5bbdcee3a435dfad470653d0b0dc90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105673, "uuid": "0f2ce8a4-aba5-4aa9-8b64-0f1261c1b8b7", "comment": "Malware payload (Mirai)", "value": "4c3e8926e09da1c625938ec8676686b28a955d506c5d695c2febb528a2b375bc88ed20822a2e0ba456e84ea372e3916f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105673, "uuid": "61828ef8-cecf-446a-905b-36d96716f464", "value": "T1CB33F1227B2ADC56D220FC7BE7EE899B355513A4F9DCA8153DDC8C48B150182DFE4283", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105673, "uuid": "64b6456d-98f6-4fea-8915-38d59eea2b8f", "value": "1536:NPB0uIz2HfQQYYGSedJPmaWchPL15J6RN2tAJ:zcCrYYGS2JPmajZL1z6Rz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105673, "uuid": "b850a041-5602-4ef5-8305-3f30dad976f0", "value": 51424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105673, "uuid": "b1e5e89e-8585-41c5-bd2a-7161f23d7d84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105673, "uuid": "cc0c990a-8dea-4094-80b4-d3686a4270be", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7494afe-64a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781079403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079403, "uuid": "e95e17c0-80b6-457a-b9aa-b196000854e1", "comment": "Malware payload (Formbook)", "value": "c2e0839e88684932d704c92e08fcc379", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079403, "uuid": "f040fa8d-707f-48c7-b9f2-aa4843c9acfe", "comment": "Malware payload (Formbook)", "value": "7c34daec0cb3c3193962ccca3dbccdaaa02a808f1f24588303e11811dfce5694", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079403, "uuid": "fd9e612b-bd6e-426b-bfed-98612e05e1c1", "comment": "Malware payload (Formbook)", "value": "1fc4cdf049beeadb9487df3b8827275a6829b96c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079403, "uuid": "d7ff7890-1b1e-4837-8150-ec8913d16a04", "comment": "Malware payload (Formbook)", "value": "3371e7eae52ed7f111babcd54259ce13f9ce454581fef7f243896229f1d910d9fe311e225eb862715a806ab951786762", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079403, "uuid": "8dd95706-2839-4305-9069-c99410ffa36f", "value": "T150E56C17D66F974E18093B61106A5D9AFE89CAFCEF726BC4E0CF90B610EE1110B851B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079403, "uuid": "2598e76e-861c-4bda-9071-46ea3e12ace6", "value": "49152:v12iyY0uZwnrhHF7pXFJQpRj5dQ4GBPHtFVvrrHuvEj2kYUP8RS4+SfDEBmFsyPx:x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079403, "uuid": "3cd62da8-6089-46d0-af60-404ccb0bc2d1", "value": 3104675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079403, "uuid": "f040b810-85c8-4e69-881e-ac803da6e4d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079403, "uuid": "079d749e-c8bf-4d97-99df-a03be0c0aea6", "value": "PO_20931.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f542d56-64d5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781100328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100328, "uuid": "c1f9c493-a284-4517-bb3d-ef1ab591b828", "comment": "Malware payload (Mirai)", "value": "9fbc51dca95571abc7f1a84a1aeca535", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100328, "uuid": "e609eb93-de77-4c6a-ada8-f3c734912ac1", "comment": "Malware payload (Mirai)", "value": "7da672e7724059bee3484f18a98c387e7f1b16bf1df541d4ff7febfd5c798074", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100328, "uuid": "098590c3-a27c-4002-89f2-87ba0492678c", "comment": "Malware payload (Mirai)", "value": "bb238efbb4b483f50b1a30b85ffe98974ffc8077", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100328, "uuid": "864e1819-327a-461a-b3d4-e515742a2a00", "comment": "Malware payload (Mirai)", "value": "ac62e96e2c220f50c1fdb7a66b141cb81f08223465dd35ece72ef97d2c112082513356a1d83f1b233cc29cb1a3bd274e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100328, "uuid": "9f91486b-b9b6-4feb-9fa9-4cc3c5c12868", "value": "T10382C024F671A462DE301CB2E47D414E2BD94FBAF27A7132213986D977C394243F8A57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100328, "uuid": "f895bcf6-2e2c-4ea8-aaa6-bf11da6a415a", "value": "384:jpGP9gvt/jtREtICJKql95SFQFvoZ+bh7qmdGUEpiaV:c9gvJtentSFnZ+b9q3UELV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781100328, "uuid": "7c699ff6-7e35-447b-a875-6a94b9dfc2f3", "value": 17704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781100328, "uuid": "de7513af-ba63-4741-ad12-269af675c640", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100328, "uuid": "8fd1abab-8e13-4b0a-8ef2-02b4e950fce5", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a3ae4b8-64d5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781100185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100185, "uuid": "995d0221-688c-441a-85be-df1a95dee7ab", "comment": "Malware payload (Mirai)", "value": "986c22951bbfc94839f6e0d61489aa50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100185, "uuid": "c5e8309c-bb4f-4753-8e28-a5b4f3ec51ca", "comment": "Malware payload (Mirai)", "value": "7ddc9a36f94fd9d29889e2428286fbc8b0350f60bf35916718750b51ba45504b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100185, "uuid": "869caf2f-3b9b-4e71-9671-48e6180111de", "comment": "Malware payload (Mirai)", "value": "04b2326f524e08ac46bf38110dc838a3009e706d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100185, "uuid": "7dce73b7-0f1d-4c7c-af94-254d1922577f", "comment": "Malware payload (Mirai)", "value": "f6532978b86c6593f680a824c5ffe25b0631e293c539f198a103316986db327c3bc45e37960baa776c90013c562d8a31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100185, "uuid": "89b75daf-6b61-4a6d-8211-8ec6b7fde8d4", "value": "T16C835BC5DAC7D8F6EC12097510BABF3A9AB3D63E21A8DB43D798D935E813501E90364C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100185, "uuid": "fe2bfcf6-3f7f-412c-bb1f-4a97bcdec238", "value": "1536:SS+yasI67+oQ6NpDCkKdqQjzZlFYkkxnyzcXzskKGSulSj:SS+pz6SoFjlWq8z7FVkx6izlSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781100185, "uuid": "7c4cc8f5-5cd2-4b20-b259-d1d1ca6ba9ad", "value": 82868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781100185, "uuid": "75b21b47-1652-4dfe-91d7-e8e96253e978", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100185, "uuid": "0a032780-b79b-4ba6-b443-29c0160236df", "value": "ytaabxcxa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8602805e-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105520, "uuid": "b5cdeba1-c784-4d0e-8c6a-cb91e614814a", "comment": "Malware payload (Mirai)", "value": "977183cd88fdca3b2cbe4324f3a28059", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105520, "uuid": "83a0ff44-8bee-4a58-960f-44cedf2bf008", "comment": "Malware payload (Mirai)", "value": "7e19ef0fa3c171d601ddc8f45606ed43c14aee3c264cc0dd1e689d4cc1c03ea8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105520, "uuid": "5d2fdf4c-9daa-43a2-9498-13e4b9ac946b", "comment": "Malware payload (Mirai)", "value": "5c42005a9139e63bd583391cfdba2a78df9a09da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105520, "uuid": "3bcaf7d9-bd0f-4514-9db3-393f423128d2", "comment": "Malware payload (Mirai)", "value": "163d54e88b1c737519fa8a154071e43cf4b26cb824a6eb78b8e3482d33e06222dc4190f0b86bc01f61c4191968d4dad7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105520, "uuid": "3c00e44a-8613-406e-b1ef-999a1fbc08a7", "value": "T1BD335B22A8791E17C0D0F47A62F78729B2F50B4F24A88B1E7D620F4EFF219D0555B1B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105520, "uuid": "afd68715-90e6-4bc9-8c5e-18dcc14e62ad", "value": "768:+JuoUU7ORLbq9U7s+36L8QFC19H20l7448JceO+hjC6mFmM:EutsORLbSU7sA6L8ymh20Jsh2p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105520, "uuid": "c3d9966f-c285-486e-a6b6-26c260993a3d", "value": 54804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105520, "uuid": "233d286a-db9b-4f0e-9716-dbb11369da9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105520, "uuid": "53f866d2-1a6f-4a38-8794-55b419cd6716", "value": "miraint.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96436265-651a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781130028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781130028, "uuid": "82a27929-c2ad-416c-af82-18c90eed9cc4", "comment": "Malware payload (Mirai)", "value": "6b804d9388f6642777757e3dcd33169d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781130028, "uuid": "a5b67f48-1f21-4150-b463-08a800bd5598", "comment": "Malware payload (Mirai)", "value": "7eddabda8909656fdf9e9c8cbafa2b7b30b32461fdb735c81597e3168ce8e415", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781130028, "uuid": "cc69d387-b765-441e-91f1-4e3e856ef30c", "comment": "Malware payload (Mirai)", "value": "aa8d77b0f948ceb084642239a243b68c3cb0bc55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781130028, "uuid": "c5a78554-1981-4aa4-a4e6-64235b3c1266", "comment": "Malware payload (Mirai)", "value": "aa38e89c4ebdfd5874c2ef514d1e878308a35f3d39919cabeb05c638f29c64296155e44003a498bb91511f3c71f8c6c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781130028, "uuid": "de76cbd1-7151-4ad3-bc55-06b1d84b58d7", "value": "T1E2F31887F900DEFAF84AE736445308057130BBA258915A376267393FED3F1990977E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781130028, "uuid": "b114beb1-00ef-4568-9cf9-1c3f04aadfd0", "value": "3072:ih6lIbOGi6l48sHxz6eYs5jVTjbitLy/eZL5WYSGlj36y6Fy+k:66lpGQxz2s58Lym1d0y6c+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781130028, "uuid": "61b3e24b-3b84-49e2-8614-f8b2b21d5fd3", "value": 160748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781130028, "uuid": "d61c5245-6eea-4a13-ac2d-8cdb7ca98809", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781130028, "uuid": "ca863eee-0c8c-4021-aa81-de97cc71c035", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba21649-64b4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781086041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781086041, "uuid": "da590446-2978-4546-b4ce-74e1dacecd88", "comment": "Malware payload (Mirai)", "value": "b466e1572908ad6db24d5aa0ed607d1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781086041, "uuid": "bc26a338-b8b0-4310-9c0e-12ab9d77cc8d", "comment": "Malware payload (Mirai)", "value": "7ee06981b595706dded876239d120738a50d4509176eb07ce94f05fd8310addc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781086041, "uuid": "007b41bb-595d-4dfd-aeaa-3aec23670c1b", "comment": "Malware payload (Mirai)", "value": "dc6e446c7df8cda9f37d0981ec0dde84c8e65da4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781086041, "uuid": "a49160b3-365d-4739-8934-12e443e4107c", "comment": "Malware payload (Mirai)", "value": "6c78b4553787c756b328e827428995bd654696b3b4396e32602b8f0e64785fca1700e5bf5c5d23c68786345fe124c048", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781086041, "uuid": "72ca90ac-44af-4ad3-bee1-c4ab992ebf6a", "value": "T15E54F759BE419F17C5D216F7FBAE4298371A7BA8C6EE3103DC146F90379A48F0D2A241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781086041, "uuid": "11d85d00-4f5a-4465-b94f-41f900348f20", "value": "6144:jhQyKCBYnbnHQc8RZIf7n0iSrJZWU+yk31u4+37kOa0TpdieEl+lcrB:jhQbCBYnTQXg7n0iykl31u4+YFSiH+G1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781086041, "uuid": "a416eaf4-5876-4ded-8fb1-1d4c4ee0119b", "value": 287556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781086041, "uuid": "739b9c45-f547-468c-9b6c-cd53586dcac3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781086041, "uuid": "cf5dab01-1ada-4887-adfb-93e8e7b0534c", "value": "kworkerd-irq-bal", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "613319c1-64a6-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781080118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080118, "uuid": "5fd41346-8b2d-4065-9a76-6c1d3f9ae541", "comment": "Malware payload (RemcosRAT)", "value": "14b4d8c1f9f49ca5709d6fd849bd707f", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080118, "uuid": "21306b95-3bb2-4e7c-ad9d-0a34476ca668", "comment": "Malware payload (RemcosRAT)", "value": "7f0732cf9958e2cc11d689e97d1e81eed84d79acc0c025f3aab74e8d3cb44e4f", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080118, "uuid": "784c6f8d-e6c4-476a-9760-e736174315d0", "comment": "Malware payload (RemcosRAT)", "value": "be5e51e903754d01d8f4d69f87f67ce5f065ee94", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080118, "uuid": "028e0b81-4b4c-4e25-b3b3-24329fa0f3d5", "comment": "Malware payload (RemcosRAT)", "value": "d38db0fb895e7aebfb93cfc728f0e9fff81918f2169375d247325a3e715f2ad55a4f220ed22ef0600552911bf246859d", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080118, "uuid": "aee487df-8b2f-47cb-bbe3-8f118b399a95", "value": "T107A230E0D6860B65EE87163EDCD03620BBA9FFF0513904D5F9E59348A40E6687B24ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080118, "uuid": "c8d239d3-0143-4690-b25e-581ceb58f14f", "value": "384:SqD4ASbAumBBecMiE6mFYLMqjD93u5sOvdC:SqsbBmPexiE6mFYa4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781080118, "uuid": "6fbf851d-3087-4644-8814-bc5f98bf84e0", "value": 22121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781080118, "uuid": "c44b3145-ddbb-4af5-84bd-e5a235da5735", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080118, "uuid": "71116a3e-40cf-460d-b54c-30370c54959c", "value": "Proforma invoice.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a22d0b-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781108799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108799, "uuid": "1a413ab8-a61d-48de-ae94-95d251dd9ecd", "comment": "Malware payload", "value": "6760021ceb30353b755d5c11f9e18e66", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108799, "uuid": "53ba70e1-8951-4655-a3c3-7b4cbbcac054", "comment": "Malware payload", "value": "7fb6e0137f83efce84879aa1a397045e2f4d7f31882ef1de85d94ed8e0a0f9d6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108799, "uuid": "6c15c9ee-3075-4b12-a84b-4ce8d7993dab", "comment": "Malware payload", "value": "896d65de5da250b37706a3d93c1d54d9c7ab9eb0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108799, "uuid": "ac017a42-d1d8-4343-a420-a1d944e2a1db", "comment": "Malware payload", "value": "fc3b074b40fe2fd3e86a776e5df00cf74434fd3d60f8e726d6294eda2129f8d7833d57e4ab19cecb665b70a5b71186d7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108799, "uuid": "ffbb18e7-a2ff-4b1a-9dfc-ee507ae06b38", "value": "T135F4083DCE18412EE532D629C899095FF882065B222CEA4750D77B9FBEB348273D725D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108799, "uuid": "11d0701f-ea8b-4d78-a314-d15d26a1c5be", "value": "3072:TZ5WMjgC7IXGqH3PiNi+JO/ykCXUqBCOJT4SmhGVcU0+XGhVSqxXo0pJVQ0hVVIH:RlF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108799, "uuid": "3bba6238-62c2-4b9a-bdfd-44c74c0fdde5", "value": 789814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108799, "uuid": "c9bc6eee-cc5f-477f-8a7e-180becb12b9a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108799, "uuid": "c60684e9-088a-48d7-89d4-9102554ac838", "value": "Payment 09-06-2026.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d01d763-64cc-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1781096485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096485, "uuid": "f1213b9f-e2db-487a-8bb2-00a39ed8a46a", "comment": "Malware payload (BlackMatter)", "value": "66f1f3ac6b40172aab014280b821ea10", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096485, "uuid": "9ace1510-06a8-48dd-add4-93a1f4a73aaa", "comment": "Malware payload (BlackMatter)", "value": "7fc9ae64edb1864290156397d1baad0b56ce110623b73cd4d8c2b15ead3cdb07", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096485, "uuid": "50640b5a-20c0-4766-afe1-33232e0168bf", "comment": "Malware payload (BlackMatter)", "value": "4417f476ffb2baa60085a028c7095ce07bba6a1c", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096485, "uuid": "2f0b93c5-dad5-4c7a-8cc4-ed6c51942534", "comment": "Malware payload (BlackMatter)", "value": "44b3cce3ac7307bb3eb7fe5fbf5a9631d9ca9a23d6839133bfc9bae926156993671549fd5df57e51a63b0e3fa74ddc80", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096485, "uuid": "4f655ca9-de33-4144-988d-640941d15f5c", "value": "T1D8E36E21F222D0B3C83718F1373675B2F3DA8D2C19956817EAE90F59BCA58136F05A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096485, "uuid": "9338c568-6e11-4623-89ea-ac2fea7a2e0e", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096485, "uuid": "39252cff-4770-4e02-ac9c-7674e8d810c1", "value": "3072:Q6glyuxE4GsUPnliByocWepyH1QfD1AV:Q6gDBGpvEByocWel6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096485, "uuid": "05b3a277-10c1-43e9-9596-e71a22a1a43b", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096485, "uuid": "1a4417ef-5ba1-4eab-9054-027f8ff37636", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096485, "uuid": "ae357032-f934-4f61-afc2-508835f13910", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe891f0d-64b3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781085965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085965, "uuid": "f714227e-e00a-4774-b906-a557ca7840d1", "comment": "Malware payload (Mirai)", "value": "edf5c79925c5d35a62ea5201ba4ff5ba", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085965, "uuid": "443751e0-8bcc-4772-a8ff-68c9845e14bd", "comment": "Malware payload (Mirai)", "value": "7fe0b6835fb674d445dc9255fad274afeee1b72ad30f1964eb8607518292968a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085965, "uuid": "00690615-eb9f-4bdc-8377-cf99e171272b", "comment": "Malware payload (Mirai)", "value": "e12ca94729342bec2024ef02c0142ddc78478052", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085965, "uuid": "522564f1-709a-483d-8183-34fec23af8eb", "comment": "Malware payload (Mirai)", "value": "159b242d74fc500d5cc059ad70c31d98d1c479a3e53ba993dddd019f14628bc4956f164987d773e18a9f6eb18ff38bc6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085965, "uuid": "77b1914c-19e5-4111-9b74-3680bb3f66db", "value": "T102448D23ED329F56C022A5F471F2CF380F12BD2A49471E9995B6E9F88183DC8B506378", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085965, "uuid": "f7d69e18-2ec7-44d2-8782-2ee5d56e0986", "value": "6144:WmA2/kQDsD0Ts0R5ZYRcbaL7kEiyc9cV:WZ28QDsD0TpYRcbOkpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781085965, "uuid": "f2876fab-1e47-48bd-b478-7711808fa2ae", "value": 254228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781085965, "uuid": "238a3206-e615-4e73-a4eb-27d7d0ed8b5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085965, "uuid": "16fde5c8-9868-4175-8f2c-a03670113a6e", "value": "kworkerd-crypto", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f89fdd9-64cc-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781096490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096490, "uuid": "7c017467-d993-4da3-ab86-0c6b45ab4a55", "comment": "Malware payload (RemcosRAT)", "value": "297d24ec5799d252de733d69ccba12c1", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096490, "uuid": "d8a2be4b-f310-421c-831d-9e79802f103b", "comment": "Malware payload (RemcosRAT)", "value": "80430acaab8075a437bd66d3b005c66d5d30b5f17af970bcedfb3bb08bbebe35", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096490, "uuid": "d065ca34-38fd-41b7-bb2f-d74f30846214", "comment": "Malware payload (RemcosRAT)", "value": "e76b2dcab3b1324162d332634c9d96cc98b793f3", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096490, "uuid": "0a9b9201-17bc-475a-8d17-7bb12eef2b4a", "comment": "Malware payload (RemcosRAT)", "value": "205b6a879b9b2c510672ba13eec9b0e6a8eedd12190b3984f7e137dda5376dd06609d5771ec904bd4a2d25abcd628e52", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096490, "uuid": "093da639-2dd4-410c-bc0f-7f3ba81c80a1", "value": "T15B41FC091BF50328E7B79B79ACBBB2114533BD21EE22DFDE0250019C18B0524E876F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096490, "uuid": "556971e2-1123-4fe2-a8c5-3edd38e0cb09", "value": "48:87znmLYFhh9L2WguX/V5yAWBpWAH07o6BcavVrq45Ne:87zn+WhM2vtYoAH07hcaVrqAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096490, "uuid": "d45ec107-d759-47bc-ba65-9d183bd26f31", "value": 2318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096490, "uuid": "a880cb65-da90-400c-8928-48a1dedad2e1", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096490, "uuid": "a248572a-d3ea-4f59-8705-a9d8139c6010", "value": "New Bank confirmation.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17eb1e56-64a4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781079136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079136, "uuid": "9028a2d0-f0a3-4822-9658-11d27c869e11", "comment": "Malware payload", "value": "935551b94c23ffc191177ed3f6935dfd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079136, "uuid": "4eb0f670-10be-4d13-b230-e11f64c18c23", "comment": "Malware payload", "value": "810d8a831912580577089dd786a29a6593e8bec6f06fdb09ad462a33e5890844", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079136, "uuid": "6c3960cc-2d9c-4fd4-bf8c-a30486d0fc54", "comment": "Malware payload", "value": "fdf5f510b1ba2ad7ee19aebff8f063e18f6b7a0e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079136, "uuid": "f35f738d-98b9-46b2-b35f-6d4877de7e02", "comment": "Malware payload", "value": "92a2361d4aeae987eb47d6a9fe1ed94b898d3ccc03aa0833254220cd8b87c0ae83ea4947b22d430400c66db3237beba1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079136, "uuid": "0d3e5b8f-159f-48da-8d22-78d28e4f452f", "value": "T14056A9AB6DEC361D3000B0C2F48521F5EA621335EBDE52D9F8F825327BFA49AC459746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079136, "uuid": "4f7a473c-658c-47f8-9976-5809d82167ae", "value": "6144:5170CygVOAf/uvR5OZ6HCN0PH5jtmjz3FhSU5APryouPdyDhfnmGtWZRVVaSu4xg:5R+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079136, "uuid": "36bf5f90-11d7-4cb7-b866-75f26c6cc3c9", "value": 6010613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079136, "uuid": "4e7106e0-9994-418f-a9f1-29a243571475", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079136, "uuid": "3635c9e5-db1b-4db3-b5b1-740023c6a55b", "value": "Update.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c2bb3b4-64d9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781101987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101987, "uuid": "830b02c6-ecf5-4d45-a5c2-192ee20a5e97", "comment": "Malware payload (Mirai)", "value": "4555dd0760a4fd016f923b3f06638675", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101987, "uuid": "6644c5ff-11fe-4d90-a16c-4b3bdacf57a0", "comment": "Malware payload (Mirai)", "value": "812b9a2acdda28b9155ed616a19777800786b9352f4825085da988973d72f84c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101987, "uuid": "6dca172e-cf4e-4afe-b6bc-a502a756545b", "comment": "Malware payload (Mirai)", "value": "645ce2815b258a1beca876caef1b0321abca74d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101987, "uuid": "aea16efb-fb68-4db1-9f84-d110da75e5b3", "comment": "Malware payload (Mirai)", "value": "02782e89afa884ef856a7a488ceac0a4bc672210bd4b99beebcf0fce128683b7374edc180cb50c47fbd53143b3d6eab1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101987, "uuid": "2b80333f-7323-4f4c-89a5-b644b1884eed", "value": "T10EC31885F8514B27C6C212B7FB8E438D7B2A17D8E3EE720399256F20379B55B0E3A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101987, "uuid": "534e6db1-311f-4836-86e5-b9366ccdf816", "value": "1536:H69w6/3mYmq62V5N4ViPaRSTXzFwFUnlSDtlqlwywQNWURtmbaeJ9XpHOFluvn+f:H6rTmq604QaADz6FiEka5Tn+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781101987, "uuid": "ba6df852-ad6e-4023-bc6c-9b91e194a3d6", "value": 118432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781101987, "uuid": "69be2413-fb7f-4a81-a421-d279f27f8da0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101987, "uuid": "61e894cb-5e11-4710-880d-c9ae618fbcb7", "value": "CRY.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20fdc4cc-6494-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781072279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072279, "uuid": "680acf6f-7593-4c02-bdd1-6e51c00c48fc", "comment": "Malware payload (ConnectWise)", "value": "d2265495f801b08dcf8c81e42289c5fa", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072279, "uuid": "73bb6a94-cd03-4dd0-84d9-f62ed26adc9b", "comment": "Malware payload (ConnectWise)", "value": "8149a13d59b22fa60563c2ada80f1139189c9414ca4c2faf0b4c797308a03d63", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072279, "uuid": "8ffcec3e-088d-4e28-99aa-1f7d1ef79481", "comment": "Malware payload (ConnectWise)", "value": "d512beca0bd778f2a64dfe31e0014abc0f221801", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072279, "uuid": "0416a248-1be4-4a96-a4c1-4d5490b56804", "comment": "Malware payload (ConnectWise)", "value": "e0278e56a4be7e45a6dd4b394d7c4584ef74f2a0e80dc20cba4c019ea3b5767e2cc6f63750bd6ed5bbfaf39af29884f2", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072279, "uuid": "ae62399f-af6b-494a-8ea6-f47611f74a79", "value": "T1D2646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072279, "uuid": "06562c9d-58e5-4af5-8a46-de3ff5546086", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072279, "uuid": "2ebda11f-97a6-4fb8-9729-732249206ceb", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:51iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072279, "uuid": "a2276f7a-8d3b-4eac-8ddd-70ef5c5fcc02", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072279, "uuid": "4fdc438f-c72f-4a67-9c61-9cd55d254dae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072279, "uuid": "f5de8e7e-5d3e-4949-8d0f-72459705acac", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca3ab9a4-64a5-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781079865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079865, "uuid": "984a214b-a6da-4276-a317-647e31cb65fe", "comment": "Malware payload (RemcosRAT)", "value": "c56dd162d5b9f0a4a2b365864df5db21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079865, "uuid": "68fe0a4f-8665-4349-8165-a7a8a46e29ab", "comment": "Malware payload (RemcosRAT)", "value": "8179cdb2ab4bc2968e9c92bea71e015cbaf79c582a52c6772fd853b61a702e72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079865, "uuid": "5e443412-0a77-467f-b1cb-27c498907cb1", "comment": "Malware payload (RemcosRAT)", "value": "51bb31dbebac1c91b98d5bdff5667c6038f99b81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079865, "uuid": "dfe5c052-420e-44d1-a80d-3a86f45c5c83", "comment": "Malware payload (RemcosRAT)", "value": "320465356768e99858a85af00cca22f0c9a34500724984def3c7d64d496e9502629cbbe846b3726937b7e86b0eb8d382", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079865, "uuid": "c22bb361-d49b-4884-a866-955d861dfe49", "value": "T1DC6512486A19DA07C95963784EB0F5B806AC6ED9B412C62A5FECEDEFBD37F040D04193", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079865, "uuid": "c72efa99-0be1-49a0-bdde-d120ea2b5cfd", "value": "24576:4YNkfKkQNgk9M0c/lYbWy50MDVPM6eO9l4DcN0OMOayGoKxr+:LN77D9MblYiyWMRQc279yGfN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079865, "uuid": "0e57c15c-be51-45de-9016-9e101b484eef", "value": 1472512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079865, "uuid": "080dc17d-a199-4a81-842c-e551f3604524", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079865, "uuid": "d2d04aa4-5099-419a-bd15-5e7db1f18637", "value": "INV PKG - S\u8302\u9060 SO#8792 Confirm HBL Draft - Z1 FLEX-3902868.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358bf914-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781108821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108821, "uuid": "8e928df9-2c7a-4107-8b1b-ec56948e5598", "comment": "Malware payload", "value": "89130d18c6909d64b1a47f18168b5f0b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108821, "uuid": "fcb143a2-7fa7-491f-8e1b-6bd46e09505c", "comment": "Malware payload", "value": "82768bcd117c2f8c1c42529eaec47eddb3b6b718ca4e2efb09a1e2481e551a7c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108821, "uuid": "c4ff6c81-4874-4ac6-b50d-11bc2ca95a8f", "comment": "Malware payload", "value": "0e9869ea82769ae5a14c7eae56fd8b8e49ab38f1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108821, "uuid": "7f9fd66f-fd2c-4eac-8868-d0ea247e4fb7", "comment": "Malware payload", "value": "7b3530ebd50ffb1a0e1851347c27aa23ac8e76ac0b1dd0af16894d7f7f1a76433e1497640afa4e0e8af4762431daf829", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108821, "uuid": "92dddc2c-26b7-4a81-b852-414aa88485ee", "value": "T1C5851AF78DEC0143CE71EAEA4906F574EFA054790DAF585F707D92B1AB922B21422E70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108821, "uuid": "2b446d1e-3976-435c-8eba-a3f867961115", "value": "384:Vbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbj:znJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108821, "uuid": "fd5869ee-8336-43db-bba7-2fa83b687584", "value": 1807641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108821, "uuid": "6c7b823e-1868-465e-8c5e-3760005c9c48", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108821, "uuid": "8ef2d763-a448-4c41-a35b-4a6be22a34b9", "value": "RFQ_IBEX.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3711ddbf-64d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781099374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099374, "uuid": "6bc90ec3-7763-493a-a7b6-f8ec6ab98103", "comment": "Malware payload (Mirai)", "value": "25f7c340ed684b0a901ddc3bded8a8ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099374, "uuid": "765d8863-803b-4cd8-b2d5-d339e0f3b314", "comment": "Malware payload (Mirai)", "value": "8280a5361cacc95d6ac4b45719d7033c5132b1f0dc1c7ed1331dec0c84b22e85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099374, "uuid": "a509e4aa-c923-4bdd-b176-b4c41e648cc4", "comment": "Malware payload (Mirai)", "value": "dc52fd5dee9aa4ce50f0940034a683ff21a461c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099374, "uuid": "129074ac-769d-4241-a859-472b1517fbc5", "comment": "Malware payload (Mirai)", "value": "b255b57aa8f04777bb22365a139234e3e8c90160e1bf381d946376eaa6f76aa64bce6ed6352623184a2c72340eea6b68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099374, "uuid": "3303dbc9-1c14-4d67-9e07-449b340cdab1", "value": "T153935C26B978192BC4E4A07A21F74727F2F6435A20B84B1F7D724E8DBF2164027577B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099374, "uuid": "25e33145-7309-4fe8-b23c-58b83a315efd", "value": "1536:6wQjEAgfxyh6IzAMCEx4tScY+519plC/BMt5elhES:DMEl5wADFYcYmzuJrES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781099374, "uuid": "b20e7636-6f2c-409f-b4aa-19d8a4a7c5b5", "value": 91892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781099374, "uuid": "17dda0ea-0368-439a-9a91-99ffa69cbafa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099374, "uuid": "b44f4440-280f-4c4a-bcdb-ea5cec6e0e73", "value": "lqtucsxvn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4771f8fb-6499-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781074491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074491, "uuid": "46f2851f-7e90-479d-bc47-e799e3447b6b", "comment": "Malware payload", "value": "05da5720ba4833175b26e29f90e9b150", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074491, "uuid": "124d0b67-d82f-4c28-9881-8cd89028e56c", "comment": "Malware payload", "value": "8297ec78749f949be12fe442e6fd7863207a3223d318f7f887e18d6b9ca5bc74", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074491, "uuid": "0c966b80-3f1a-41a1-85af-a085b6bb8b08", "comment": "Malware payload", "value": "897bd7a03d5e48331e2030d07639ea5b7d3b261c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074491, "uuid": "c4fb9801-fcf2-4aad-895c-e112bfa46307", "comment": "Malware payload", "value": "df308f0151dbbb45d924de5536e15957ae32ed975c02127e9e4dc6e0560a6565ba7b26dbbaea8178354037c8ac8265e3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074491, "uuid": "f1b568a9-25f9-47b9-b0bb-cfc4a8bf75b5", "value": "T187D39D29A3A214FDC29A923996D743F2F873B83017225FAF0754CE751F94D913F29A21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074491, "uuid": "ee048297-3327-4250-8d3b-ebac9e3252ac", "value": "c1f4184fc0d8e903ea01b5e3159c8812", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074491, "uuid": "a58c2219-f1c6-4893-8022-0cbe94f2d9ea", "value": "1536:FvsiJMLY5NjBkBr6fTdWgFIZRHhdcUkFvM5FDgMomcA0AmtWvyrDz+Wuga7r5:ZM2Njyl6fTEVrxh5FJ3VmdrDz+o05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781074491, "uuid": "705d1143-5792-4d95-9cd0-9b804872bc38", "value": 133120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781074491, "uuid": "c940cd07-2f17-4836-b084-e32c0b8af147", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074491, "uuid": "8d8ccfe5-1ff5-4e8c-875e-81dfbbcbdc64", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "763bdf65-64d1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781098621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781098621, "uuid": "046a3b89-c0d2-4468-8d9f-553171c82c72", "comment": "Malware payload (Mirai)", "value": "4737679521853ac0f2dcd4770ba75a03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781098621, "uuid": "6d610f5b-7fd4-4f1d-812b-03459429fe41", "comment": "Malware payload (Mirai)", "value": "82a74fc89051a49ddd7337a8b520d27997960f315d6c59afb2b44362e82513e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781098621, "uuid": "e07abb11-ef78-4685-8387-e64a9d1fe9ba", "comment": "Malware payload (Mirai)", "value": "c7e87b41b0ff1dd5f6b454334139ef43ae0010b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781098621, "uuid": "574d6d27-96e5-431d-9017-d570eb6879b1", "comment": "Malware payload (Mirai)", "value": "c047243f6afa9ec65dbabdc86a7f75ad1bd55c7cf1ce72c1a59c50bad80efc3f5c91c80e5aa369d5051a512d0e60ec7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781098621, "uuid": "f1a9dee2-762f-4d1e-a01e-ea56e14b5365", "value": "T12313F1AA134480E9D21694FEA1E92B335FA94F8770237D12FE4DEA651C4C431BE73D88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781098621, "uuid": "583b89b7-0018-43a9-aff2-fac7575fe5f3", "value": "768:W0mE7o/dwAYkbn0VweSzjBbxF5plHJVjdJJvbSx2ow5rJgGlzDpbuR1Jf:bJOd9zD03SXBdplZrvg2bVJup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781098621, "uuid": "d71fb2dd-a0bc-4bb0-860d-f34fad981807", "value": 45028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781098621, "uuid": "22bf0a16-9819-43b1-a5f3-6d1bb9dda3e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781098621, "uuid": "a5f7f9c0-1080-4e6c-882b-d73c64d0d28c", "value": "zero.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5367bd75-6517-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781128628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781128628, "uuid": "4e44f7d4-2b64-4fd1-a728-1c8cc2045fd9", "comment": "Malware payload (Mirai)", "value": "a1710ce3c11152d81ae213b38685e04b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781128628, "uuid": "6507f4a3-45e5-412c-8012-7fce66e97944", "comment": "Malware payload (Mirai)", "value": "82c20a394fad85db49e0b23f7d65eddc07d2226e8a4e8e66d407e137c385836e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781128628, "uuid": "7edd2428-f20e-41ec-acb0-0d8e21200270", "comment": "Malware payload (Mirai)", "value": "03c004f6b30d05220b9d02049eaa7d3212f375ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781128628, "uuid": "7dc62a04-e79f-4616-b0fe-7980c72d3867", "comment": "Malware payload (Mirai)", "value": "291a51f212608dee589b36006e6fb295ae480e75eb9048c00fd76b39b626bd2fe36d8ce667d7e2659cb9fa7838d93ff7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781128628, "uuid": "859057a8-44c9-461f-b72b-0879b4fa12d6", "value": "T175F3F756B8819F16D5C152BAFF0E534A33131B7CE2DE7203AD246B247B8B86F0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781128628, "uuid": "6c88a92e-5090-4c74-a26e-7a881088bfe7", "value": "3072:MxHKADZIKGVRRGEWB0o2fXQjs/6ady01KgjsG3ath7CF2:wq8ZIKGVGEWB0rXFSadJHjv3arI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781128628, "uuid": "57b35e05-45e7-4531-bb20-9844f3f811af", "value": 162288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781128628, "uuid": "8bc09bd5-491f-4130-add1-39dc0b2854ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781128628, "uuid": "8a4acef0-e25b-415b-84f9-0d9c0d44993c", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a376d5dc-6496-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1781073357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073357, "uuid": "1e235b7b-e85e-459c-bb3b-c12dd9957e1f", "comment": "Malware payload (AsyncRAT)", "value": "dca0d171e9faf837b702ac6ab4e06215", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073357, "uuid": "55329791-2456-4306-a3a8-676632fe9fab", "comment": "Malware payload (AsyncRAT)", "value": "82e3f88df80eb74912b75ae9d68fd8100e20f7dbb2aa1faad92249236cc8db4a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073357, "uuid": "80b5ee7f-3bdc-4e03-a571-608fbf147e7d", "comment": "Malware payload (AsyncRAT)", "value": "17b38e356de3543c34dd1f7f95f65b8187cf5e45", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073357, "uuid": "747453d4-4c84-4667-b393-5611eb2b6abd", "comment": "Malware payload (AsyncRAT)", "value": "e57e19d110aeaf2a40f53b3622f20cce4eda9493d22cc3cf8ea0b368db2c73a2d7325aaed4e98c82e104870ef796d718", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781073357, "uuid": "e0ed4c81-9eca-4538-9f2e-ca8c76d47c2a", "value": "T1F9F53B416BE8CE1BE1BF2775A4F201111BB1E449A732D78F1698E6792C637406D0A3BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781073357, "uuid": "25f946d8-b97e-41c1-9a70-c6b7035cc599", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781073357, "uuid": "70dfec2e-c061-4c75-acbb-6111fadd6b7b", "value": "49152:7GHHBF+azKPKZ12ShzPMAzU0mdBdo+6WuDayPdr/NxJ:7raOPHS9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781073357, "uuid": "347879be-3339-42d2-99fc-c8fe8bbe0b00", "value": 3369984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781073357, "uuid": "f8519af9-1619-4710-81d1-e5e63d4c44f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781073357, "uuid": "fac33ea0-1478-4478-b7bf-3bfb872eecb5", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acfad2be-64ee-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781111169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781111169, "uuid": "4ecd9c64-ad72-4467-9f2f-400b4f3790e0", "comment": "Malware payload (Vidar)", "value": "9c69fc16a0fa1c6ca41a53392a109d38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781111169, "uuid": "a45f2dbd-f91d-440f-afd7-90f1e01584cc", "comment": "Malware payload (Vidar)", "value": "834cd4961435ef0c00dadf7e58a2db2b7451bf4e079fc7af25eeddb884ee1b89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781111169, "uuid": "c20a9a61-0586-4478-956e-68e3e78aa147", "comment": "Malware payload (Vidar)", "value": "162d3b5d70368a8d0ed8d9d1169436e33ef422c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781111169, "uuid": "8479e941-2b7a-4a0d-803f-3895bbfd229c", "comment": "Malware payload (Vidar)", "value": "a15f35f7fa87684fe6fa41bf5fa561f26baeaa612821048684796e11de3241f208993531204274c67460e287487e104d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781111169, "uuid": "319f74c9-90ef-41a6-aa2f-77140f3773b7", "value": "T1ABE58C07BDA40AF9C4C6633248B25692BB32FC640F7623C72BA076782EB27D15D39755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781111169, "uuid": "a1beeabe-d4a7-4941-b462-9000dc1595d8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781111169, "uuid": "c870d967-a5ee-4548-b14d-bf7e2f692e20", "value": "49152:0/m1gXIdmcveA+nGYwdqVyO5i3O6Xhu9uKL7G8jr8j7rcdn75N/uWs/VV7gcTY76:0BWVeuu9uKL7G8jr8Ydn75N/uD/VV7gG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781111169, "uuid": "f48517ea-6fb8-41dd-80ea-58139596d24c", "value": 3106992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781111169, "uuid": "10aff8d9-5fad-46e5-a480-81998fbf3997", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781111169, "uuid": "e4c45764-75fa-4b98-9b12-32d338a61702", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c9236d8-6475-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781059092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059092, "uuid": "4db8cf5f-7828-4e65-a593-49e1d17dc315", "comment": "Malware payload", "value": "ac205024c8d1930526881dfd350e635e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059092, "uuid": "004ccd71-268a-4b2c-9d27-52c2d4f581af", "comment": "Malware payload", "value": "84b697aa0687321666fd51dfc944890bfe0466606f64a3209a256617c4a01664", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059092, "uuid": "e067870e-aa3d-428f-8be9-899e4525ed62", "comment": "Malware payload", "value": "fa6c8b3d3b1a21cd94dec2d6cee8418e461e7f91", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059092, "uuid": "b59060c2-3d28-420c-a8e0-964c34eebc82", "comment": "Malware payload", "value": "1c8c3b4717533ff786c3c26da9c8406cbc0928f6cede962eacc58f8dd151436ef221a8e97082f3fba7fcc62b09a7e3b2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059092, "uuid": "203a17c7-7dbe-40b5-84d5-4a6b605029c2", "value": "T13501CECAC601E7604185F89E7AD7A284B420C3CB59414FE9BF9C043D9BBE31C7015F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059092, "uuid": "d09a175a-1d90-4236-a56a-c45ffbebb9c2", "value": "24:kXCKysE2hi0ziQvZoha+KPFB9VvaN1gzEftU7:e9Qp+Ms+K9B9VyzgQfG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781059092, "uuid": "e2f663d1-2c7a-4322-a69a-634883f6d4bd", "value": 826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781059092, "uuid": "6ad4e3b7-3433-4959-b887-2117a5ab5676", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059092, "uuid": "afefe2e6-778e-4b95-b431-73ea4a8c0746", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a8694a3-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781105527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105527, "uuid": "ca4e512f-8d93-4484-9fd7-3d7439142208", "comment": "Malware payload", "value": "f731ad48bd482a12576afb68cee96e1a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105527, "uuid": "59e0c64c-a5cd-4f04-adaf-117c0f3b4d17", "comment": "Malware payload", "value": "84ebca3704b01b39ebc84d2443996378f9ab1c55512b82c9208839e24c69aa4f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105527, "uuid": "f7be5808-fd61-40f4-8da4-f06da20e126d", "comment": "Malware payload", "value": "8f40c76974639c0568201c1fa8eba58ba89ac4c4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105527, "uuid": "cbc16886-5efc-4b7c-a908-49adba70e137", "comment": "Malware payload", "value": "8d776c4b271e77673ac50e8d0b2b6dab68b0627c0aa73a7b62223d8e88c5c26c006c4190aa0f1dc367131ccd63eb46a3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105527, "uuid": "ba1ba4e2-8747-4ab8-932d-03f0e2ce28a6", "value": "T182F0A49926711F75C808EF05FCEB46A861CAF1C292A08FADB5E5357A7C6CCC0B490A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105527, "uuid": "674000de-bce9-4e0f-be36-f2ad870e344f", "value": "12:O9v+aKLKVYLC2GieggS+bDsluiLaKLKVhF5:KvcKcxJsVsPBKzF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105527, "uuid": "07e27076-5eef-4113-a11c-2a0ff0757a3c", "value": 600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105527, "uuid": "88f1aeaa-6d5d-40b0-8134-b6f51dafc8d7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105527, "uuid": "6f3592bf-5a10-49ff-88af-3751a02e0c93", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad89815-64a5-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781079731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079731, "uuid": "c85eb46b-1e2e-4214-bc90-1e52e391f067", "comment": "Malware payload (Formbook)", "value": "68531ea6655e75cfc12d3bfbd822f211", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079731, "uuid": "d37b10fc-b02f-43fa-a54a-8157734538de", "comment": "Malware payload (Formbook)", "value": "854d742f0b61942fae2236bed0fec3db32ad80205c6f8a4f4ffed2836b7c05f9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079731, "uuid": "b51164a0-33ea-45a0-8139-37a7206b0b4e", "comment": "Malware payload (Formbook)", "value": "a145feb8de315a236195cb5056fb6ac8e6d1c2f2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079731, "uuid": "736ac4f0-4f53-4a2a-84a4-a5f07cf4a795", "comment": "Malware payload (Formbook)", "value": "94ba1e246cbdcea0626a29b2678e1d2d2bc6542d50bc5db33401b25447d26a069ab90a7cd8cbd233526c552c6d18fca6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079731, "uuid": "cad48303-0ac7-4658-934c-76b67d3a0184", "value": "T1A87642300354C571C25C5BAEA6BA7118140E5DCE84F9FB0D3AAA47B552BA833D3BB7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079731, "uuid": "67bf74a2-dadd-433e-a653-807a36db44b6", "value": "196608:+JufkOa2ATyqNdvyIfkn8RfeFFOkWQpQTbMgreaetJTF:hcjRmeKp/UeaerTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079731, "uuid": "c060df64-12be-4da1-b292-9f7127f9ae54", "value": 7529635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079731, "uuid": "3d4bcfd2-167c-4595-8333-3465475a0c41", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079731, "uuid": "f771a4fa-f6cb-43a8-bd5a-205b8c3c980b", "value": "SWIFT90927828920.PDF.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd904f68-64e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781108620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108620, "uuid": "5a764817-d824-4a76-babd-0c355b5e0642", "comment": "Malware payload", "value": "4077ebb8b80431b02e95bcaa39a8ff48", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108620, "uuid": "3ced9cb8-8029-4d4e-92e0-103edb5c7a9b", "comment": "Malware payload", "value": "85c8f7f809f9f26ea85bffc507a349de9b3d4c9283fc82e49b1b45057f799653", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108620, "uuid": "c4d00efb-8444-4fc2-94da-4dfdc4035de7", "comment": "Malware payload", "value": "bd08a55859d723526537e56fb5ac986ff8f7ddf7", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108620, "uuid": "ca015447-634d-436b-85de-50319eb688fb", "comment": "Malware payload", "value": "495b71bfc42642eaed2fb3c98be62712bdef6dd87aff4cfd19711e310fa54ea95c557c2c074d7acd47f64af57f774c70", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108620, "uuid": "9366628b-3e0c-47eb-bf59-fad721567879", "value": "T1EA51024563DD0014F272897FCBD667C98CBAF2942439C68ABD504B1EC531D039FA3B6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108620, "uuid": "d7075725-c52d-44b3-abdb-60ed3887ea09", "value": "48:8FFW/4r8eqAOHONBaVlH6slsRtS3xhdS/fuYhKrmbKSROre7:8PQ4Yc7mlaslXBhdSuEKriKSROre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108620, "uuid": "2df9272b-695e-43ee-8045-99285597e9e9", "value": 2937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108620, "uuid": "e5c0e01b-c3e8-40c8-8c77-9fd8ba53f1c5", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108620, "uuid": "d29b140f-14d1-4e3c-8727-e3a034d3a815", "value": "Screenshot_2026_01_06.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "486062c8-64a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781079217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079217, "uuid": "14eacd41-d54b-4332-ab0b-e2c9c6efebc4", "comment": "Malware payload (Formbook)", "value": "d65747d31a2de8cf6d5b5212958e063e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079217, "uuid": "c0fd549b-5749-4e83-91a3-fce9c664efad", "comment": "Malware payload (Formbook)", "value": "86226b8c291f202ae6d8ef819e46339998ad4a5c797e1901af64ad9f4c20e735", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079217, "uuid": "7bd45e27-356b-4a9d-836f-a34a2fc4f959", "comment": "Malware payload (Formbook)", "value": "944c2e3cce662781b6b67efe0a67519fe5f24faa", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079217, "uuid": "e9e0fd90-2a08-429f-ab80-b0ff75a6fceb", "comment": "Malware payload (Formbook)", "value": "9f954fbdc55a1e60ec2cb7b8bf742d1f56621ec5cfe8f664c6c440ed855de3907d9591ac01ed8c3bc142bc4725954b17", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079217, "uuid": "f90f0b77-2519-4624-b443-fc8fc56ec11c", "value": "T10505183DCC54012FE1B6DA19C59A446FF882162B222CE94B50C73B9FAE73946B7D312D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079217, "uuid": "d1388b80-9b78-4f27-a8a3-b4d4d123c79a", "value": "3072:OSrvvTXidLLdkm7Dkl/3TZbPzlIvRJgrr8KiTO8B7DYX3oHc22FG9p2Z/pXF1TXz:f5eD0ZXl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079217, "uuid": "edd573db-60c0-4f6e-82e6-48baa1838fb9", "value": 797994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079217, "uuid": "af9f59a6-61c8-437a-b905-ec3faba72f6a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079217, "uuid": "b5994190-1eb9-4894-8bd1-614cde454f95", "value": "RFQ_967.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f72e93-6491-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781071340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071340, "uuid": "ff593a99-2850-4f7e-aa03-108956a3bbdb", "comment": "Malware payload (Vidar)", "value": "0fed87d1f7458620282684b12ffca185", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071340, "uuid": "9dc4b8b2-d20a-4661-87cb-19b944b0cd8c", "comment": "Malware payload (Vidar)", "value": "8626981efaba9cfe10a9c628bfa5771af3224409fc95b7521ffb5b602296cdfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071340, "uuid": "7faca630-7ebb-4414-883d-5aea472e3e66", "comment": "Malware payload (Vidar)", "value": "ff72c3061a0b5234402809cfc65bf6014591e588", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071340, "uuid": "4ee2c70e-a438-486f-9d94-539e1c12f9ce", "comment": "Malware payload (Vidar)", "value": "63ecee8ae7a52ceafe0791cd4d4bba93b58bf60163b3be7544b965018814846e2531965d7a2d2f497866a48dae29000b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071340, "uuid": "36c1fc3a-6b4d-47e8-ad42-a5c4bc7d2909", "value": "T10242FAD9B1A2B4FCC0ACC2B8D6CF12BB97663085071E5DFF01FD89A02BC26553578A56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071340, "uuid": "0f97bd06-05ae-453a-ad27-fb3321f30562", "value": "17a4bd9c95f2898add97f309fc6f9bcd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071340, "uuid": "96cefbda-1433-455c-abab-da12f1c882b0", "value": "192:dqhglj+g3a5ycmcRNzFwan1yoJgm/4QztszY/txosgxS2:AKj+qa5fwan1PCm/4Qzttys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781071340, "uuid": "8a96bd83-5b09-456c-879b-365975747853", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781071340, "uuid": "9c9524bd-827e-40bb-9111-36ea79eccb59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071340, "uuid": "6873363c-3901-4b12-a819-51b189e0fb61", "value": "install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a70c34b-64a6-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781080106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080106, "uuid": "7bb18acb-5165-4596-943a-0f2b6f2ae05b", "comment": "Malware payload (RemcosRAT)", "value": "2f03c18ff1c58538a3a2ba86d3d28d45", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080106, "uuid": "56adf184-aa2b-4f38-b426-e1c814be18d9", "comment": "Malware payload (RemcosRAT)", "value": "868051d7394e4df3c60f1176f44e19d4b4b6eef3b096be687b61f08dd6efa18a", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080106, "uuid": "64ee8053-366b-4e0b-a859-94ea57f6ebbc", "comment": "Malware payload (RemcosRAT)", "value": "4a89c5f3053fbf3448da2d612bd0d23d8ce1c377", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080106, "uuid": "a9045907-4a68-4a3c-8b3f-59d1ac83b1af", "comment": "Malware payload (RemcosRAT)", "value": "5b379197dd3c7e17dcf33b93dc7f6e6c3203ea2dd7bba317759e45ce79e0a21e915e2d0096af62b88efcb545dc7b6223", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080106, "uuid": "5315f196-1c28-446b-bd56-c300a798d5ab", "value": "T17A9256719A9A079AA947227FCC807D157234CFB2423284D6BEA49346F53CC7C7A24F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080106, "uuid": "aee99401-bc6e-407c-adc8-42d017c5bf4e", "value": "384:v1eMa+8P49usbxSamjdPzw4+dLDwX13bBg/:9ZsP45Sa0MN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781080106, "uuid": "0ee1e06c-6bf8-4b86-86e4-e019b0c5d489", "value": 20804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781080106, "uuid": "2911866a-c316-42c2-a971-a671185d2558", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080106, "uuid": "9b38be5e-5c3e-425b-8f0f-96bcaf965ed3", "value": "DHL shipping documents pdf.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afdaa58a-64b9-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1781088410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781088410, "uuid": "c582e8eb-b594-4ba9-a682-3dc2f8e501e8", "comment": "Malware payload (QuasarRAT)", "value": "346109534281c5eb89936cbb03f43f9d", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781088410, "uuid": "1348bc9d-7ffd-4f72-8675-eabb105339bc", "comment": "Malware payload (QuasarRAT)", "value": "86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781088410, "uuid": "e4add4f5-f575-427a-aae7-ec76c1c619ef", "comment": "Malware payload (QuasarRAT)", "value": "1e5ab089fb8fd0b8b207887792bcfab23d3ec246", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781088410, "uuid": "27c85f0a-1fa5-4aea-b660-b5d9c5287c90", "comment": "Malware payload (QuasarRAT)", "value": "286c74e2eff81b3a60fbd4f4c6b4c7d108b6c4d778886bfe87d12e6ee880d5333cadd0ce2c254f4cec2872b06a7cc176", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781088410, "uuid": "50417f33-608d-4530-9a08-6579a5efc1d0", "value": "T1A6D35A1823EC8A5BE6BF5BB9E87400054372EA17E676E78E9D8C60DD19727C1D1813B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781088410, "uuid": "cc8dfd32-abc8-4f1d-93c9-7c27a13c9b4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781088410, "uuid": "e3a19870-ca83-4256-8dc1-330e5bc4f420", "value": "3072:tcQOYD7/cEYQ3v++nNcV2BjhREknBCmZpbiGya6j0fWTKG:qYX/ct2NcsvRTZpbiI01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781088410, "uuid": "06058391-199f-4d4e-863a-f20beb26ecfd", "value": 139776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781088410, "uuid": "e25f455e-94c4-4da6-a49b-455d36b19b36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781088410, "uuid": "338bca43-227c-48f3-98ee-b343e9bed479", "value": "hitclub.nagoya_6d604600_q_7zip-setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8498558-64cb-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1781096155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096155, "uuid": "6c17fc3a-bd2e-4660-8327-faa803a427ea", "comment": "Malware payload (PureLogsStealer)", "value": "385a9bded9b073b18b168bc034f934b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096155, "uuid": "edae7f76-d3f5-494b-b45a-9fa6808eb8cf", "comment": "Malware payload (PureLogsStealer)", "value": "86b9fc468e13235003066c38f0606ceec093fc1130da10a4c12eb7b15c54387c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096155, "uuid": "0c832a9f-0aba-451d-aa40-1bc4c6d47a71", "comment": "Malware payload (PureLogsStealer)", "value": "cbe3d0301f0274a3f9cbd223033a619ecdd2e59d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096155, "uuid": "0a285e4b-ccee-4669-871d-d81a556dbe0c", "comment": "Malware payload (PureLogsStealer)", "value": "cfe0e7b59732d127fa71bc86eb4c86bef0aacae2fc0923ed715d4d3268b9691debec17ccfe1cb553210d7b82c45a3713", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096155, "uuid": "fc05d8ac-6f85-41f6-8baa-ad47afae77ae", "value": "T11BF4CF5B76568E20D2841233D2DB510283F1554BB627E70E3985139F2E033BBEE8B797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096155, "uuid": "8b235289-4fc5-4d2a-994c-1bff7814b6de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096155, "uuid": "4d071387-ee40-47f4-8768-56fe8b2af117", "value": "12288:2yUGufBX7AH0HILaKor0hL8MpvYz3HXDSfELSUKa5Jz7CJ+Q/QrMhjPyn0pa9dN:Vud7FophAMhYz3Hu0Hd8+QorDsed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096155, "uuid": "02c6d15d-1a2d-4195-92e5-625064ffbbd9", "value": 785408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096155, "uuid": "87a1dfc5-9e5a-4999-95a4-c1ef7561cdab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096155, "uuid": "6d208771-fbbb-4238-9fb7-b41be5504c99", "value": "Xyz1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c45986-6491-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781071217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071217, "uuid": "9fdc0b38-64b5-4d54-a0ac-951d7288f64f", "comment": "Malware payload", "value": "8392fb61e6864444f6f1b90ecc0d2c68", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071217, "uuid": "8c048a01-57b4-4a1b-b540-36c5594f0c23", "comment": "Malware payload", "value": "86c78cb4b365f48d3b7ce7a3f6dc31095bdac9caa52e2914648a549b03a2f19f", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071217, "uuid": "70fe68a8-6ae3-4d22-b87e-51a24c36cc36", "comment": "Malware payload", "value": "ccab67ad7739716815804d117836635b11d6ddb6", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071217, "uuid": "a22ebc7e-58be-4fd9-b68f-99829563d9ff", "comment": "Malware payload", "value": "d3b1236c5cc1042cee6bf668e3b1f7892dacf79371634ac0395a5e09b0c2328ed73d6e62884adb9e9756c828c74300e8", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071217, "uuid": "3d7496b4-b727-48ee-ac1b-d6caafd19502", "value": "T1C0F3B64475ABD45AE5595E7A4CF683B93BA5BC028E76A30B3040731F2DBEBC89D03712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071217, "uuid": "5cd668b2-cdcd-4fce-a31e-10f0a8eb06d0", "value": "3072:f0xEtjPOtioVjDGUU1qfDlaGGx+cLYIxs9TQVeJyzNqzhZUKWvRKNNaUbAo1LAHL:8xEtjPOtioVjDGUU1qfDlavx+WYIxs9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781071217, "uuid": "bb8bbb98-587e-4289-8635-139c9f0520ef", "value": 169472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781071217, "uuid": "cf1cc267-ed54-4736-b929-eaf2442dfded", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071217, "uuid": "37b6f443-27bc-4f68-9122-b47ebe3aab36", "value": "PTTK_Balance Sheet Form III_M2 (All)_VNSKY_09062026114213.XLS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7533d3-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1781108750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108750, "uuid": "eda5abef-e4f1-40e0-bf7a-c8cd001e0284", "comment": "Malware payload (PhantomStealer)", "value": "975f2e66bfd9bc079a84fc737231b13c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108750, "uuid": "397b9df2-109a-4cd5-a413-3f8d79b3c077", "comment": "Malware payload (PhantomStealer)", "value": "86fa2d6e4055dcfbc903a51c3482a96d7149a0eae57f5cdc791f674e5e87a786", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108750, "uuid": "68839347-98e8-407e-96f5-68bde65d3f82", "comment": "Malware payload (PhantomStealer)", "value": "b0e1fd61e097ac14b21ef0bfa2d2cec3af3aa9b6", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108750, "uuid": "9a56ccc6-81a6-435f-8790-4d9d7ac66e18", "comment": "Malware payload (PhantomStealer)", "value": "ecdb3acb33725fe4a4ae4439c003e90c03076bd786cc45999332674f11820cdfaec1d6ce9cba1454e32825876fd24377", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108750, "uuid": "eece7b2f-e217-4437-9fad-68772b045a7e", "value": "T1D97512885953D80BC96A27389AF1F13412B85ED9F503D21B5FED3EEBBC66B940C54283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108750, "uuid": "5d782aae-a9fe-4c51-adbc-808811e0de3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108750, "uuid": "dd2e8cea-eac7-4ac0-b0f5-f853956060e0", "value": "49152:GYQN+47U1Bdh+u5KVks85RkmDwYtMa1Hec840g:GrY4g1f15KVR41Hec8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108750, "uuid": "58181489-a13f-4fc4-a3de-9d05de1c0e87", "value": 1612800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108750, "uuid": "30e1ef6d-0bba-4155-be1d-2adc41b5e622", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108750, "uuid": "43805376-7e43-4899-ab6d-25f00dc26a02", "value": "dhl 81 abu 885 81 abu 768_Navlun FAT..bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d2d6cd-64a5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781079540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079540, "uuid": "b74ccedd-20e7-4a25-bcfa-037f42ff5f2b", "comment": "Malware payload", "value": "7f81b6333e3b6d0defd0f8ac4d0b7693", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079540, "uuid": "7961a39b-5635-41f8-b0a0-9922f076c875", "comment": "Malware payload", "value": "87060a2578bcf248b0ca7ec59be759de7795cd2645431e18197b7cac235ec2c2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079540, "uuid": "86ae1332-d4ab-49d3-b3a9-b4021bbd33e8", "comment": "Malware payload", "value": "c11f2b27f8448ed68d4b57df57147128609f2bca", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079540, "uuid": "df1fe09a-f81d-4707-b37e-ddb19732eaa1", "comment": "Malware payload", "value": "c9b9dd71a2228b2cf36cc4f6e25aa87b263d70bc41ee700463f3c63214b076a7e54470b736097721d4ffab63fef52918", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079540, "uuid": "73aa4871-6e07-436a-b3a6-599bc5315ffc", "value": "T16802F536C23446B6861B4FEC733851D8A654C7991373BE204A4F9C2AFFD14299E392D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079540, "uuid": "6bc93fb9-90e2-4555-b199-22a3d4474f2e", "value": "192:DlzKiKpQRCowtrdFM03K6Q6oQlm6Xu5vokkDqO8pNfDYhlhs8S:JKTyXwtdj7m6X6fkDH8/fUhlhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079540, "uuid": "e2d218ee-d0a5-46bc-8c2b-9b9e1d66f18e", "value": 8887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079540, "uuid": "6e812bea-7684-4067-8fd6-3db0763a6e28", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079540, "uuid": "96a17bd6-ffc7-4200-825e-2acdaece9c0a", "value": "AANbDASUDHxjfCt.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15505bef-6494-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781072260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072260, "uuid": "5199edfb-0eca-497e-9d12-734cd8f0c9cc", "comment": "Malware payload (ConnectWise)", "value": "454cb07b03b60eb7e252d152b850b778", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072260, "uuid": "a437c347-f1d4-416a-a5fd-7bb44e2ea20b", "comment": "Malware payload (ConnectWise)", "value": "8734cd6ba26aa1aca2855603d7dede8f0ebeb06fa9630dbb018bc71d06156adc", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072260, "uuid": "23d603be-c07f-44c4-ae82-b7fc2bee50b2", "comment": "Malware payload (ConnectWise)", "value": "f3c41a650fb49634b02403c2b7245bac76667140", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072260, "uuid": "ee4cf6d1-3a18-4021-b8a5-50bc5cef3dac", "comment": "Malware payload (ConnectWise)", "value": "1239b3fa740b2354c2fdffd404a6b778378b7844004a161ffb6b17e27114e08c523f7f89c5298b02630df6ed4119ef49", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072260, "uuid": "343a8c0b-658e-4206-a31b-834510c48f9c", "value": "T18B46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072260, "uuid": "da10a144-517f-499d-a277-38f4f082fc0f", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072260, "uuid": "6cb17d5c-d66c-4b7a-9386-56e9661aa511", "value": "98304:XzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:XhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072260, "uuid": "c1d163c6-3e18-4afd-8033-0d97caa60234", "value": 5642944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072260, "uuid": "f488811e-5b81-4926-b02f-6dcd5d1d3c70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072260, "uuid": "aa673e9a-bdf6-4dd8-b4c8-4446c5c833a6", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08862ede-64a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781078681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781078681, "uuid": "0850544c-baa3-4570-83e5-cd86ec1ebbeb", "comment": "Malware payload (Mirai)", "value": "7a407bad68248901b6ca0f0eee967e4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781078681, "uuid": "86cd4a2c-8366-42f9-9c6b-15bc8d8ca5a4", "comment": "Malware payload (Mirai)", "value": "87956094f7a0482e92b34884b2d3a8fa6433d473d97aaa155f86e716ed6d29eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781078681, "uuid": "db6ef960-74eb-4344-9c61-32fe5e5a9e44", "comment": "Malware payload (Mirai)", "value": "18cfcb90319f23e881e0ab5da63c5e19f6267473", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781078681, "uuid": "a9d28eb0-4297-47f2-ab41-d7cdb3d63e57", "comment": "Malware payload (Mirai)", "value": "8eab903361c2a9a89f9761e15ed4ed7224d770375955a937326e734a8e2f330c44610cb79b8ffa15dd180728d03f6fc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781078681, "uuid": "081b4bf0-1050-40b5-bc0f-85ccf30794f2", "value": "T1B293E64AA9419F01D59731FAFB9F425933536FACE3F97201D9246F6023CAADB0F62112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781078681, "uuid": "abef1539-a4c1-4e6f-ab48-458c1df569ed", "value": "1536:76nl55of4x1tZ7m6BCOjZramg6bY6KQwlWdl+bCHimtJwYYwgmqzS:ePof6n19MOjZramg6bY6KNuVtJwY/qz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781078681, "uuid": "54e29f9e-433d-4369-8bf6-508ba28da08e", "value": 91612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781078681, "uuid": "f93af233-c538-44ba-8af9-2c4844d6685d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781078681, "uuid": "cbb7cb16-3067-41ef-8b6b-755337b18ec7", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d4d3eea-6476-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781059415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059415, "uuid": "de55b194-07c7-41e4-b9ab-3bf9b6b3ee7a", "comment": "Malware payload (RemcosRAT)", "value": "b9f8ac18a02f08f17611d7ad023019a0", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059415, "uuid": "f04998e4-47e0-47d0-9db7-bbf9644fe668", "comment": "Malware payload (RemcosRAT)", "value": "8808eec887107aa44e42a4aea2ab0ae26c389089ef73acd96b640f2ec16ec02e", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059415, "uuid": "7bec44d3-1b0e-4987-beb1-8629604632e4", "comment": "Malware payload (RemcosRAT)", "value": "4c67c6319b0f87024da762dded7e28f168706c62", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059415, "uuid": "fed7b968-c7ae-4170-a41a-5c7b7ce83519", "comment": "Malware payload (RemcosRAT)", "value": "dd78af1f381b82dcc71c78d29939aa954b903b63f9121c3caef09eb4f208498b68ccceb96b0cc1e52e2aaed583f17bb2", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059415, "uuid": "602aa065-a7de-40ab-a9ea-8be1fb1d4d3a", "value": "T1A6A23075A6C60752AA43677C9E8133007BA49FE941B108D4FEF51F6CB00C5B8BBB5E89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059415, "uuid": "a94b51d0-46a9-4eb9-931a-af65c8ce010a", "value": "192:QX0QMZlGRXHc8L7Fo4SwRLxfcrqygzrbCim4n+QIaCXSp3AjIw6uHSz0TIJzZUl1:FXkRXHc02v+mUkyz0kwrpQLnmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781059415, "uuid": "605d87d8-0f08-4990-ab98-11a95f9ca4e7", "value": 21371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781059415, "uuid": "3b38b920-7603-4852-8c42-e2ffbf20439d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059415, "uuid": "5ebd1853-ab01-4435-87e0-1057b15b1076", "value": "Radbrknings.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f281fe4-64cc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781096408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096408, "uuid": "8eb324e9-2825-44ad-9c80-7ffec0870b91", "comment": "Malware payload", "value": "72eb995e9176886f6f20349ddcb85b0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096408, "uuid": "779e8b9b-b7e4-410f-8ace-d2951ae80fbf", "comment": "Malware payload", "value": "88f273d8448db3f051b6a23ce0d3ee27d6fa0754cf11be4a6c71af8d42450ac4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096408, "uuid": "35aef086-c67d-4054-8136-049f4f2fa06a", "comment": "Malware payload", "value": "af4ef38579b798d1060ebdf7bbd688d1cb327704", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096408, "uuid": "d9905360-1802-49d0-8ff3-d3cdbdfed08f", "comment": "Malware payload", "value": "af60f18c68bc8dbccf09cd0516cc5f8e70dffd2b718d0c7dd7413fc80d324ff039b02b9452977e74c33d6e1441f32fc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096408, "uuid": "5d32992f-5a92-4fbb-8149-07624812177f", "value": "T11E764B227BA8CE61D8BE13310D8BE9B46572FC05AF1741873229B76F6A73FA01811757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096408, "uuid": "f91fb748-2f14-4b35-8d7c-acffe86da857", "value": "2d9e242960f84bc7c78a2273ba553d9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096408, "uuid": "75a44e19-495d-485d-ad7f-63b6f227483c", "value": "24576:KeElH9ZIkH7nyHCRxjjPMn/EMPnc/3wGue58S68IcQyQ+VDPeiRrwF+FZHI8/x93:ildZI+nyHC3lUIw/gBSDegD5k25hHd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096408, "uuid": "dd256587-1f31-4325-b881-b3ed089641d9", "value": 7143424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096408, "uuid": "bcc29d98-8409-4a59-97c5-da400add9ac6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096408, "uuid": "ffe0ddb4-0576-4006-8b07-ce00b3e37a30", "value": "z2SCTV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0206e2ea-6495-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1781072657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072657, "uuid": "f020f872-fa80-4f18-adb7-4754187e1060", "comment": "Malware payload (DDoSAgent)", "value": "edd9edc271640a6a6c8bc5be6b9bf749", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072657, "uuid": "0d010a13-5d4c-4d1a-a4dd-83624bc919d0", "comment": "Malware payload (DDoSAgent)", "value": "89a51bb990e33e2020e036d1e3e788944f5ab0e4baa6f10427e250a618930092", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072657, "uuid": "d857f1f6-ebbb-4af6-9d2e-cd69ebb7e552", "comment": "Malware payload (DDoSAgent)", "value": "dc06a18c84f221fd1f3b29e071e805939d5d9d17", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072657, "uuid": "6376aa3f-2e2d-4bcd-8651-42476a21745f", "comment": "Malware payload (DDoSAgent)", "value": "d70927082e9618c1232e3eb901a84e47063fe3db298172b731be1efa345c963e7a0813a072723b4d54b85620a9623912", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072657, "uuid": "82dc8a73-8e63-4988-90e5-5c241c122558", "value": "T15E95333E023D1F1DD5EAE2A9C46BB0F61B0D05A28F83201E54A6BDDF4A20651795FBF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072657, "uuid": "54bf54a6-f39c-4717-935a-90f180beab55", "value": "49152:JvHzoak0SAFtvqfBYYH+mlwoTTYSuz4I4GSHSDQ5Qz:poakX+tmF8oTTraZCQz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072657, "uuid": "82d79885-7a57-4c3b-aa61-097ecbeef41a", "value": 1934560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072657, "uuid": "e3658147-19d2-4029-a3de-38c6116bc8c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072657, "uuid": "528fc842-8ee7-4959-aee8-fd0cac2e2997", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9a497b-64d1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781098662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781098662, "uuid": "b6ebad9e-ef4e-4760-a516-20c5bb2cd0f0", "comment": "Malware payload", "value": "775a8aaaca41013feaafe4f1406d4d66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781098662, "uuid": "3fc62af5-e72a-46f2-8ff9-674ab2eb1b26", "comment": "Malware payload", "value": "8a2783673e72741dfc623afb4b23baee1730684a1c7f16ec1b7cc8a607b91a3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781098662, "uuid": "0f9162f0-21d7-4efa-a1f3-4c00abe27968", "comment": "Malware payload", "value": "90ed12b8eeef784e2d60f428ed1b25719fcbebdb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781098662, "uuid": "73b1a675-9c29-432a-a046-20d4e4434dfe", "comment": "Malware payload", "value": "d3dd4f193c0c7ae7878860a572001fff8abd6b3b3329b21ac1a950a05f6783617b1c7b4cd99b28f4a3776ef5fb9c8327", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781098662, "uuid": "8c2660aa-f198-4701-a679-d59cd168cb7c", "value": "T196E3871E2F228FADF668873447B74A34976963D623E1D684D2ACC1146F2038E545FBEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781098662, "uuid": "dbec37fe-b165-42da-833f-4ba49b29d939", "value": "1536:8s/y2cU8MXAY2d67BB0jpK/yCHu5TJkn/OSHnX/jeTUg5T:8s9w67BB0FK/y8n/lHnX/rKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781098662, "uuid": "8c9bbb7a-3694-4e29-bba6-ff56ba19d07e", "value": 144108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781098662, "uuid": "e825f3f8-2f36-48da-9050-02c5d24cdaf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781098662, "uuid": "8c7bc56d-e3f6-4445-aa89-29141f4882b7", "value": "zero.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38410251-64cc-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781096370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096370, "uuid": "8a1bb77a-d917-4861-8939-35ebb278e985", "comment": "Malware payload (RemcosRAT)", "value": "f53f544714e7c9f400d5e2ca2293aee1", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096370, "uuid": "6e6fbcae-45ca-49b4-90a3-0d9244fc8681", "comment": "Malware payload (RemcosRAT)", "value": "8aeba54e4b2dbace241a721e120366b8194a5a1fa4b1fb28cbe49cb432cc60ec", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096370, "uuid": "000063f0-65cc-4e18-84c5-1dfaffdc5f8c", "comment": "Malware payload (RemcosRAT)", "value": "878d2ecbccf65e8d9bc658852abd077fa0645af4", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096370, "uuid": "3dc46de9-010d-4450-87b0-0a47627f1453", "comment": "Malware payload (RemcosRAT)", "value": "134d5757c10a451d8768370574a09209a86ce38652b57b2305869018858fb9a4fbdb09d1970e7dd918e5629330c94924", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096370, "uuid": "e5ba351b-f3d1-4639-a226-64db7c20e378", "value": "T147F6D3B173B2902BF1E98BBAB055D5E762CF31F424A4CEF6A89ED51C3750A06E235D01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096370, "uuid": "e604222d-23e5-4252-aa3d-ad6894cd9b7f", "value": "768:cHHucaM5kBKowIT6vitEtfMU/kQGcryb70UFKH2ygdWITkX5LaZ098fuwHaFISoM:i17Bq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096370, "uuid": "cde2ba9c-8e0c-48f7-964c-1a8cf3ee95db", "value": 15631716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096370, "uuid": "52cf8554-0ae5-4ac6-888e-341b5ab1fac9", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096370, "uuid": "77db2528-0f9a-43ba-a542-1756dd987f57", "value": "20260010INTOTMS-4109926.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8beb50c7-64cc-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1781096510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096510, "uuid": "ea1cf988-4ca7-4a26-a44c-e7e895cfdcef", "comment": "Malware payload (BlackMatter)", "value": "cc343173511472552f684e5843e8a7c2", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096510, "uuid": "5f93c95c-13df-4c09-a84a-8bf38541198e", "comment": "Malware payload (BlackMatter)", "value": "8c047ba01ef0db2b2057190d6c35a7c0e6965f465b0015d17b8c59c3767b2cf1", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096510, "uuid": "95d678fb-5b21-4206-80ef-e877df8fae9a", "comment": "Malware payload (BlackMatter)", "value": "ef38b7502db2bbdfbebd8cad20aa4e9a74185f65", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096510, "uuid": "4066a0ba-fcca-47cc-93e8-70964ad7e9d1", "comment": "Malware payload (BlackMatter)", "value": "d9e395d08133858d3460cd2912e00a43b4c289fa8eb3be50e93c017b9e59b89647dd342ee231b6a398ed1a2168c16143", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096510, "uuid": "083dedb9-2768-4a75-ab13-c0b6b7a2ad97", "value": "T157E36D21F112D1B3C83718F13736B172F39E4E6C29996947EAD80F99BCA48232F15997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096510, "uuid": "04f562a9-e0f3-4039-94b1-40fdf3cb5524", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096510, "uuid": "d63c8ad9-d42d-4533-a7a4-df81a5c2a577", "value": "3072:k6glyuxE4GsUPnliByocWepQuz2VrUkHaUnvDv:k6gDBGpvEByocWe+V4k/vDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096510, "uuid": "801de8ad-d387-459b-b9a4-9cb095fa867f", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096510, "uuid": "73d6fde9-9166-4be3-8de7-6c69c7fccf94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096510, "uuid": "8427b1ee-567d-483d-bb5f-dda12fe6c7a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac0b910-6505-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781121017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121017, "uuid": "036a6cf6-fcb6-411e-be2c-ebb81d7b5662", "comment": "Malware payload (Mirai)", "value": "dba5be06799dda8d78b30297cb543870", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121017, "uuid": "e2504c2a-f94a-4b5d-a7c0-57d7bc9c0d99", "comment": "Malware payload (Mirai)", "value": "8cb9e79a9675124ab5d740f8ea209c5b44e0658c4c11575ce6c8e02b44d5160d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121017, "uuid": "b3d55ac2-7e3f-439b-bbb5-1d1c057e38a3", "comment": "Malware payload (Mirai)", "value": "87140abbeead46bae7996ca26876e48398fd1080", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121017, "uuid": "4e0fc80b-c02a-4188-bd6c-6aee97c68ec1", "comment": "Malware payload (Mirai)", "value": "074362b277b9d9f5752f41d8a2422525a282f6e66793cb65c1515f519da06656cadbc2eb22b3a981e66fbed21785b872", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781121017, "uuid": "73d3fd19-980b-4b7e-8eac-67072cfe3d83", "value": "T1D2937DC9E982D4F5F45301B12967D7738632E4752027D9C7E3692E31DC72650CB2A3AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781121017, "uuid": "58f2608b-f12d-43f8-9098-445aab872fd4", "value": "1536:+Na8hdohr9+A85vsXsO2ioDmUjVGwKH5HcToSzNJ4ySPGF:F8h89+AEvsXsO9oifZHK1zNmSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781121017, "uuid": "3f1db61a-4a0e-49bc-af06-7add113eca33", "value": 95496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781121017, "uuid": "b3dff8a9-819f-4d9b-bcfd-896cc9434d3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781121017, "uuid": "a5d40dee-632a-4423-9479-240946a0e5ea", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "607614d8-6508-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781122207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781122207, "uuid": "2bab811f-ae17-498b-a886-03fbcbba2b0f", "comment": "Malware payload (RemcosRAT)", "value": "906f6e211577ed2ef3f118e933b6aead", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781122207, "uuid": "e2ac6aa2-1095-429f-a39c-6fa40ded5948", "comment": "Malware payload (RemcosRAT)", "value": "8d59761d1e3dc3bfc1b43c5ed15dade7fd375b1d314313d483bf9ff76cd7af57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781122207, "uuid": "76746002-c9f0-40a7-b888-542abd1a1f0f", "comment": "Malware payload (RemcosRAT)", "value": "9144433f662e1c59f727dcd58615b924cd1328ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781122207, "uuid": "f5f0a40c-8114-459d-b3d5-a060c03d907d", "comment": "Malware payload (RemcosRAT)", "value": "8353a235e07cd14f5b2d059f23e85ad4cd5697eef802a9370702acfbec0ca5a7ecc6d1ee36ade5611404c4389fd3465c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781122207, "uuid": "4e53ddba-50e7-4e21-ab99-72a82ebbf45e", "value": "T1BAD47D49E3B401B5D07BC235CA829527E6F2BC056271562F03D74E9ABF233A1573EB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781122207, "uuid": "fd25764d-70a0-489b-92ff-a599bcd604f6", "value": "3d20ba98fb1153d8e87b00324316b42b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781122207, "uuid": "88981637-593c-4c0e-96db-68c8c234d06c", "value": "12288:rKN72uXsciTv/0+EqjCpas1aUu9dzn76qoLz96ol5KCTYlY:+N79XsciTv/0+EqGpas1xu9dzn+qoLoj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781122207, "uuid": "a7400c7c-153a-4142-a70b-dcaa0dfd7bc5", "value": 641536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781122207, "uuid": "c207e0ff-7d08-4a84-b77c-436a0b51f6a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781122207, "uuid": "cc8ea9ad-4f50-4ec6-8a80-0a002b0258b0", "value": "8d59761d1e3dc3bfc1b43c5ed15dade7fd375b1d31431.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddda5501-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105667, "uuid": "37fa3f75-0284-4cbe-b7b7-36494f47aa1d", "comment": "Malware payload (Mirai)", "value": "df1027b67ec3d8fc2509f7e9786e905f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105667, "uuid": "3dd9133b-e1b2-4e31-9df3-7baa63533a98", "comment": "Malware payload (Mirai)", "value": "8daf482306aaa19830da19408d2f7b7bcb579e4067eae9c85627ab6fcd7015bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105667, "uuid": "d72e483f-2da8-4a9b-8c1a-50e4ed37a678", "comment": "Malware payload (Mirai)", "value": "6d05b6441330410416320125bf1f6defac3b113d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105667, "uuid": "873a2137-88de-43a1-8007-74cd61b65414", "comment": "Malware payload (Mirai)", "value": "26c44d278f0146662ec6d15eb32d3023888464b647353f4bb41c268b7d7e0f32e3726dbc7b30e5afaf83c8fe318008fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105667, "uuid": "804e79f7-5f6d-485a-856b-99605320d9be", "value": "T126D2E18DE5A098C2DBAD1DBE50DC2362BF31E44137A7D7952B228C8C4665C4AF57A07C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105667, "uuid": "95b7d01f-4346-4017-b861-015a7ebb75db", "value": "384:i8pVWtmRsLYEpB6V8S628F6Rm/Lcq4bEMn5WPbMSMdyKKr5CZb6AoU5ke19SRWG9:HMYHb62xRsc/bEsWPIDKr5HZs+WY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105667, "uuid": "7914133b-8930-491e-9f0a-464c4fe786a4", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105667, "uuid": "5dd42cbf-d6f8-4257-9447-3b7b56ce4685", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105667, "uuid": "cdcd3818-20a7-4dc9-8652-7ea8aebb32e1", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1384965-6513-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781127094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781127094, "uuid": "84ce0c63-15b9-418a-bb3d-8800ed777477", "comment": "Malware payload (Mirai)", "value": "5d82f76185f4ba1a5e0346f880254026", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781127094, "uuid": "d01cba5d-004b-4f09-903a-d032a6d27e0b", "comment": "Malware payload (Mirai)", "value": "8e51a36bae76aacbe6b4f33494e90fce1356f36e587b6a989fb51259226b3ecc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781127094, "uuid": "7b22faf0-b997-4357-9dfa-d0a21df29d2c", "comment": "Malware payload (Mirai)", "value": "1937f6ca5de9be804ade81d22abfbf2e71da855f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781127094, "uuid": "79963c55-ec17-40d4-a088-c5db7144b981", "comment": "Malware payload (Mirai)", "value": "d0894e305ac3f59a332396d8c635e6046924bec15bd20b0050342a8b1405095c90173c3521dc7bf74101b49275f047ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781127094, "uuid": "e143394b-9cc9-4a0a-866a-a3d00f0e6d00", "value": "T1EFD35973DC366FA8C528D5B5F0718B792B939961808B5FAE55A3C3788083D8DF5093B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781127094, "uuid": "0d5cf44e-fc3a-4f59-832c-f4244488588d", "value": "1536:aAS3/SpAw4DosQUfcDXbCjQfflEWOzNBKxT1wV/lHI0BG:f9Aw47QocDLff9EWGNIxOIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781127094, "uuid": "14c04d03-3bc0-43c1-839a-d47545c6d2bd", "value": 130772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781127094, "uuid": "4a4437c5-eeb6-4ada-8dca-8e6a1977a79c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781127094, "uuid": "81ab8547-21d9-43a4-b682-03fcc1aa2f52", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a03354e-64a5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781079623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079623, "uuid": "20d73dc3-1dfa-4b73-8d5c-de23e568a989", "comment": "Malware payload", "value": "3aef025f33ff2a19e53f275bd455f7ac", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079623, "uuid": "0de69b00-230a-4616-b6ab-08fd3becf52c", "comment": "Malware payload", "value": "8e5e57ee0ad3a8f4e2083e2a6d5cc9e291da57ea9676e326d7625ac51be53c92", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079623, "uuid": "9cc3b1be-91b2-4705-b7da-bddfdc9f68c3", "comment": "Malware payload", "value": "32c91df9ad602dbb10ce195572717a658f855d4f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079623, "uuid": "95b9e0d6-423e-4aaf-9f9c-6bbb77b2c77a", "comment": "Malware payload", "value": "44c83987311196220f8d4b56dfcfa7338d63c60830ff3935fafb7357d052cca7aa4b836ba46d74cdd517c22b6364c17c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079623, "uuid": "1190d17f-81b3-418a-a44f-4ba2fcb8273d", "value": "T184F4C63ECD14012EE972C518C4984A5FF8D2599B222CD94790CA6F5FAF7388677C329E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079623, "uuid": "e20b9eb1-8f54-4918-8159-cc7495a6efd4", "value": "3072:bMCEoItyumgWY2TF51NXZRkYoa4ek49wU6J9vdEvpIEF+7MhOT4y8o1ing83UvN8:nY2f9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079623, "uuid": "65fc78f6-b12d-4268-b433-cab7940bb03e", "value": 789404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079623, "uuid": "e4f8cc19-d2c6-46b9-b111-361d6688def7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079623, "uuid": "ceb959c8-6357-45d5-9377-6cc609fdaffe", "value": "SKM_CC12000978899.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c30e3b-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105655, "uuid": "6aae861e-173b-4fd0-b6a7-6497ccdb280c", "comment": "Malware payload (Mirai)", "value": "a8d63219a51b2612bb15baa47d91365b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105655, "uuid": "876f4076-271c-44c7-802d-26486b5d3fa5", "comment": "Malware payload (Mirai)", "value": "8e6985ac51e02e35f2193aeb7812ddea02e106f4aa284cc13ba7ce48dd85e1d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105655, "uuid": "3d398471-c2f4-4207-9fc4-d30347babaab", "comment": "Malware payload (Mirai)", "value": "e10a7d30cbdc0e20cbd9f4253e975018ee9128c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105655, "uuid": "d6e0d816-d8b6-4993-bf0a-e351c14cb06b", "comment": "Malware payload (Mirai)", "value": "5b9f8683d488c02b6c02211a65ce87699725c8993cc4bf7a886735d2736879e3c980eccedc2a29d2580840d89cea4bdd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105655, "uuid": "3be76285-e8ae-4729-bf2f-2921fcb5968c", "value": "T18B933A03B58090FCC5C6C1344B7FA636EA72F1ED1275B69A37E4EF222D4AE211E2D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105655, "uuid": "18636acf-6bfc-4ac2-8437-35a2ec16ff90", "value": "1536:KPvjFFjrKGGg17rsyCcpUu1vMbnIh0vAi2k2xPSUUN4J+LPR:KvjLrKGG4syfcIhXiuxpUN48LP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105655, "uuid": "ccf3e657-410d-4c03-8c4d-139cbd0fa316", "value": 89232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105655, "uuid": "3514b08c-bb7c-4167-8d76-70e1eb61f9a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105655, "uuid": "be5e7060-c898-4b37-a129-39daebaf8da5", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e6417ea-6517-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1781128727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781128727, "uuid": "81637b0e-a947-4c31-ad09-f178a0d7ba53", "comment": "Malware payload (Amadey)", "value": "91a5057b48034273c0803de1edba9510", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781128727, "uuid": "535620de-673e-4b44-a217-8429fe984d8d", "comment": "Malware payload (Amadey)", "value": "8e92cbdcccdfe7baac62ed1ecc0f2d9463b6482dd455daef5bb5778367ef4d73", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781128727, "uuid": "75804e6e-779e-4436-a6b8-7505b80559b1", "comment": "Malware payload (Amadey)", "value": "b2ec9df866e8f06dfec423888cb1a8b4b364c175", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781128727, "uuid": "a5465d40-a5a8-46f6-a2f1-0c1354cab4b5", "comment": "Malware payload (Amadey)", "value": "58f57d42b706e9bfe3ab508e44fa09d2cd44a32818bc243e63f1399dba45c2de843b6faa1b888615a9d76d5fcc71ac16", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781128727, "uuid": "cb06c0f6-78c4-4694-9718-bcbe250989c6", "value": "T1BC046B10B1E2C4B2E673053114F89B75597DBD310B224EFB67D80B7E4F342D1AA35AAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781128727, "uuid": "22ab5eac-ab26-41e3-973a-e3fe19492918", "value": "44fecc80f9b0222c9a3ac23b1cc2d9f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781128727, "uuid": "eb0d17e0-5bf7-4b09-a818-cdd126293bc5", "value": "3072:wVDs73PgRODbw/h7jmlArERSek01tGrrP/lOAg0FuD0kqqMef5:wVbRys/dfw8eV1tUMAOJqpeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781128727, "uuid": "69cedce0-7c32-4933-a36c-8a1612addc73", "value": 174592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781128727, "uuid": "846a58c8-e55e-4937-9cdd-cd8b1189eca1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781128727, "uuid": "a6ab36e3-0a15-4939-8d74-06bdb2bedbc4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8b0f5a-64b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781087522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087522, "uuid": "cedbd64e-68a3-4572-83b6-e9490af17b56", "comment": "Malware payload", "value": "13a4e30691ad9749fbbeff30c829341e", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087522, "uuid": "def7b6dc-c807-4818-a762-36d33cd3a156", "comment": "Malware payload", "value": "8ed4dbf049882d68f73b79df15011daf0908475309bed674546ff01568396be5", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087522, "uuid": "b372a269-85ed-46ef-9511-202c448a7527", "comment": "Malware payload", "value": "9883deb0816fadcfc252020d7d66092c60f26a8d", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087522, "uuid": "85252dc4-7c38-44a1-8529-7ee3c483176e", "comment": "Malware payload", "value": "faf859593e1867852568099b98e183692e612b151a86ac4c6be1c8850b521f5c3e08f4747a62dba9371abb0c1625a97f", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087522, "uuid": "66e4fb90-4281-42eb-95fa-f3b67f8aa783", "value": "T181C2FA06EA6F5EA29647C1B935AB71862315E65F3B002071FDBC91782F0F538C1A6FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087522, "uuid": "cf1d7f40-acb5-4557-bc06-ef75b7bcee6e", "value": "768:j0wvY6+CFfqWUJjPFc+eHYxkCYxlkV6YS43YS5:QwgLCFfqWUJJxeHYxkCYxlkV6YS43YS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781087522, "uuid": "16871fa6-d9b8-4e24-b2c5-0f51cece3340", "value": 26773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781087522, "uuid": "1abcf1ce-6239-462c-8ed6-8eedc743ffb3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087522, "uuid": "cf922e56-96a7-4fc4-a4ac-dd81530fb175", "value": "8ed4dbf049882d68f73b79df15011daf0908475309bed674546ff01568396be5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5446600e-64e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781108443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108443, "uuid": "41a15800-c745-4b10-b0fb-3f6d9039568a", "comment": "Malware payload", "value": "0350e144b7e5edc8fd7399f4d55da636", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108443, "uuid": "a9ea8993-1485-4aea-93e9-e7255bb655f7", "comment": "Malware payload", "value": "8ed757f4a328013d38939cb0e53a52c8aec3646400ccfee860c287f37f3383dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108443, "uuid": "3f6ae476-0efb-44d0-9620-37292dd30831", "comment": "Malware payload", "value": "cdde837f628ed26c9b2701c6803e8454f6498730", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108443, "uuid": "e40800d9-df03-4839-96b4-2bd4c43bb8c8", "comment": "Malware payload", "value": "0293141adc90bbb1a8278fe37fb07c9cdf886e97ce6d9bb247f2fe70fefeb4fa07d36016edaa4b8b8e6c5282019f6985", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108443, "uuid": "9be08d5e-9dc5-473d-aafb-3593de6bac73", "value": "T157C53917FCA549A9C4AEA230896691927B72BC484F3023D33A60F77C2FB7BD059B5744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108443, "uuid": "799a9536-f745-44a0-a81f-cf52a7bafb6b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108443, "uuid": "6845e025-6d31-4c3b-aba0-6ce11dda1e30", "value": "24576:CjZeQAYWiCfCZyaRwcm7zmyQiZp2vlduOT8Ve8yl+5mez2p9zPOfOylZPJkcGXnG:Cj488Cxmnmyf0dduOg08/qdyjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108443, "uuid": "7cc75bc0-ebe7-479c-84b3-41a4f4375b7c", "value": 2668544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108443, "uuid": "e6c2a743-08f4-4dc6-abd9-f23917436798", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108443, "uuid": "07a605ed-d133-4ef6-a610-92db2c6c9786", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63051807-64bf-11f1-a769-42010a9c0008", "comment": "Malware payload (DiscordTokenStealer)", "timestamp": 1781090858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781090858, "uuid": "59fc4dd7-f8f7-478a-9e77-8f376523b655", "comment": "Malware payload (DiscordTokenStealer)", "value": "7654740d0dc227ebdf0afbde89c3316f", "object_relation": "md5", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781090858, "uuid": "a9056a3f-f871-4dec-a1fa-5d56762764a6", "comment": "Malware payload (DiscordTokenStealer)", "value": "8fa1f3e3cb1d773962fa0fd626fbd1595829d1d0826c271765f040778b58bc72", "object_relation": "sha256", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781090858, "uuid": "a27f884f-621d-4914-907b-5a95a8e46c98", "comment": "Malware payload (DiscordTokenStealer)", "value": "c2ce4df48a62f5e0888e1b40e7b07cb66edc0a40", "object_relation": "sha1", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781090858, "uuid": "75092617-b02e-48dc-b319-d898b0376da3", "comment": "Malware payload (DiscordTokenStealer)", "value": "b20c57db7ebf130d754383ef3407a7babf7e1627196b5a5d2e143dedb2ef39b1ebd1087ebf73192a71387ee46358ce11", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781090858, "uuid": "9decef1b-4a4c-418c-bdf7-767b543269cb", "value": "T10BC5385303851BBDF69D0EC9C94B215B20F2D46B7D291298EBB36EE7BC3B9845430636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781090858, "uuid": "a315bcdf-d9ba-4dab-b44a-98b60e175a71", "value": "1536:L536vYovsrAgxl8MUMq2AE7vh6PoJ4iklku3DBFEjF4z1SrjGpUuQBerXDzhrBX6:9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781090858, "uuid": "ab56561e-e921-47b6-9487-d5e9797bb1f3", "value": 2653675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781090858, "uuid": "8c671cb9-bcaa-44fa-812d-143ff82195f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781090858, "uuid": "57f71796-e6b7-4a48-874a-18153b1ee79b", "value": "P.O 265.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "242e6e91-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1781108792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108792, "uuid": "6b5e9808-1743-4c49-b24d-e8b59a0e0dd8", "comment": "Malware payload (PhantomStealer)", "value": "4bf76c49fc9f73fe7aab7bd163d3e84b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108792, "uuid": "7d140522-a520-4748-8d3a-9891945a8da3", "comment": "Malware payload (PhantomStealer)", "value": "8ff1f162756335ca314c2a347aa1ac9d377325364bd1b2b5e84d7dcd09a00a0f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108792, "uuid": "34ca020f-f2d2-4840-871e-233faf9c98b5", "comment": "Malware payload (PhantomStealer)", "value": "8af7eeba6e0fb3782157e354b1faa41e95028808", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108792, "uuid": "91da6d54-1b3c-4b26-8ddd-dc4cc64c1bf4", "comment": "Malware payload (PhantomStealer)", "value": "e785461f44e6016df9701447aee120625fd71937b6d852c054aabad5712b67680cab7b2b1afac945913c1a0f548769f6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108792, "uuid": "c61da831-f6c7-4535-9132-9d2f277c417f", "value": "T176C66B03499D670B00C8D2B7E0378993C6DEE43ABAE8F6E257530DC6E84F5D469527E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108792, "uuid": "c5fa036e-763b-478a-98b3-7c8c4336529b", "value": "384:y3nGwOEJiPKMC2dixYT+T/m+TUYSwBOfP2sLE9g6C3EALMxzBkJopgb8K3gn0owc:ucpV+KG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108792, "uuid": "06149ef3-188a-44a0-af56-06a8f40e6818", "value": 12259402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108792, "uuid": "f8784073-cf43-479b-9805-2883556387a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108792, "uuid": "bf4a18d1-5efe-40a2-a16c-8d9f36203499", "value": "SG1006261_AvisodePago.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c95c3e-6473-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781058382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058382, "uuid": "775b26c2-562a-48f4-81e0-0314518bdae0", "comment": "Malware payload", "value": "51220c7fcb70b763373b6e95763d947b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058382, "uuid": "c0861a73-aab7-4226-a229-1ebc505798a0", "comment": "Malware payload", "value": "903cfcf71df77a3990f47919e62493eac176f40a6699aeaf4ed1713eb6ddb1c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058382, "uuid": "535f6105-111b-4188-b3c5-331b435950bf", "comment": "Malware payload", "value": "c134680dcb659370586fde48e3c447c27dc51b14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058382, "uuid": "94e71560-4914-4a9a-ae48-02a7f7b0ba32", "comment": "Malware payload", "value": "6271c9d97a8d69cd846bce666ad7d42a0246637537c52c565f13c21df8cc2b10e2a45f2318072315d2372d1d68921f42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058382, "uuid": "6f73e531-d0e3-46a5-986f-69747faf1065", "value": "T1BB14B80AAF510EBBDC6FDD3706E90B0239CCA45722A53B753674D528B94AD0F49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058382, "uuid": "0b19fe4d-3c4a-4e15-ab70-b6fb48b260df", "value": "1536:CKtTKEZdEZp16Z4AJCWAJe6vrGiueQbsj0LbHY/qfI7/5AD+YRxi00t9ZEtwZgpR:PVKEZQqA+1lbrzRx0EUe+vXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781058382, "uuid": "80fe0c34-5163-4053-8c17-e3889eab7684", "value": 201952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781058382, "uuid": "c4a7617f-adb6-469f-92b7-f5f679f7a3aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058382, "uuid": "6b860658-e063-4dd5-bdc0-7c8dad4f05f2", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bfc3259-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781108778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108778, "uuid": "99b5b438-573e-4f58-81d8-13d656c36c51", "comment": "Malware payload (RemcosRAT)", "value": "4499bb7ee6c82624cf14ce560da6ab4b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108778, "uuid": "1b67013f-b811-4217-b188-73aff28a6731", "comment": "Malware payload (RemcosRAT)", "value": "9197e1afe26c1082e5012a146d27c7f0a18c2bcc87b18c7b4bbfa3c5544968ce", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108778, "uuid": "f211c830-96a0-4832-8597-1eb2909a09c1", "comment": "Malware payload (RemcosRAT)", "value": "24a1afe9784a8cf0109551e0e5acdc09af1a4532", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108778, "uuid": "c08c8b66-9261-4f27-80d1-a6cf035d4c3b", "comment": "Malware payload (RemcosRAT)", "value": "e677b84b9cfdf99b8d56295906bc435276df013f282a2a77bd27a628f6a0c920d93bf3a1bba8e97c6ad430e6f1cfe9d1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108778, "uuid": "a0f15bf6-f2d6-4725-87bf-eb1d6deba4a2", "value": "T195A57DA6DA7BC4812B70173CEE0B362AD76CD7983F7E37C67CA01A5640C5D15980AE78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108778, "uuid": "241b5f94-687b-43cd-839b-183d4065744d", "value": "6144:eQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQc:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108778, "uuid": "acaa325b-ccd3-4722-8bf4-8ecaafcb68c5", "value": 2267909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108778, "uuid": "9c536096-f825-4be4-8f6d-a62767af227a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108778, "uuid": "8c9f1e2d-e088-4817-a7a0-b726c5aacd3c", "value": "ME63674747774774345532523523535235252.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35be358-6491-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781071236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071236, "uuid": "353a98e0-6441-4dcb-a6fd-23e5e0311097", "comment": "Malware payload", "value": "8e629f6374b9123c977b2140d5d49dee", "object_relation": "md5", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071236, "uuid": "7f2f2d62-0f8b-41c1-84f1-709b85d3b40a", "comment": "Malware payload", "value": "92a00ea5dbf17a9891f6b28d55994460ec46ca8f0b5a560bd245ca1996c6a80b", "object_relation": "sha256", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071236, "uuid": "80f221c7-e105-4ee5-85f1-5630fe5c36f3", "comment": "Malware payload", "value": "b8b714035f636641e1cb17a38535ee1d3efcd5e9", "object_relation": "sha1", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071236, "uuid": "42552719-94e7-4e08-87b2-a124adfd6eab", "comment": "Malware payload", "value": "fe98f18ecb083143dee24ea5dd333c49464c429528c30e14fa0041e14a77c1015174d77ac85ef4d9c5a07aaba3293ccd", "object_relation": "sha3-384", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071236, "uuid": "a5ce75df-d513-4ffe-b62e-ca018e2ed517", "value": "T118F53308A53411C1F81FC3BD8880EAE2495B586C8AB99E64404DDF5CF5BAF56FF606CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071236, "uuid": "d9c58834-ca8e-4483-8f60-e2479a450e3c", "value": "98304:EiKVtmoPYM88x/exmNIca4uilgKxhmUYD2w+BvU:OvrPYMLx/exYxuilgKxh61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781071236, "uuid": "8cb1c5ca-0194-4509-8808-c0b553798eb4", "value": 3352406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781071236, "uuid": "68699a13-733d-4305-ba07-0c8d9d5b6f00", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071236, "uuid": "1cb34708-acbc-4cd8-9ecf-08b536805c78", "value": "CASTLE BROMWICH DELIVERY SUMMARY RBD.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e24619f3-64a4-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkVisionRAT)", "timestamp": 1781079475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079475, "uuid": "41d40d14-9636-49dd-b14d-0322926c4227", "comment": "Malware payload (DarkVisionRAT)", "value": "ec6652d836d0283fd2eedd45a861ec3c", "object_relation": "md5", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079475, "uuid": "bed3dc3a-8c94-4326-8e1b-9b95bb773c69", "comment": "Malware payload (DarkVisionRAT)", "value": "92ad02bd0ce9160a8ad87ffd7fba019a366b4e70056b3e8bd35c706abdb4a2ff", "object_relation": "sha256", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079475, "uuid": "2c7e0dce-e380-4420-a849-b5bdd9dc4bd2", "comment": "Malware payload (DarkVisionRAT)", "value": "384c94e7c6b15997ef49017ecd563184196e92b2", "object_relation": "sha1", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079475, "uuid": "b1d2091d-fade-40ae-b144-a796c9965f28", "comment": "Malware payload (DarkVisionRAT)", "value": "80bcc7f834716feee6b469d93561f921da04dad5e0c6f4aa2dcdb80f0ef767526b0c0041d03d12eb2b659ab0509cb6bb", "object_relation": "sha3-384", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079475, "uuid": "ab0ff19d-3ee2-4a03-ba96-40c097b6f26f", "value": "T19B13314E4A6164C8794C3F64CAD50C4D279E2A928D18F3D72A41BD9EF81CA7600FFDB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079475, "uuid": "150a1ba2-d887-454a-8433-9557be29225d", "value": "768:LMwQ8jTtN/7wXp5leKYoedmpIC+4XUb1By4dKv77:LMb+8lpY9dC+4X0e4dC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079475, "uuid": "9c9aec22-ba5b-4cc6-9fbe-29af29457c99", "value": 42729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079475, "uuid": "8126595a-4680-48c7-9994-94c4b648c62d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079475, "uuid": "31d2fa72-a9e8-48b6-9039-c7ba706bff2c", "value": "PO1850062.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f8c921-6511-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781126058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126058, "uuid": "0efccdab-77d8-420e-9009-86cfa11aa01a", "comment": "Malware payload (Mirai)", "value": "925396a05fd146ea22263585563c264a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126058, "uuid": "56ec2468-192d-4cf0-85b7-beecb2598444", "comment": "Malware payload (Mirai)", "value": "92cf91e91b717099913999d8e9879b87f964ff1e2f5b65073ff37920a4e0d93d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126058, "uuid": "fe4ebf3b-4335-4ec2-b775-39037aa905fe", "comment": "Malware payload (Mirai)", "value": "e5d8ca3275b4f6954e2a753512051546eb5615cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126058, "uuid": "1ad3001d-e957-4e0b-bfaa-67bee61c0f33", "comment": "Malware payload (Mirai)", "value": "341d441d205c869c0bffb45a7d4073cb9b3c2b8efbc2e37c8e45fc8db8e7ad5a846b73304d5b8f5513bd65941076aab4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126058, "uuid": "8d58b1fd-5cb2-46ab-8f06-f62589ea6fad", "value": "T186D33873CC766F68D628D4B4B0758B7D2B93A96181871FAE55A3C2788083D8DF6053F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126058, "uuid": "d8c90242-7d97-4b87-ba4b-a900b7271886", "value": "1536:362QIwfSZy0yPkRThtMdk8BCBABv5nW4ZZiKyWVqO6jQUjXk:36tKyb8xhtMTNBBnWSZFyyUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781126058, "uuid": "2dd1f379-f217-4b8f-b626-f3082a282e73", "value": 130740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781126058, "uuid": "a21f6ff0-138f-4cc7-a2f2-56a4f566b29f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126058, "uuid": "03c677a4-a486-45f0-869f-3f4371ca3f91", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d2992e2-646e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781056113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056113, "uuid": "554a9d22-fc39-4c33-930c-bfca5a52b30a", "comment": "Malware payload (Mirai)", "value": "336eae0c9d55deea2c41900ec535c836", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056113, "uuid": "88d8ccab-fcb1-4fe2-b5f9-1878556b2044", "comment": "Malware payload (Mirai)", "value": "931170d4b6e1c66e6de61fee36392127fc24e37e0fe25b50b290e9a76757f62f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056113, "uuid": "e4529c91-9c30-4bbc-aa44-4d922700af22", "comment": "Malware payload (Mirai)", "value": "49a773bb8de6031c108fa65211f8c27f4adc4346", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056113, "uuid": "7675a467-0ca0-4ab0-ae93-97cb3408587c", "comment": "Malware payload (Mirai)", "value": "78947bef9f6c39d05f38f2c80df416385e982a5e559c25adaace5e1f5ca29f6262299edd54a757a78403b78652e9122a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056113, "uuid": "7db9af0e-0efe-44ae-8c9f-9a140e96137e", "value": "T1C6D37D46E353E0F4F9A341F0006BE3665A70C925A120EFD5FFC63A71B8B2796961627C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056113, "uuid": "3e2b6fca-5741-4cf1-bdf9-d6a098b6d178", "value": "3072:UnoClMoHnfVII59lxltapHAq7ITj17prTFQ+xFNANtdG7M:opM0ZxOI5XQcFNAtdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781056113, "uuid": "ee9dd4c8-e76e-42c9-bed1-c64e9e93fcaf", "value": 140984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781056113, "uuid": "7d2ee2f2-d5a7-4595-a558-176b8a1b96a4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056113, "uuid": "b1cfc4c5-2fa6-4e00-a713-f5c68e4309c5", "value": "wife.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1373f741-64a5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781079558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079558, "uuid": "da340f70-2a17-4d85-8153-7c2222e2379f", "comment": "Malware payload", "value": "c2c77cf9bd0b6a93972e12741f3cc583", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079558, "uuid": "e0cb6506-a702-44d5-8fca-50cf6197ff74", "comment": "Malware payload", "value": "93818957fa1c797dd56d9ea0f6d4df1931e8a81be2f526fd5edd429d7b73bb29", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079558, "uuid": "a8e28585-99c3-4b80-98ea-6750d62e563b", "comment": "Malware payload", "value": "e3053a9711da40671cfe3896c2161b6e4d6be5a4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079558, "uuid": "42955321-bfe5-4828-8164-541df157a7ef", "comment": "Malware payload", "value": "da8d3ef500d78866f77b9b283069254109f3912fe3ad669e79a5d79b138ccf44eaf8d3edc34ca486caea011b84ef6d11", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079558, "uuid": "cbb55b1c-6365-4e2f-8d96-87d5933377a5", "value": "T1B2A1A53DD6A44B3187AF8DCCB239058DE129C3601256BE649B8F8C5BEFC8424CD7A695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079558, "uuid": "cf850baf-2b44-4b42-9fc7-3d641b811e31", "value": "96:3gSlMuL38OlwMWtseNJXAVsg0SNQUN50ejT7Bw4Tgz6DG/jn:3AcMOlwMWZu0wewjN8jn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079558, "uuid": "ff1f36c9-5cf6-4544-a861-13a308aff791", "value": 5026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079558, "uuid": "8809b708-4807-4f52-9a29-34881290793f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079558, "uuid": "443ab1bf-8745-4aff-ba0f-99a06c2f80b8", "value": "aMocuLHFKjlTqfHrBva.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a67eed-64c0-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781091425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781091425, "uuid": "e1d90a3a-05e2-46ce-9a22-f55427b850a7", "comment": "Malware payload (CoinMiner)", "value": "dcc1c7a5796eeb22c5dbaa642c3a925d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781091425, "uuid": "c87ef951-799a-4e14-87ff-a9a1db31e82d", "comment": "Malware payload (CoinMiner)", "value": "93a1089ba7f40a4808bf24bbfc57709dd681fb15971bae88f3c3de240795af38", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781091425, "uuid": "93e596d5-9107-4f55-87b3-bd396bc94f7f", "comment": "Malware payload (CoinMiner)", "value": "a97f4c0b35fa4e7e7ed2b5e0fc981cb0afa538fe", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781091425, "uuid": "7d848a26-41ef-43cc-bde6-f78775fb8088", "comment": "Malware payload (CoinMiner)", "value": "6ab589db288bc0f919fb43b0f33d17145a9cafa9dac4d2ef07cb4b8cfef02a89cc29f9370ebd6cc8e3240df25a258909", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781091425, "uuid": "1a5b7298-d123-4e34-beb5-2bd83596aa3e", "value": "T184322A1D7E450332E3A489F81879824F517D6223E797E3EFF7339A4A5A962448840DAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781091425, "uuid": "bb9c85b4-e1f8-4871-b1f2-fe99530d9d4a", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781091425, "uuid": "0d08562e-6664-479d-967b-f52227d1b048", "value": "192:f94so2WX9TBjx+ezysVQPFJxTEZmFhS2cVRpE:fRot9FwOSPFwZfpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781091425, "uuid": "c1a0ab66-8b77-4797-ab0e-3aa30896dda1", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781091425, "uuid": "18ec6ee2-154a-49de-9574-d27929eaa2d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781091425, "uuid": "a1ec8690-2c99-4a1c-8949-3d514b1dc197", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4bde5af-64ab-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781082379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082379, "uuid": "c75b6fc7-3048-450f-a1d3-c5aa4a2f1f1a", "comment": "Malware payload", "value": "43b4912da917d9941ad4eac865360262", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082379, "uuid": "56cc0cb8-c6d6-4f20-8b6e-5f0a9bb504fc", "comment": "Malware payload", "value": "93c66a99df04c7fa8f4903f23a5910c895a846a80570eb9874289b68067087ec", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082379, "uuid": "1ad1aa51-962a-4311-819f-8b404a88f0cc", "comment": "Malware payload", "value": "deb435033f57b31273dfa7712d4a165c9740769a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082379, "uuid": "8c2b554b-8ef1-4186-965e-5cff4cae402c", "comment": "Malware payload", "value": "04663e6ec1764cbc13a28ead7a76c82d452fd7d635bd14e8f1a9c33a9fcee880dee348587b5e0f728c780d1580d731ae", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082379, "uuid": "a5aa8676-e135-4de6-8227-fd19ef61a740", "value": "T1AF136C6526953C25AE99883B5C7E2F0CB9A983E2304491DDBFCA3CF18C15A9CE318719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082379, "uuid": "c3dcf0d0-d99e-4ed7-80a0-6cfd9ef8f51c", "value": "768:/r9NyXsZztCs9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:DHusZsco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781082379, "uuid": "d2f866e2-e4d4-45f6-ba11-2169994323e3", "value": 45513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781082379, "uuid": "afc521d8-44d8-420a-9d03-76efecad439e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082379, "uuid": "69aa4cb0-2775-42ff-865c-bcd6fe583036", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d195561a-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105647, "uuid": "71ffb0f6-3804-41da-83b4-7434c2f5e423", "comment": "Malware payload (Mirai)", "value": "d24cb173619e99152ba8c1025627b220", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105647, "uuid": "4e1b2ec4-12d6-4530-a3f4-4997b2f6e3b5", "comment": "Malware payload (Mirai)", "value": "959be7e7f46f4d513de554a8927ab7a994a0d9813acbcd38cdd1a3c940694501", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105647, "uuid": "550e17c2-fede-44bd-b150-a3b55ebdff34", "comment": "Malware payload (Mirai)", "value": "27c625d3704b286a8f9d5b2f2ac90777e04b8157", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105647, "uuid": "71560c76-49e4-48d7-9aed-9cfa7470c4ea", "comment": "Malware payload (Mirai)", "value": "9626614b0c39316ac82a0b7ad82b3fca4f22b13871fb4386e88d5d225fa3a1b6bf32e37303ae12ef8a7d314226060cfe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105647, "uuid": "c761f82e-d183-4a7c-a59a-1f57eedcacac", "value": "T1D4635AC5F643D4F5E96705344137EB7BAA32F2B90229EB87E77482327C92642D90678C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105647, "uuid": "6737c191-2cd5-4ade-8a8a-a99ecefe4ac0", "value": "1536:RaZsGDExpTGAtV+/C8eQBW2OnEGcfz3WyL35IUfA5PGFjfnPq:zGYxpTGASC4XTfyyLpIoYPsPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105647, "uuid": "61aabd2b-f74f-4f54-8ba1-2a62995a70d8", "value": 71520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105647, "uuid": "55bf3cad-b7db-49a3-aa2c-d259962bce9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105647, "uuid": "643aecb4-9d31-46ae-9b80-2090dfd67f51", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20a69d18-64a7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781080439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080439, "uuid": "a35669d0-f8d1-420e-8d56-f5208348ed13", "comment": "Malware payload", "value": "635bd76da1088c13c2e5a8d53b99aa05", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080439, "uuid": "3a81edb1-de41-4905-94a5-153a8343f332", "comment": "Malware payload", "value": "95c15972a2beca994211b5f5ee3e44fbf4046c14bea1458fa20a237116addf95", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080439, "uuid": "7a68c83a-4b27-473e-995a-bc9852d36960", "comment": "Malware payload", "value": "faf51adbb5882fdf42f9850373125090948a68eb", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080439, "uuid": "0ba85788-dca2-4218-b368-5943a4c7418a", "comment": "Malware payload", "value": "95f323183a6254cdf1e65b0ba87c7d0c03c6608e1cae29d02ff94c5c062aa47114d9011f2b37cd127347420b1436e830", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080439, "uuid": "07091858-4cdd-4cda-a01b-fd8d58fdd9a7", "value": "T194E07D4670162E4C060A8DA0501C0E9867BE1AFD886926AB734A85BCD8451F8C62A13A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080439, "uuid": "760f67fb-e635-4df7-819a-eb6bc8e8b7c1", "value": "6:hSG86ZACK1KBM3S1RpTCsu2xKrnJoz9HdX30Si8lwkpYA9HIzey6sKHFGRIMPyk:0G8XFaIS1fC2Iu9Z30SiiZYAlOeyI2dV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781080439, "uuid": "f6626b50-95e5-4c28-ba0a-6c55b314ee1f", "value": 315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781080439, "uuid": "650afa66-e22e-414d-9daa-1c89d9d79656", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080439, "uuid": "23223584-284d-471a-b068-f633dc96add3", "value": "clickfix_raw_user_input.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bab8b5b-64dd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781103597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103597, "uuid": "1e88e4c0-be9d-42a2-8abd-0df9c948f7f9", "comment": "Malware payload (Mirai)", "value": "1c93959f0e039eb5c56176006399e37f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103597, "uuid": "ddaac9b3-0f6b-43c6-a48e-4a42c83d9af4", "comment": "Malware payload (Mirai)", "value": "9646964e2d9c4d80b9cec9ae34f443c73e5bb084b45b1a65cba7105ef44ca424", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103597, "uuid": "f37b50b0-97ee-4fd2-b3ca-aba18bd7a637", "comment": "Malware payload (Mirai)", "value": "e40685a2570d788ac309d8ac9ef2e5c762890685", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103597, "uuid": "1250e78f-95e1-4167-83fd-c6e7767a5496", "comment": "Malware payload (Mirai)", "value": "861ef3298aa777a0fa30b23c2edf65e5910bb4f094b52dba51cd36256c0b6364fd005d9f6b6203a77b42aee784e8dbc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781103597, "uuid": "b54447da-c801-4749-b0da-075fdf54363e", "value": "T11073AE92C8299D84D7A886B431B4CE7947A3D40972D72FF726DAC6699083F8CF5087F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781103597, "uuid": "e8c09855-e6cc-4a72-9cab-6a3c963617a3", "value": "1536:39yKPpEPxgSGnmoXoDxui776AV4eKHUQg7WsG7aC7jQBGXDulC:3ExG3moXoHqAeRHqa7aC6Iiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781103597, "uuid": "0094c4a1-9245-458f-b775-28286c6920f4", "value": 80620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781103597, "uuid": "53b3a8dc-8381-42b4-a6a9-3aacc0b85961", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781103597, "uuid": "431a06bf-00c4-48d2-bcb2-735e50215a10", "value": "nqmwdsyht", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b7ede3b-64bd-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1781089960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781089960, "uuid": "286358e7-efae-4f85-9bf9-f663d6ba146b", "comment": "Malware payload (MassLogger)", "value": "0c1cc4ae6cca523c7b50fac69874e5ba", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781089960, "uuid": "3e03e5f3-6862-43a4-a76a-3054d97d8168", "comment": "Malware payload (MassLogger)", "value": "968416f33911ac6dbdf52a31009d85d954bd3ad3d13aa73bf52d4731c2efa768", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781089960, "uuid": "5a768173-0333-4737-9767-a22984518737", "comment": "Malware payload (MassLogger)", "value": "f948373234b5081f9f56021a5583cadca888d5ab", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781089960, "uuid": "ca988912-1cc8-4ac8-9299-c9774919518d", "comment": "Malware payload (MassLogger)", "value": "aaf8b71335a722bd3d92f8b9f44c53e5f07a151b834d75f9672fe82c8429741f82ae958e65dc2ebfa20858682db1e3a8", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781089960, "uuid": "5fb0bcaa-dfdc-42f9-95b4-cf171056ac21", "value": "T11AC58C4587CE62EA9878201EA546A74ECD1E30DF7B3EF50B292FE8E139D434949BC134", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781089960, "uuid": "212e9543-6e11-47ce-b797-4458a74038f0", "value": "384:XHSQWJGX90EsrEbzE6KkM1VFR1ah1EobKJ87c71rS6cPrAzNv+gvGIOs2KvnjU5y:XO736nK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781089960, "uuid": "079b0c6d-dcbf-49e4-9f3c-74e8ff08007c", "value": 2507468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781089960, "uuid": "5db28e0f-82f8-4677-8c24-5d16ffff9b0d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781089960, "uuid": "392479b5-1575-48f9-a7fb-89ccd62f4fcb", "value": "TeklifFormu_1120.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43700bae-64a5-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1781079638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079638, "uuid": "11e38991-d0cd-4474-bb35-f35b21d9b07d", "comment": "Malware payload (XWorm)", "value": "9682cefc2264f2acf169cfd7c64f71c3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079638, "uuid": "ba9881c7-43ae-49a5-8d8b-587e9b734746", "comment": "Malware payload (XWorm)", "value": "96e2fb98c70ecddd5ea3c7f90003a9dce2a9ffabf3589ab814924eb5038e637e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079638, "uuid": "f9571695-e748-413c-ae3f-270063a87560", "comment": "Malware payload (XWorm)", "value": "432637faf059a0ec66f4ad862f3cc7508063d7c9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079638, "uuid": "7484ef27-7000-4c68-a3d5-e6e2caad317e", "comment": "Malware payload (XWorm)", "value": "ef5c99e03435b90b72dc7b1b475984215d01c7f168bd219abe1253a3af564c94901226db1165a1dd94a8d671ce3ae48a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079638, "uuid": "efba0122-83ab-4d32-ae84-37633185a0c0", "value": "T157C512E009476B8C89A27952CA6A07099436C28ABC96F65F3D7D42DE0133F5DFC94C7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079638, "uuid": "22446704-6d5b-4531-a416-f8e7f4514ee9", "value": "384:JNFxuzYlccEVo2SzQENd2IxNig7Y42ebs/vaAnUU7CzrPQ:3uwccEDSpeCig7q3aE7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079638, "uuid": "e74cccd6-0979-4987-8c93-707821724217", "value": 2498309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079638, "uuid": "472e4472-8906-4181-8166-47cdd58b18f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079638, "uuid": "11f73c16-7776-4682-961b-22dfe6ad48f4", "value": "PO.pdf.00346.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "065d5c32-64a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781079106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079106, "uuid": "1ccc4a2d-9f49-4f4b-8fe1-e9484fc06f34", "comment": "Malware payload (Formbook)", "value": "d1993f48d82086f9bde47d571e66d30b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079106, "uuid": "a584aec4-b9c9-4cdb-a74c-f75784dfb47b", "comment": "Malware payload (Formbook)", "value": "96e6b3c46e1e099425f2b234437d9e832aad3ce921f1d1a676c37cb93ece4a85", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079106, "uuid": "ffa6368a-a94d-4fa8-9ca9-07afda1e0812", "comment": "Malware payload (Formbook)", "value": "14945601ac2bfde326cbf3fcf5a4f71e13811234", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079106, "uuid": "460fbb3c-f2ed-4485-8860-4ea2bf0f19bc", "comment": "Malware payload (Formbook)", "value": "a09f8fafb6fb1ba398cce1f9df41279add183822f832f7dc4308e64df77cb877eadcca034f99cb351e28e1e0cd2c06a8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079106, "uuid": "74cda646-b6f7-43a5-b683-0c71abcba47d", "value": "T1B563FBF439EF98D9AC1F4C73F9DA37D64A9B515B0070685B9B58048FB92BB049CE098C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079106, "uuid": "c4eb1ee0-7327-457f-ab5d-9448beb27ffc", "value": "384:fVsYhw9mDHgwsfzcc+eXarJz/OimiVfIkivwP7WC38QecTaRSC:NsYG9mDA9aN/OdiVAjJC38Q9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079106, "uuid": "999263a8-3d11-4935-9cbd-b01360ed734c", "value": 72714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079106, "uuid": "aa1034b1-e94c-4fd1-b1b7-81523bf2a036", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079106, "uuid": "190247ef-f91f-41bb-a8c9-9b618b65507b", "value": "Order no. 3241688.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05fe3933-64c4-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1781092850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781092850, "uuid": "4d35bdf4-74ad-4ded-96fa-0c03a38a1a98", "comment": "Malware payload (ValleyRAT)", "value": "0d141cd7161d82ece39475ff306770f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781092850, "uuid": "ef72c9c3-55c1-4df1-a4e2-576cb31b93cc", "comment": "Malware payload (ValleyRAT)", "value": "96f9426b834c812bc953e2cd836d83d1b523d2ff0bcbe812306b80b8234a73c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781092850, "uuid": "6993baa5-1826-42fa-bf00-d51dcaf76061", "comment": "Malware payload (ValleyRAT)", "value": "d744a9c0047804ef419ac1f22447d450384b7203", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781092850, "uuid": "98cb8723-3c9c-4083-8281-ba7427ffb6ee", "comment": "Malware payload (ValleyRAT)", "value": "b90f54f0f5bddd575b7d4bea04de43489e6b2dadecc8c1d3a194a812f17549adef56eb6c03fd747d80a0b78a18173799", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781092850, "uuid": "f4f86a3c-a273-402f-a930-4003045a216f", "value": "T1D4068C4652B900E4D5E6E078C507891BCBB2BC620274C78F41B55A6A9F3F2520EFFB76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781092850, "uuid": "9c3531a0-8953-4d92-b6e4-dc81e55bda76", "value": "dee191233b008cdb4d1445f8418e3aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781092850, "uuid": "2b0d5af6-3797-4076-a34b-c2606d13b2f1", "value": "49152:2fS1WBCbjF5SeJiQFQlmae4niIc0EXATS7vQkgdjd/BQOrFudsO5QM1DRos:Njqc0jujQkCMsOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781092850, "uuid": "61be0568-f0c4-48ea-89f7-c86503a87e05", "value": 3705344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781092850, "uuid": "c89bc1ef-c9ee-4fc5-b261-1706cb393b8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781092850, "uuid": "f311bc41-a212-4759-8c1c-a5eab2369971", "value": "PopAd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "934aba17-64aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781081920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781081920, "uuid": "d13c3141-f92b-460f-a66f-97feba12baea", "comment": "Malware payload (Mirai)", "value": "b9152b53c2a69af0de3589f11f3c5c91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781081920, "uuid": "6ff9104f-0302-4540-be99-813222f6f6b4", "comment": "Malware payload (Mirai)", "value": "9713c2d1d47e780f24933090bf1a68ca4b027172b38644ba6e84fd88819aa2ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781081920, "uuid": "d2fe8613-32c1-4df9-9533-e2b2e535d176", "comment": "Malware payload (Mirai)", "value": "dbce4a671072a22164386982468571aadc654267", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781081920, "uuid": "17e38d28-cfe2-401c-bf53-85cb9fba5971", "comment": "Malware payload (Mirai)", "value": "d263d778586a91676b6304f35b25c0ded0e052ec60d7ea4160a63f3d1afda17224b38ee0a833e8b72cf996e1a67154e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781081920, "uuid": "fd6357d9-6fa0-4cdd-990e-40388e0028ab", "value": "T123B3F845F8508B17C6C661BBFF4E428D7B2A1758D3EE320399256F34379B96A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781081920, "uuid": "75863cd4-0dd1-4ac8-a77c-876247f0e0f9", "value": "1536:Os/I5ZhN/VLMWMAcf774VNaSTfhrHYbO5di45EjNkDlN1wyw17k/IBDjKsfulpa1:TQDv/V4WMLv4SSzhD3z5IFmu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781081920, "uuid": "e47563f8-766c-43f4-bb3b-bb092b104df2", "value": 109312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781081920, "uuid": "34f8fc33-2c7a-4a3a-b7d2-3f30feb312c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781081920, "uuid": "63f58d69-de6e-4b3c-b462-64aab8997471", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d1eb31f-64d9-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781101988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101988, "uuid": "791eb064-a682-4db6-b027-62b695f38358", "comment": "Malware payload (Gafgyt)", "value": "d625a7577d7b902d4fed43a4e6ebbf70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101988, "uuid": "890fcb52-7a4b-4404-8a5e-a00c667d6711", "comment": "Malware payload (Gafgyt)", "value": "98a0f7ee0e4d814a846e44e27fcd1533e337eb92dd4221a104b6b63162a0ba8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101988, "uuid": "5ffa3d2b-de7a-4555-94b2-5abd334db606", "comment": "Malware payload (Gafgyt)", "value": "56d709a59f583ee88667c9404c0b71cbc721ed32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101988, "uuid": "f317e8bb-68f2-4226-9500-b952b324bad9", "comment": "Malware payload (Gafgyt)", "value": "3f7a77c7030871198fd99173c4ebea1c13e0ee28d0da22f64235dbe2a00846c87ecee9895baae831c302fdd330209df1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101988, "uuid": "a65ecd77-f662-4c55-a566-20f6afb1da3e", "value": "T15413E1EB837FC03ECA518F75E2698241DE75B4E36B050E6F46F4A9AD48E17915C12B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101988, "uuid": "05986993-ef92-4e44-b9a4-297ef6b9c7ce", "value": "768:6ub4TxzwJBaBm2t3roUYmBJrupiqw3qIjhH4v/lPtaCRLlZYPu4Jgef:6M4dwJkY2t7otmvupiznlqdtaO7Gu4JX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781101988, "uuid": "081fe5d4-7e1e-484b-bcb3-2c9a019f7e2f", "value": 43844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781101988, "uuid": "cfe88f0a-3bc3-4710-bacb-714a1c0e3c14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101988, "uuid": "eaeab314-d4ce-45a7-818d-c4dc10b07840", "value": "zero.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38257cc3-64b7-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackShades)", "timestamp": 1781087350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087350, "uuid": "8498d045-1ada-48e9-9357-85ae504f0cfa", "comment": "Malware payload (BlackShades)", "value": "41f1a2b73071e27236f87519a5c27baa", "object_relation": "md5", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087350, "uuid": "40904196-5b02-4219-aea3-0184cc166f7f", "comment": "Malware payload (BlackShades)", "value": "99cfd8d9b8ebba0d7cf8527eb0b63eb920fa6898f6971c53df833a85415714f6", "object_relation": "sha256", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087350, "uuid": "eeebc121-df40-4b5a-9952-0f3c2091a0f1", "comment": "Malware payload (BlackShades)", "value": "46fa5ae4b86c24305dd6982c377cc12ef31b885f", "object_relation": "sha1", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087350, "uuid": "8f2b5e8b-592e-448d-af1a-33aee1c573a8", "comment": "Malware payload (BlackShades)", "value": "b5c8ac352844db803397b8ff9fa0474e7393010f83c0f29ea6fcd532bb5b3404670f73d1ba1b1502cedc83cdebdec0a4", "object_relation": "sha3-384", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087350, "uuid": "9b3dc64c-4824-4dfb-8223-48c02bf36f2a", "value": "T106A23A05B7D88364E6FD8B78ACBB03444172F24B9813DB5F1CDA505E6E6A7A0C704EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087350, "uuid": "21220f5e-28ad-42f9-b0ed-e7d43c16ce88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087350, "uuid": "b6704db3-97eb-4597-81db-d22851201426", "value": "384:q4zd9rh29OPLS84STkz3VwTlDCjLOhZwlh9EgoJRvZ:q4zd9rs9uG84S1cLp9E9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781087350, "uuid": "085595b5-aeda-4664-8255-dbf86b89e163", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781087350, "uuid": "d7e34698-9c7f-4b09-b59f-a8932f0d0fd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087350, "uuid": "afe82cd4-cd05-4836-a6bc-4cd3895b32f4", "value": "citrum.io_41e23b94_h_nvidia-driver.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63d98f6d-64d9-11f1-a769-42010a9c0008", "comment": "Malware payload (LeetHozer)", "timestamp": 1781102027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781102027, "uuid": "7bbfac77-cc8c-41f8-83ae-6381b6dc0f32", "comment": "Malware payload (LeetHozer)", "value": "c0917208e71cdc890dadc28a4c7fb068", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LeetHozer", "colour": "#A57159", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781102027, "uuid": "1ee260e1-c4e1-4094-be9d-df6061354a2b", "comment": "Malware payload (LeetHozer)", "value": "9b4b6476b4145b3d1d31c45bbdd8cbc604dff595062d62ade06ea89cfa455f46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LeetHozer", "colour": "#A57159", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781102027, "uuid": "1a3f7627-e17b-4873-ba62-609065fc6c04", "comment": "Malware payload (LeetHozer)", "value": "19ed07395ed4f30cfbd386c7dfd8c6c71e977ee4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LeetHozer", "colour": "#A57159", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781102027, "uuid": "ae58bcfc-a4d7-41db-bb13-dc20043c8951", "comment": "Malware payload (LeetHozer)", "value": "a59928410600e73f90d12aeef48c3286e3f7bf39ea892b50798bd1acec78b6b2b465a1bb8a26ae5983dc1c60fc5b0eb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LeetHozer", "colour": "#A57159", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781102027, "uuid": "f17ebd36-9daf-402d-8512-bfbd50fa7386", "value": "T1B1B32A17B4C080FDC9DAC1B84FDBE13ADA33B4295174B25E27C4AE265E4AE205F5DA24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781102027, "uuid": "eca56b1a-3fa6-479d-b97f-246348ea0f81", "value": "1536:ldzbxtXOMCdmMNLtGeGeMD0cvXaEfQhhDG2JA0bY3XhG1:ldZ5hC4MSeGlomaFhMp04RO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781102027, "uuid": "a164be61-86b1-435c-b7b5-d2de0dd61e8c", "value": 116920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781102027, "uuid": "92ccfbb3-2701-49a7-82ad-565b6ce877e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781102027, "uuid": "d27d6daf-8e4e-4efb-b984-fb694c4e77b2", "value": "zero.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31632008-6478-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781060281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781060281, "uuid": "d51ab14a-804a-4459-9ec2-4c04ba223292", "comment": "Malware payload", "value": "d2c211ca25eab4ebecca7156b3ca3e1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781060281, "uuid": "1755b1bf-aed6-4b49-a095-d4a37fc1a15b", "comment": "Malware payload", "value": "9c6e833c1db56b8e3861118261de0b0c7f3945b9183d40737b8e0b9b63d3c001", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781060281, "uuid": "a998e77d-a15c-478e-b01d-f119d5c38d88", "comment": "Malware payload", "value": "7292c44f0b6a7ee5f79ee96126561813071927ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781060281, "uuid": "2350aa5b-c992-4841-b9d2-3a91167b83b6", "comment": "Malware payload", "value": "c2cfcff8fe71e39b2b5d8833936ab894b073eea8297dc9f83be69ed3f34b4ea90be17c71820dfd8e4c3b54f65dd8e636", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781060281, "uuid": "0e347606-85b4-4c61-bb3d-c44d16436e61", "value": "T1B363E775BBBA0A0BC4D4F4B962F74236B2B1874A14B8CA173DA10E8CAFE954071177F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781060281, "uuid": "e469d7a0-1352-41c5-a90a-2b817923270a", "value": "1536:EclIeNxHvoN7ML4FeP8pCP/32yPBRwyg0b4:0wZtT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781060281, "uuid": "0d6c796f-ec1a-4cae-bf7d-cd2c2e03a112", "value": 66984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781060281, "uuid": "8358a035-a6b9-4395-acc6-80802d1296aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781060281, "uuid": "c91788e9-30b3-4f9b-8aad-62e501c5876f", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d4d9e8-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781108766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108766, "uuid": "59ceb882-23ef-479f-b088-4f783465cba6", "comment": "Malware payload (AgentTesla)", "value": "64b4eb0d972281efa6886540df91e4d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108766, "uuid": "c1a55693-f26e-46f2-a3b1-0f7b2cd771fb", "comment": "Malware payload (AgentTesla)", "value": "9c7588a9ece5d0c60d4461edd21edc9b59997c5709a1e59f39d4e673cedad86e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108766, "uuid": "50fc0a51-c87e-45ca-841a-c1dd393abda7", "comment": "Malware payload (AgentTesla)", "value": "6fddbe9254eac02de4ade8d182e041b3539680e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108766, "uuid": "515ad39d-f71b-48a0-a19c-5feb49c9fe02", "comment": "Malware payload (AgentTesla)", "value": "742ba260e526da843028d1870923d91189ec5822f38dd3a517f79e272d250849fec02605bc2415ece44714e8524d2c14", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108766, "uuid": "aef43974-37c5-4a8d-8b7a-e06644f44474", "value": "T1B2761F300394D672E3545F9A26A9B128640D4DCE94F9EB017A9EC7B4127E833E37B7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108766, "uuid": "6cd80c66-20b8-40c0-b669-7de132451d0d", "value": "196608:CYDMOKvgvfVSLkmOp47k5yGI9FDAqePMPOT8g5IomUeldhrckz7ROCV:CXgvfVSLkL55bMSmBhbz0CV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108766, "uuid": "42be311b-ef35-454d-a3cd-a94fa3fecbef", "value": 7267015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108766, "uuid": "744b9a0f-6be7-4d1d-97ca-df1f89ba1083", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108766, "uuid": "9685158a-5994-4f90-9fd9-6c6a7420b4c1", "value": "ORDER_SPECIFICATION_COMPANY_PROFILE_PDF.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f76072-64a5-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1781079664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079664, "uuid": "c5ae1aec-4eb9-44ac-ac1f-a2280bdf41fa", "comment": "Malware payload (PureLogsStealer)", "value": "508582e5c7b743a083b7f4ee988cac7a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079664, "uuid": "5f051c24-f14f-499b-ac2a-695ef0df8d24", "comment": "Malware payload (PureLogsStealer)", "value": "9e1aa478a7edfc6b9ae520955abcd2faa6bd3937fa083bca242ec237ba360e91", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079664, "uuid": "e8623010-4598-4578-9260-e797f357388b", "comment": "Malware payload (PureLogsStealer)", "value": "6b78740badea45cf375405611abf017badf2644f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079664, "uuid": "3c08f1dd-0373-4fa5-ae24-4a7dce719b38", "comment": "Malware payload (PureLogsStealer)", "value": "eb881f3e3202418086f5d87133ba3190d91cfb77a6bd262d5a94c13eaf815e1c755463fcf95970c0a3612dca9be9a431", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079664, "uuid": "1c5721f2-e07f-4a2e-b81d-ee3ff9322e39", "value": "T1D5F4173DCC68013EE4B2DA19C59A485FE481562B122CED4760C73B9FAE73A86B7D311D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079664, "uuid": "5190a22d-c5aa-428d-be7a-4981469eedbe", "value": "3072:KIOT1Y3xFsVsZYukFGScO2vm+u6QiMrqzq+KI8DHXwwYbIepqCB3nOqdTZrKNu75:N8uIf2MrzDgwYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079664, "uuid": "0fea0550-922c-48b4-a444-4ee32c41f52b", "value": 789124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079664, "uuid": "1ccccadd-5bbf-4788-8bb6-52fe6aea0db6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079664, "uuid": "0a3b3d1f-f154-4f68-a027-6431b886da22", "value": "Remittance_PI-01045226_20260609.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681d1733-64cc-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1781096450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096450, "uuid": "899a3d37-8066-4f6b-ac1e-01409992bfa7", "comment": "Malware payload (BlackMatter)", "value": "fcd1d8d406cd62e506f3ab8987a7f717", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096450, "uuid": "4d26ffa7-bd3c-4271-a512-c16447adfec7", "comment": "Malware payload (BlackMatter)", "value": "9e2d6e16e5572e6459bc257f4e6dc47b0b5f11663568bba2e9ad1e8a71165cd9", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096450, "uuid": "99866038-c369-4432-a07c-22b1dfed642c", "comment": "Malware payload (BlackMatter)", "value": "27441cf028d73855d42f4628d753b82f952129d6", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096450, "uuid": "d079437a-75f5-4481-851f-86c562342091", "comment": "Malware payload (BlackMatter)", "value": "7d8451ca0b4d444d4cec4a5e44721c35a2e747e231a72f1dfef400bd7e94d7000a5637ee3434bba40ac6a033b5959d6d", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096450, "uuid": "24af8624-ddd6-4315-a96e-1872f9beb5db", "value": "T1FFE37D21F212D0B3C87728F13736B572F39E4D2C19996817EAD80F99BCA58232F15997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096450, "uuid": "b8fef63e-c17d-4fa4-87da-022b91e643d6", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096450, "uuid": "3d6855e6-e073-466e-a0b4-c5cd01beb547", "value": "3072:R6glyuxE4GsUPnliByocWep/MZbnhG1bzyio:R6gDBGpvEByocWeyZnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096450, "uuid": "ec2111d0-31ce-45c1-8f1b-673f96c8bbcc", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096450, "uuid": "844bf86d-93f9-413c-b2a5-787a864c01a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096450, "uuid": "d036f77d-15b1-4f64-87ff-ce7ac5038da1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57d5413a-64ea-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781109308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109308, "uuid": "005aa694-7484-4b23-ad6a-5a4cd987b0a3", "comment": "Malware payload (Vidar)", "value": "94633616a7da4a84a0e87e87285441e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109308, "uuid": "aee67e19-c9b7-4708-adca-169900852e02", "comment": "Malware payload (Vidar)", "value": "9e7dbf8d728ed6b645ee21410edb15a5f3c33fe360fa1a6ff16aacd1de8c8205", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109308, "uuid": "8c274863-35f7-47c3-b868-81a316b8928f", "comment": "Malware payload (Vidar)", "value": "f297c896d566eb68801cb6c4b232730b933e01df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109308, "uuid": "c79bda47-e88d-444d-8aed-e041f4097004", "comment": "Malware payload (Vidar)", "value": "7e52fb388e1076a5d237b37cde94d28ba2cb9b0c092a01e9c5943a35797d518d26c9d868be882f06e0917e189f43545e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109308, "uuid": "b94547ce-1380-47d9-aca9-f0084073f32a", "value": "T183E57C07ACD04AFCE49AA73348E76692B724B8550B3223D31FA17B392E727D46C76714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109308, "uuid": "16575ce8-a60b-4efd-b2c1-3672ea2a7455", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109308, "uuid": "02f4eb2f-0150-456a-915b-d3be3e3aaae0", "value": "49152:6wFmB7IWmwhbFg/AaxftHKT+QgZ+qaiGjZHHD49GnQ5:69ZWHftHKT+QtqaiMZnD49GQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781109308, "uuid": "e74d22d7-615b-494b-bb05-80b84f05da28", "value": 3209864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781109308, "uuid": "76f58a2f-ad9c-4058-b292-a6e92b570a79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109308, "uuid": "823e8a6f-fce1-46cf-97ba-8ab3625b5ebe", "value": "NovaCheat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb81339-64a2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781078263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781078263, "uuid": "24c0576f-2ba4-4dfe-89eb-977be9bf93a2", "comment": "Malware payload", "value": "e9ea715a1893847315e6160bd051e986", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781078263, "uuid": "cdf379e5-2ba3-43a9-bb69-1ef103d64b22", "comment": "Malware payload", "value": "9ee509581356a191b62211602d84dfa5189f5ceef361ca09e713ca49657ef39c", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781078263, "uuid": "4998059e-e327-46cd-8f36-6c3b8961b312", "comment": "Malware payload", "value": "a68bba4a197a85bcc393ac1398bd76bffdc88153", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781078263, "uuid": "bca42a88-acfd-43d9-8650-c9ff6f0c1b82", "comment": "Malware payload", "value": "888bb7da4fa5518153d1fad0c6726f1f1323d22cdcf0bfb242f6a054934d4596fba96a29d07541ab69f85afe1d5bc1d4", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781078263, "uuid": "b74a1c47-10ea-421c-8a89-045446ccc748", "value": "T1FDE5236EEB2C4418D9118D30A33C97F8689DA7C64540C41FB248FA4A87E6F57D7AF22D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781078263, "uuid": "b7cd9614-d227-4458-add7-1a030d783389", "value": "49152:FnLkeh9yzJLfFGoEdpYYSlegVeI9n/8OwDUkrluGcF96YFHHcAkoPPnr8AAZeBt/:dkeh9qJbgoiI9UlUkr4T96OHclEPr8Av", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781078263, "uuid": "49183387-e784-4952-af03-4f224c0f9b3f", "value": 3039509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781078263, "uuid": "f67ec6f4-4435-4032-a097-b9bb88af64e7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781078263, "uuid": "d5ca75d1-b721-4aae-b844-d7bd8465e25a", "value": "Copy of ITR1_AY_2023-24_V1.9.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51cb8537-6476-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781059476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059476, "uuid": "547c3581-a15f-4a4d-ad1f-af0cf79cb4ff", "comment": "Malware payload (Mirai)", "value": "fa3ed7dc11bf3dcff56f71650c6f9676", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059476, "uuid": "cb51f802-e76b-4839-8958-d29cace65c34", "comment": "Malware payload (Mirai)", "value": "9f2d99ed2138738f63f97cb925f7bbe6f3b2f6e64c4a480d1d51a97de9835dac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059476, "uuid": "3dd1c15e-4997-457d-8d52-827ef121675d", "comment": "Malware payload (Mirai)", "value": "3d76e03ac63aa8bcb0b4df7f7ffbea7c2dfb6f01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059476, "uuid": "b8e65ebc-fd7f-4d23-a042-5dd78497cd23", "comment": "Malware payload (Mirai)", "value": "eb2d82118e5e8690455324d6ecdebe13ae3518cae10c1b8bfbbc0f4a7527799536030bb9cd47e711ebe40191d6443f8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059476, "uuid": "6ec5b8db-4f52-43ad-b704-a693111b5d9c", "value": "T14FC30AA6F950DB62C5D1267AFB5E4288336307B9C3DE3202DD149F3427E795A4F3A902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059476, "uuid": "5d9335f0-0733-41bc-855d-6e40229154f9", "value": "3072:wxjWhmrnHcBQPDpNnhJhKa0o1mYzX38Oyicg:wxgI8BQznhJU3o1Zzxyic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781059476, "uuid": "e94a2b5a-f744-41b5-991f-b464d91639f8", "value": 128696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781059476, "uuid": "a900af8f-79dc-4b30-a400-983d940d033e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059476, "uuid": "fda02a00-06a3-4254-b2ed-e800f6e44b7c", "value": "wife.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16121b5e-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1781108768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108768, "uuid": "5c3e3d1a-110c-4003-92e4-efeb3678d49a", "comment": "Malware payload (VIPKeylogger)", "value": "4389fb5c179271d289cf0809fd37292c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108768, "uuid": "4e67607f-bda5-4bd6-80c5-94c8833acdf5", "comment": "Malware payload (VIPKeylogger)", "value": "9ff945cc99835e5e2aef9daad57b30df66624216439c970a18804d1ccb22a1fb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108768, "uuid": "9f577986-084c-4d2d-ae91-a39ff3588eaf", "comment": "Malware payload (VIPKeylogger)", "value": "11568b3aafd39f62a2af5936493942652b41f487", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108768, "uuid": "988f0921-eb57-4403-a6ef-6aabc5c930a3", "comment": "Malware payload (VIPKeylogger)", "value": "9dbccc24a81ce896c04f3a4ccba2bf021117394607257d40eac116362c265543fe91635f13d7db533b9068975a9471bd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108768, "uuid": "63519658-e007-491a-a781-3ada142a3660", "value": "T1FEA5275303851BBDF69D0EC9C94B215B20F2D46B7D251298EBB36EE7BC3B9849430636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108768, "uuid": "2f15cde7-6470-41eb-8a3f-dc6fb84cfdd4", "value": "1536:CVijD0pSKQfKxfXF+tCqDqCWPGItrlG5JHJq8LLn73b1E5bKBhaL2YKcIENUHpge:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108768, "uuid": "bf9edb3a-ff43-4c9f-b2d0-62c8dbcf2093", "value": 2112268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108768, "uuid": "0a55dc7a-4924-42cf-b8af-2d4f96852755", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108768, "uuid": "b04f2144-6d6c-43c8-8536-7bd7f6f7fa0c", "value": "LX_We5PKKvlqo.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "359f30a3-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1781108821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108821, "uuid": "b743d99d-2ebb-4c58-a74f-a8962ba20407", "comment": "Malware payload (SilentNet)", "value": "75147797de28121f99b8289ab7ad789c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108821, "uuid": "85053746-6a8f-40ca-a888-e3988e5f4b16", "comment": "Malware payload (SilentNet)", "value": "a0088b6c9780d9fb9a84ed2c4deddd89ec5494a1b4ce82212e93ee8ea5b3d0d9", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108821, "uuid": "8b10fc87-cd02-41ed-9e4c-a99d4b177f84", "comment": "Malware payload (SilentNet)", "value": "5d44ce49a6a1c54a4c28a2773fa8af11bfd2fdc3", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108821, "uuid": "cb6eb9a8-f534-427f-a177-09bdab55152b", "comment": "Malware payload (SilentNet)", "value": "5260182b8605c1e696f1ceb3e92872ece40f5c956b0f638907fdcb5d0ff27815605875f03b6e7c2787b8f3d32543b3d0", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108821, "uuid": "760a5a0b-4fee-4419-aa5d-a3d50c8f3560", "value": "T125E312C1F2B0C976D15B7EFF06CBEAE50A441BB0C289769288B408C36579A545F05B7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108821, "uuid": "c212d9ee-5a06-4fcd-bda9-3e796ef883fc", "value": "3072:1JDA0zRaS8LLT4jIv35+1T3+NNwmI7dyPgUoIWls4ioO7Af9sd9:1JRQLLcjIhMQNzIByPgUoIYs4X9sd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108821, "uuid": "bef41b5e-d943-4c2c-8d2c-5e550be1d242", "value": 147082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108821, "uuid": "6e8ba976-c852-4ed4-9eaf-4fd26fade2f8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108821, "uuid": "ed14add1-2076-4678-98cb-4ae7ebee5bda", "value": "DuplicationMod-1.21.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e17edc-648c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781068965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781068965, "uuid": "06fddb22-fdb6-4f40-9174-5dd9faccc9a8", "comment": "Malware payload", "value": "f5c5a2cd3ebe75d6234b34c1b9cdee62", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781068965, "uuid": "22158c89-c8ef-4caf-9dab-5ac6e3aad26a", "comment": "Malware payload", "value": "a035e0bfd2cce492ff9b54ee668934775d53dd9f15b6f10d25bee1c88966cd1d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781068965, "uuid": "9a75c864-6296-4987-a35e-429ae0dbf982", "comment": "Malware payload", "value": "cc11e49a8eeb6de7e4a987be948768ac2cdd415f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781068965, "uuid": "5bdc7101-b3eb-4cc9-a57a-bb91c66c96f4", "comment": "Malware payload", "value": "f788a1a01d5dd208929be96702e349b85db9f20d00318dd8899df756a3da10f883118e14760822b2e8ef4d94e7db287c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781068965, "uuid": "338ed457-addd-4a0b-acda-b553d37d25d6", "value": "T13801ABCAC002DB5001CAE49E729B51C0FC20C3CB65490BB87F9C483D9BF9748B056F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781068965, "uuid": "7d0666f8-2a8f-473e-9342-18107baa3732", "value": "24:kXCKysE2hi0ziQvZohaXmswXtJSiShMu7:e9Qp+MsX7MKNP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781068965, "uuid": "c1d9ad27-8005-4259-872e-22d37da66c18", "value": 822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781068965, "uuid": "33775f13-0419-4548-8417-83032dc4385c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781068965, "uuid": "b56c6df0-5cd2-4d21-a5ed-f32d5a111648", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e99388-650a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781123236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781123236, "uuid": "48a40299-6fa4-43db-b611-789a70379cf2", "comment": "Malware payload (Mirai)", "value": "8fb39f22185f206f6492a5ae2b41725e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781123236, "uuid": "69223343-4691-4556-8367-18edddf8fb73", "comment": "Malware payload (Mirai)", "value": "a095790d4ae3da89e817037dd1ba8a22e31f02c1e05dfed580c04e1e15433a32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781123236, "uuid": "5b4312d6-b03d-4e37-964f-b54b6ea47626", "comment": "Malware payload (Mirai)", "value": "96756478e468e8ac80781d52876004e11645a36d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781123236, "uuid": "ba0c202d-7330-4ceb-ab2b-c3254bad96e2", "comment": "Malware payload (Mirai)", "value": "1191a09ba62ea3e9e4c7670c27c4201c2ed486b5da92341e0439cda2466fdc7ae0811ae2caf162df1fc8befd3c1ea686", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781123236, "uuid": "cdd5440e-b2cf-4724-9641-0ab0b03da591", "value": "T130F308C7F900DEF9F84AE73648130806B130BBA254925A377257356EED3F1990977E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781123236, "uuid": "c1953997-2a17-41c3-acb7-08c93f7d6415", "value": "3072:GZ8rEGFHnNBgcml5yPrpVTjbiXLFWUijNkysqDLtZ3yufVME2:OjGFMcmOPrQLF7Ngbyu9Mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781123236, "uuid": "cf0c405b-c22c-49e0-8458-df3635f3d740", "value": 159756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781123236, "uuid": "bdf2e267-9478-4e1c-9e72-48e6ddd9c231", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781123236, "uuid": "58bfe3cb-6a95-4db8-8439-f7f8723fc803", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83c7a77-6517-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781128878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781128878, "uuid": "26fdb7de-caaa-4132-82a5-7431470e614a", "comment": "Malware payload", "value": "7f8a0362569693665d5b070610b87281", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781128878, "uuid": "6a90501d-2a7d-4d0b-b2b5-0842439712a4", "comment": "Malware payload", "value": "a0d320576df7aee7158e723e8d69d7629d8963aedff8584d8ec171152bcc089f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781128878, "uuid": "d3d99543-05db-40fc-9094-1552fabeaf45", "comment": "Malware payload", "value": "922747f210aaf2a4864651bc12bc5e79f471d38d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781128878, "uuid": "e051e5b0-f128-477f-9a2a-e6ecc091199d", "comment": "Malware payload", "value": "b6a49ee70c47f78f507766d41a976e95bd03aab19b3051058346fdb6eb5d0e452c29d7e9793451610e11897ca19292db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781128878, "uuid": "011483f4-e0b5-44e5-a49a-77a22bc63ef4", "value": "T16F22F608ABE88735E5BF8B7849B383151273FA02D923DF9D5CD8618E5C237419C91BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781128878, "uuid": "e7db484c-c4af-4594-8f63-39fee3d492be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781128878, "uuid": "d55a6f0a-b424-49ee-861e-24ccc82dabde", "value": "192:i1OZP6V28bn183UFhfgLYZw6zaOaC9HIc8ny2V:i0x8jYsZwOaOaC9Hr8nya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781128878, "uuid": "221a8fff-ccc8-469c-84ed-d9ccf3eab32f", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781128878, "uuid": "7b52c418-1d11-4146-8c5d-7be4ea735c8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781128878, "uuid": "937de531-1d76-4399-a6bb-8eef2ad64970", "value": "rLunaAdrianaEmilyRocha.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4707bd21-6522-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781133332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781133332, "uuid": "dd10b333-12a4-4f61-9ca0-10d22ec822de", "comment": "Malware payload", "value": "20af30fe77da202a41553dbed9a34162", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781133332, "uuid": "7540e9df-e84a-4061-bbff-480d6b955a08", "comment": "Malware payload", "value": "a1112e85ac72288c90608a1d63112f82583124d13af696163967469b27eb3347", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781133332, "uuid": "4adbca77-4224-4818-81b7-a931f06a4e4f", "comment": "Malware payload", "value": "bac3f02d974354b00b81e56789982654c0f3ad9c", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781133332, "uuid": "06819191-7690-470f-95d5-186897449e0e", "comment": "Malware payload", "value": "39c43fa160f7ec1cf7a529b2f2d8c76ee04e6209bc7347446bb03cf160295cffc2d5671ba964d90a05e061edfd3846ef", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781133332, "uuid": "cdbfb3ba-1263-4f1e-ac53-7391266392b1", "value": "T1B774E012FBE508F8C53A827488740906DFBEBC590B609FDF676942561F226D49E3EF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781133332, "uuid": "ab0a8841-22ad-40d2-a689-a6b3e8da7ace", "value": "c2c07d016165b4ccbeec8816fabf7935", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781133332, "uuid": "51939ab7-ef36-44d1-a746-e9045e5ac02c", "value": "6144:feFoxXpM2GEoZ2nwqEwcskkiJgWiC/3Dx+IQSd9PXwA:feUsEO2nUtsIJhP+IQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781133332, "uuid": "3d2f0571-ec85-44e9-a698-dc2e21cb928f", "value": 353280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781133332, "uuid": "78ffe5c3-e079-4cb9-9249-cc6e25c21783", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781133332, "uuid": "f5c672aa-049d-481a-a345-c390c78c94f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e89f6a0-64cc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781096300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096300, "uuid": "d2c049e0-3845-4c12-b6c3-c369e7d69c15", "comment": "Malware payload", "value": "f64df355a583715c3b38d90a7c6b6b8f", "object_relation": "md5", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096300, "uuid": "0424f88d-5264-4627-b232-51339a6400cb", "comment": "Malware payload", "value": "a14dec776e8496f6b4109982ca7ee73dc930131eca78853f537d958a3a3e2d18", "object_relation": "sha256", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096300, "uuid": "cb443a5e-e077-423a-ad2b-df13cc45fbd0", "comment": "Malware payload", "value": "729a4ac10caa65bff9339f9e4f61873b7812d0e7", "object_relation": "sha1", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096300, "uuid": "b6cbd228-21f2-41a8-9e68-1319ae823f46", "comment": "Malware payload", "value": "b2cd0137f0a59b4692457e0be1d4738efc792870ccb1c23a722ad7390f02c27ef36e978de9a8c3687b472d24e3c082a7", "object_relation": "sha3-384", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096300, "uuid": "546da59c-8ee4-40aa-bba4-657de14a8446", "value": "T1AD730239B4ADCF33624608365C1E8D87CD49EF085D0EB4AD940BAB9495A8CE7743E1D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096300, "uuid": "982bdad2-9b5c-4b67-a041-7b540a123ed0", "value": "1536:xYg0cb2ztQV9x45MRC4LwCzHPwCyXV2Fk6Hy/gY9gNw2lzs:xzZ2CjxjXLFzIZ8kmymw2lzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096300, "uuid": "40392da1-22e7-4fba-a31b-9c3e3a72ad7b", "value": 73805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096300, "uuid": "100a0260-874c-402e-9cb1-a185ffbf36de", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096300, "uuid": "d7d6bd7b-5c71-43f1-a044-1db406931e3a", "value": "vmdThreHu.vBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1447ba39-6494-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781072258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072258, "uuid": "2f1521a1-fcfb-45e4-a688-b1e7ea149076", "comment": "Malware payload (ConnectWise)", "value": "a65082f48b2209350d523260a5e6b1be", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072258, "uuid": "4d14f4dd-7b44-4c99-8efd-f5ca57d927f7", "comment": "Malware payload (ConnectWise)", "value": "a152a44c91019701f0cc65ddfabf186caa376ba9e4535ac5a94e56903e0caf10", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072258, "uuid": "62ab52b3-bdb2-4619-9a82-2041ddce29b9", "comment": "Malware payload (ConnectWise)", "value": "711213549c7f5a31c379e5b81457bc7b2846dc84", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072258, "uuid": "dfae7986-f21a-4b48-8767-4fe60c680c23", "comment": "Malware payload (ConnectWise)", "value": "5efd4706264c1590aa223b47778575cbfdff614d025db7db66200cff48a6e865a305485cf7bd00e119e9aa9640541b29", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072258, "uuid": "f9c231b4-92d4-49df-b7b3-0f9e4eb508ba", "value": "T137646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072258, "uuid": "5d63b19e-cf88-445f-b097-19d83a3087d4", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072258, "uuid": "b2ab447c-b87e-4c4c-9a4c-55d43162fe27", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:h1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072258, "uuid": "0eff13dd-220d-4867-ace0-bb0dcea629ff", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072258, "uuid": "520e5a68-b273-40e4-9ec6-f0715dff1320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072258, "uuid": "852345fb-934b-41c9-b377-405a0e8a4e90", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f8edb2-650e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781124851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781124851, "uuid": "f274eb61-e642-4f3a-bb6e-c5d089065c46", "comment": "Malware payload", "value": "e3a0502fbb79fa3093017e7c70eedca5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781124851, "uuid": "ee4ed54f-4443-4f78-bad8-43cc8a850248", "comment": "Malware payload", "value": "a1b9d6336de8371393aa5ed53e82f16c49c456d3cac7176ffefcb77b0d2fa0a7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781124851, "uuid": "a7d7fcaf-a776-4bac-9677-545d46df674b", "comment": "Malware payload", "value": "9611f0ba30d3fa77556acdb7c6a985012b55e3bf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781124851, "uuid": "34595b75-862b-4f5a-8d4a-7dfbb729abb2", "comment": "Malware payload", "value": "3c03557fe9b6ed6c497727192cc02e7f281f467665ca5374598580d9437c95d86b593171845fb456540f02f8183b8b90", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781124851, "uuid": "0c81d1fe-2524-4e9d-9ee2-d4ca3a3d4402", "value": "T1C7F0629A227063F2E7DDB806400F98CA534A12428D652E49F0113EEE7FB1B74E18F547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781124851, "uuid": "8276a7ea-ba04-4f7a-97fa-e1bb1c5d324a", "value": "12:wTZlEG92J9gE6Y9vsY9T9J9FAY9dT7Y9E9Y9tcuwoHw+5quqxQ:wteG92J9wY90Y9T9J9iY9d/Y9E9Y9tcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781124851, "uuid": "2af9236a-aefb-4ba7-801f-b438cf4f57a2", "value": 597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781124851, "uuid": "e3879ccf-30df-4dba-a3aa-0bd038f2ffa0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781124851, "uuid": "34d334b6-5070-44bc-970c-63b595f674c3", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7063fbeb-64de-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781104195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781104195, "uuid": "a553d5ce-a30d-4e93-aa64-c9acc2d49b9e", "comment": "Malware payload (Mirai)", "value": "29e2b6286b0edccf9a5ad161bf27987b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781104195, "uuid": "f56ae855-036f-4242-bec0-1954b5efb77f", "comment": "Malware payload (Mirai)", "value": "a1c2680e81e2881d554cfe33c3eb0920b8aec9d75e3da6313b6832bca142ac2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781104195, "uuid": "86833c86-527b-431b-8820-e3e4038b25d3", "comment": "Malware payload (Mirai)", "value": "f599a49e5e67c75e071038e081f6ffab7c4514e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781104195, "uuid": "0c92da95-19f5-4576-89aa-9aad917f5031", "comment": "Malware payload (Mirai)", "value": "87b04e7d7860a8b2fe82ce7994d0dbe93922054910a5b08f799bc27703c1a03c7240a309f819da061cf0a3d1ac23fecc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781104195, "uuid": "f04258ab-21bb-4180-b0bf-33fe210abdd7", "value": "T1CFF3B61AAF610FBBDCAFDD3702E90A0539CCA54722A43B753674D528F64A50F4AD3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781104195, "uuid": "6b0f8219-c909-4115-baf3-077c1bd3fd8e", "value": "3072:kkUGyWSETqImbnfOlA+ZZDjvcXcxP+5r:FUGyWzTqI5lpZBLcXcxPQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781104195, "uuid": "be702a8a-1228-4376-a205-48d1bc51d6a3", "value": 161152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781104195, "uuid": "38688c96-d6e5-4a71-b0b6-cb4032a1bccc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781104195, "uuid": "69713602-b2cd-4c4a-83f1-bea35cd773ca", "value": "CRY.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96859e49-64e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105977, "uuid": "3c80714b-a78f-4d0d-97a5-aa6c1db47de3", "comment": "Malware payload (Mirai)", "value": "b6d8b86e32323dd53707f9809f9c07be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105977, "uuid": "964fb30e-1b23-46c7-b8dc-58410beb96f2", "comment": "Malware payload (Mirai)", "value": "a1eee0f4eb1e1d5e229b5e7b127257ac7b57499ea0687de0ea4955d9bfb88b11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105977, "uuid": "b1663148-93c0-48e3-a0e2-787eb9aa92f3", "comment": "Malware payload (Mirai)", "value": "fdf0c6e9319dc6d5d6a750399e57e980533b3045", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105977, "uuid": "d5e5fbc7-1565-447f-a839-b272094cccad", "comment": "Malware payload (Mirai)", "value": "ef90edf62f93b2644f955d84b9abc6511ff540c2e76c7f3ac634ea2c5c7fd3b798c083c1308c7c90032bd62a2246d8e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105977, "uuid": "9bbe7c73-f4cb-40ae-b977-2689a69b9fc1", "value": "T139534B99B4028E3DF88FE97984160E05BA2023D112931F276BAFFDE37D331659D16E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105977, "uuid": "8d491a6c-c3e8-4a6c-a0af-6d35ec686cdb", "value": "768:2eY49YE204qEkRf/36fmODeiuQlJZvTgFHq1euk8B8vpG97ErlfXySJ1oXTo7PI:2Y7EkRfPh3iDx8Fq1Xk8B2aErlfiSJFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105977, "uuid": "7d66c8ad-86c0-4c5c-99df-db905a4bf05f", "value": 65096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105977, "uuid": "5b4b5024-b265-4305-a467-2defa7bd4b2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105977, "uuid": "8f9596fc-9a24-492c-878b-51261dbf0b51", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d59f07-64af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781083909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781083909, "uuid": "0d07713f-227a-4ce4-96c3-84b252acd4a3", "comment": "Malware payload", "value": "cb563e993fe73d6eb1a6fdb1794c92a7", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781083909, "uuid": "f76b436c-3998-496e-83a1-e4686dc40d31", "comment": "Malware payload", "value": "a21279b2cc36c7aaa8328e408d7e463c9ef43853349a7e6d6b70f555bad89e54", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781083909, "uuid": "6d26778f-970c-495e-8c69-94b26f8f2a14", "comment": "Malware payload", "value": "ff81b0aec6b42bb27b6710884612fd355dacfad3", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781083909, "uuid": "f2574160-dd51-4e8d-a310-779e03e6da74", "comment": "Malware payload", "value": "cca7283145686b1cb8bbb478ea6671c9ebfe75325c3efe79f9ce64d33609723f46aac74ba1813c8f8707186712eb9064", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781083909, "uuid": "8e71b1af-12c2-429e-9040-d0c01017bc8a", "value": "T175862B776088EBA6F70AF8B2D10B1956F29DEFA045780E516474CBBA42E36414F87CD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781083909, "uuid": "8fc8f8f5-6685-42b8-b4d8-8704894dc48b", "value": "98304:AqR+iXcqyuuh1wWM5/Klp4jft9IWOhXOkBDQsjt/pyimdy:Aq0ujm4LvIWOpZBXRhmA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781083909, "uuid": "97e35e3b-a2a7-484f-8936-dbb3607ab9f8", "value": 8192000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781083909, "uuid": "eff3303e-09a6-4fcd-8d93-6644b5d26675", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781083909, "uuid": "f8c921a1-8fef-4ed8-bded-45da43aeba60", "value": "Iranopasmigirim.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22263b0a-6494-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781072281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072281, "uuid": "ad33f610-796a-4c9e-8947-e86862362e56", "comment": "Malware payload (ConnectWise)", "value": "425a27831269fe6eb48a723096e6ab58", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072281, "uuid": "1d3f880b-2c41-4dc2-b8f9-91a02f5097cd", "comment": "Malware payload (ConnectWise)", "value": "a21e835422323cf7a4412256ae2ddfaf7fe00b887bc129aa660d65929bd82557", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072281, "uuid": "acfa738d-b70c-42f2-a41f-16651712ca50", "comment": "Malware payload (ConnectWise)", "value": "96015053774918a715dec29ff324f6773522c804", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072281, "uuid": "e8b077f4-526c-4010-82e0-dff4882638a3", "comment": "Malware payload (ConnectWise)", "value": "b7c8b2fd937741101f805e742009eefc5e847b01c2faa0cac40c9adcfdf102d5c6f1cccb4fbee914a1d91cd53f9fbf16", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072281, "uuid": "f34c8a96-0e09-40de-906e-a93fa0ae045f", "value": "T18A46E111B3DA95B9D4BF063CD87A82699A74BC044712C7EF53D4BD2D2D32BC05A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072281, "uuid": "ed295e3f-a545-4fc5-bbfe-0254fffccc7f", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072281, "uuid": "941ffcdb-2bc1-4920-a80f-69d9bb18d801", "value": "49152:OEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:7Es6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072281, "uuid": "59962e19-d62c-4b05-abba-e2006ccdb4dd", "value": 5620576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072281, "uuid": "a83feede-2768-458f-acac-b2fc4b9ab3b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072281, "uuid": "dc87ae64-8118-49db-a9e6-2854db76c3d3", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ae8345-646f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781056428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056428, "uuid": "3f8cf115-123d-494a-b60a-c256f4ecc506", "comment": "Malware payload (Mirai)", "value": "fbd7d3c945bbd7c7d60c40b8502e301b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056428, "uuid": "cbb0d5e4-a907-4858-bba1-b6717cf73040", "comment": "Malware payload (Mirai)", "value": "a32c732268dba58d78652994fb0b208d8214c0e20632a1a586ad7331830ef27a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056428, "uuid": "99a7e558-4529-408b-bec9-387a8cb642ae", "comment": "Malware payload (Mirai)", "value": "9770313eac184ae83d85c5aa95daa2be3ca9199c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056428, "uuid": "0dffb825-6454-4953-aece-2b91c0580026", "comment": "Malware payload (Mirai)", "value": "17d4417c83eecaa34c4532e788928006a471ce97bf09f7a32563f662ae0d7e6f2e0a63f4a9808473f59303fcc38f5fa7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056428, "uuid": "231bdb60-cc90-4464-8fcf-8f75c26cda69", "value": "T1B96302255029AC31FF9619F0EBD6A3F8BF0098C69E0454E7E9F327255CB646B4612ACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056428, "uuid": "74a8d08a-da7f-4a9f-aad0-b48c45bea6ab", "value": "1536:P4hRwR0fq7oNL4FR0QxN1k7C3vQSrFjTsaupIsQOt34u+qgw0t4V:PZEZL4jZO7YISjTjRsZt34u+qgwI4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781056428, "uuid": "6fc66141-2d47-4bad-9e4e-1854d53e1388", "value": 66884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781056428, "uuid": "19ac740e-b9e1-4c4f-8098-8302c6c5278f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056428, "uuid": "4c47b2e6-f92c-4771-9bd3-9361b729242c", "value": "wife.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41dc71bd-6494-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781072334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072334, "uuid": "2502fc63-416a-4f1f-a70f-6925958d0c20", "comment": "Malware payload (Mirai)", "value": "e2574ae44b490f1ff8661c1a8defa996", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072334, "uuid": "188b2a37-b289-47cf-b259-0eb1af687e68", "comment": "Malware payload (Mirai)", "value": "a4ee376bd6388fbc3b852b27ab057453d489ed8b380a99a1a5e4ab88eff86802", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072334, "uuid": "d8e03a4e-03e7-4dcd-b4a5-9cbb7edcc920", "comment": "Malware payload (Mirai)", "value": "48e8bb32c92a1a022371a97947f4914065784467", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072334, "uuid": "684d6cd7-593e-4130-8ced-6f4f5b4805a2", "comment": "Malware payload (Mirai)", "value": "37b60255aff1cb2f1a9c2813d3e0952d2918bec2e7dc81b89ac3a13189834ef89f4c719355a029d482d9191c62b040ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072334, "uuid": "b29f7a55-cd0c-4ff9-afff-218e6e8b19b6", "value": "T15A83E60AA9419F01D59731FAFB9F425933536FACE3F97101D9246F6423CAADB0F62212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072334, "uuid": "d1ae79f3-5c7f-4a8f-bd86-8a48294247f8", "value": "1536:rin85Z0jtLQmBE07vCYaAwBcq51Si94ll4jei45K9XjeXyYQg8Gby:nARkOd7vCYaAwBcq51dY5K9XjeitGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072334, "uuid": "4b5ade04-90bb-490b-8b2c-fbf42980d22b", "value": 88468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072334, "uuid": "01a50eff-736b-427f-950f-d914263058ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072334, "uuid": "903e1523-8f70-4f34-87d6-090d78e74ffa", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76cde1b-64b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781085524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085524, "uuid": "031de762-1228-404f-8d70-b1cb1ac75596", "comment": "Malware payload", "value": "3f9ee4b62da9a197b9380f6594aeef12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085524, "uuid": "8ed3b6b7-bcf3-4ffb-b147-2971fa0cab62", "comment": "Malware payload", "value": "a527a96b091730408c62fa1414052cf7c527724d93a537f821d18333cfb9dbcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085524, "uuid": "6b098b2e-88c8-4c99-b486-3fb8e7d19507", "comment": "Malware payload", "value": "f2e8c513e2ad1f6aa5f02e7290da527d6498c0cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085524, "uuid": "026db863-d94f-47fa-8fb0-fb16bc29b1f1", "comment": "Malware payload", "value": "a9c66440c40330fd6c9d6d7a014a86abe02b52ee5dfcedd98bde306413d6f3d182c2f3d6be5a9a94a356449e42c0da6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085524, "uuid": "b3c304b6-0661-4ef0-a02d-c50b3b906c39", "value": "T11F722B05F7E049EEF479C371CDB35A19E431BD515B32A38F93E0092E0DB2AC0AA21B24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085524, "uuid": "48190ceb-8a9c-4f95-9d43-78bdf76b0121", "value": "8e5f0b7b295438a966ec0e9c844ba0c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085524, "uuid": "4b2150c2-b86b-4aa8-b3af-4dff337f156b", "value": "192:9sgMluZdHvEmW7239rplYJaS/DKut8vegrbxQFV4DFcW5tf5L5FW7a:ugtZdcB723GvF8veghQFV4JcYFW7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781085524, "uuid": "8b87f77b-3bff-4e82-b6c0-5752f731ca2e", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781085524, "uuid": "1e06397c-0d7e-48b7-b4a9-040cd1412d1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085524, "uuid": "326e010b-9438-4259-9ab8-e965590e5f86", "value": "a527a96b091730408c62fa1414052cf7c527724d93a537f821d18333cfb9dbcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e0896f8-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781108862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108862, "uuid": "038fe746-4b59-4995-a217-96e6e9ed89bb", "comment": "Malware payload (Formbook)", "value": "a6e56b9f0d0a441c6ee043f6833e5e58", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108862, "uuid": "2c7a596c-4145-4bc1-a37b-980dc5a192df", "comment": "Malware payload (Formbook)", "value": "a52f2947d9dd682c59611005ad253b9fb1c2ed0bfee7696e9c34b609755c41c7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108862, "uuid": "b68f7176-fa0a-4caf-be89-802a99c7d70f", "comment": "Malware payload (Formbook)", "value": "0ec9d2fdef2c10a85268d3bd51c829669c376127", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108862, "uuid": "aeae6d66-78d7-41b0-b4f1-b3d1b28e39be", "comment": "Malware payload (Formbook)", "value": "b3fc1d4b0860789e26f0b2b4acd0a5a7c784a9e15cdfa2bdb8f33995421be6c3e610b60805ce3268a181d336e4ba0faa", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108862, "uuid": "409e25a2-a418-4396-8bbe-e328398977e1", "value": "T1B7C244CD37C2B8604377B47F3D6BA496E1AE0C81A74884C4F726B494F8A4718DA7AE54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108862, "uuid": "d6727df0-f4b8-4860-bf46-14d3d1a02e89", "value": "384:XKwGISQwLfy1AnSyXIP+q7y0lGSiby0BlPLgvPyie6Q3z5UMSvxauPNFHknQJFXp:H3S1nXO7y0/31auS2P9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108862, "uuid": "53aba24a-4200-47d5-8b6e-046defbf94fc", "value": 26387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108862, "uuid": "6b54dffc-0b42-48b2-a938-f725b739d453", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108862, "uuid": "12373a59-bd2c-4462-a8b4-36c2548e149f", "value": "Quotation Request_7009.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02b71f0-6511-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781126314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126314, "uuid": "94952299-2161-4f3c-986d-5353683328c7", "comment": "Malware payload (Mirai)", "value": "a656c139319cf558e2b180d19fc423ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126314, "uuid": "2a81a6de-5251-43f6-9be9-b3014fb08b61", "comment": "Malware payload (Mirai)", "value": "a570938e00ba22ed95e64cf214b3215f86056411bf7c3452bbc5431591e35b07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126314, "uuid": "36316203-1c61-4dae-a7bf-9a9fd95c18ff", "comment": "Malware payload (Mirai)", "value": "fc50aa6a6c3037f69361f1f7279ccb3d96575435", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126314, "uuid": "de50c36d-68ac-48f4-9b7d-33a67f484250", "comment": "Malware payload (Mirai)", "value": "9e9337752bfd43c520c92782b93bedef376ff1237843599cfaaeb9151127761c20ae92d93dc7296b1fe3e6d3eaa5f15e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126314, "uuid": "a179594f-b59c-4245-a32a-02d9f27bd113", "value": "T18DD34A46EE818F03C0D5177ABAAF424933229765D3DB73079D285FB43F86A9E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126314, "uuid": "7160df77-d7e4-4131-9a67-160de19b5d5e", "value": "3072:b2N8tJk98/uHv8BFVlX0CTgb7SzM/9Lqfe:yNgkGuHv8BF7X0rb7GM/9Wfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781126314, "uuid": "ca255e7c-df2b-463a-8f2c-e723946171e5", "value": 131489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781126314, "uuid": "1c3797b4-6bbe-4604-a6c2-509d4f131f15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126314, "uuid": "1898dba4-45e4-4c99-a956-163f3083338e", "value": "kwari.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15114945-6494-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781072259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072259, "uuid": "1f69f9c7-66da-4a08-a7d6-f18e5899e735", "comment": "Malware payload (ConnectWise)", "value": "5f896a6edc2800758311f3151684d132", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072259, "uuid": "cb2d1949-7a48-4292-99d9-163537646e37", "comment": "Malware payload (ConnectWise)", "value": "a5d0320abcd412ef6b44c71259310e97b68f3bf74e1275314814c2b61a2cc439", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072259, "uuid": "73ab6f21-687e-4607-9164-a612d010633b", "comment": "Malware payload (ConnectWise)", "value": "801c2958c79a0778cd02f4ff2a5b5d0af5b71d08", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072259, "uuid": "5d926c57-3126-4776-8696-db4a5a0b656b", "comment": "Malware payload (ConnectWise)", "value": "c6cd86cf13677c229cef53821e348456830c4ed1a5f062b64ce90108c7ae5ded340f84f8d92e97102e0bd5b7930b19ef", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072259, "uuid": "80f55952-e1c0-4b6f-b79a-419ac9abb42e", "value": "T1E8837C43B5D19871E9721D3118B1C9A15E3FB9211E348EBB239802AE5F741D0AE35F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072259, "uuid": "3a6fb7f5-fba6-4d96-b006-21ba5ba09992", "value": "1273eaec87da7c0a308253f29e7857eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072259, "uuid": "2564a563-8601-4dd8-85a6-5c6752dd12d2", "value": "1536:VXn1JYSnExFkcgKKjxfmqshiKW5Xs/iYQqQJtsWFcdfRMvb+xWeuHil:lE3x5KBDYiKWm/iSw0fRMvygej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072259, "uuid": "d87ec18b-d0c0-44a5-837b-b327534c312b", "value": 85272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072259, "uuid": "044b2919-0246-4a7f-bf7f-c9722126c3f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072259, "uuid": "4ff09810-aa5c-491c-ab9a-26b8fc59954b", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4676b31-64a7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781080660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080660, "uuid": "102a4391-f61b-49b2-826b-b3229a09244f", "comment": "Malware payload", "value": "717fdb93dd6d70a431a5212001dcc570", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080660, "uuid": "c0584cc9-50e8-47a8-a734-cdb8673e1581", "comment": "Malware payload", "value": "a603815970caa1768f4f6d4164ff87f3b397cfdc509f401bf22e330f313925e7", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080660, "uuid": "e9959799-bb29-43f4-b0c4-49da22e3dd3a", "comment": "Malware payload", "value": "2aa9796ba1b35c4694c1e9d39772268ebfe61e25", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080660, "uuid": "d16b2cbe-fba5-4733-a342-cd7aa9de9c8b", "comment": "Malware payload", "value": "d13e7142880bf03f02d8965676ff791e70bbc84e9882b73b2ea72e62659c3104585706721b915f9aef183c8ff7167f46", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080660, "uuid": "2540f074-31b4-4d9d-9c3d-de4d1f865748", "value": "T1C6B4F105F7E501F6E17B9579C9524642DE72FC4A0B60A6DF63800BA21F276E09F3E722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080660, "uuid": "82f8cf01-e962-4096-a499-b7e508572561", "value": "bc9ef82c0da7dcffb60805858eeaa4e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080660, "uuid": "99c64975-216f-458e-b14c-56836aa8fc00", "value": "12288:GCTGEx6+/6dNqI8DpeDG3FKVTe731/au:GGGExZjfpeMK1e731/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781080660, "uuid": "a86cae56-cc4f-4a39-a881-a24a4b344c11", "value": 517120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781080660, "uuid": "3e6fb4d2-8cec-4b83-97a8-8ccaab55b4f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080660, "uuid": "aa177bf9-8a3e-43a1-b898-9fb980a7d589", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ccae173-64e6-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1781107571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781107571, "uuid": "b22b8cd2-9703-49be-af0d-85a4ee7ad9d5", "comment": "Malware payload (Prometei)", "value": "227894da33532ee1172eac64c7e31d32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781107571, "uuid": "39f267d4-2384-4c9e-bb19-079bc887833c", "comment": "Malware payload (Prometei)", "value": "a659d06ebead7cc329e7baca49dec016ab925a655bfb108af05aafe1e0a18838", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781107571, "uuid": "501ace2e-9357-4cd3-ae55-0765f41450ca", "comment": "Malware payload (Prometei)", "value": "d9e4b556cd608f6b8fda542299bdf6143224b33b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781107571, "uuid": "7322fbc0-f6f5-472f-98b4-a2446395bd34", "comment": "Malware payload (Prometei)", "value": "b59d437e92f242dac222ae36a4ea5be277fcd21e02e10504fe1b08dcb03e8e7a3adb5babc7eaea90d8a08a48127c3102", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781107571, "uuid": "75356a4f-da70-4778-bef6-ce98d5e87307", "value": "T1C0A423B4F9229E9F6DD76DB91B24831DE181C172589D4C2313AE94A34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781107571, "uuid": "c7b09537-9508-41d1-a7bb-f7e0ccc7b8c6", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdc:Fs6pyCC/Ya2hpi6T6N4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781107571, "uuid": "5fb4ddd0-b176-4ec1-b089-d57adc8c2724", "value": 449083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781107571, "uuid": "6460d309-6935-41f8-b2f1-a865c78a9b66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781107571, "uuid": "a7e50a06-4806-49d7-821e-0369115e8590", "value": "a659d06ebead7cc329e7baca49dec016ab925a655bfb108af05aafe1e0a18838", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a5dde4c-64b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781087300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087300, "uuid": "5c799557-3def-4383-9a00-956d05e80006", "comment": "Malware payload", "value": "097b3d29b688bd5f72fe0c62f1caac0b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087300, "uuid": "e2307dd4-ca97-4aed-8e34-b4d0301e8387", "comment": "Malware payload", "value": "a69f91b68f1298fa14845fe12817daa579060c1e9cc9d9f20ca784da9fec4770", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087300, "uuid": "2226e2b4-00e3-4a6f-b4e8-41d26543c5c7", "comment": "Malware payload", "value": "bdc37bdcb7ab1b050e81b3a1e2b024a31f8f7c57", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087300, "uuid": "b5225e69-630a-458b-be22-bb90e3475e49", "comment": "Malware payload", "value": "7879559a94fbda2b44af705c8ad0cd2b587a9dd298787b74719ac154a2148e3eb932cb5922d91325f010b6659ca7e966", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087300, "uuid": "7467f522-f67c-4bc2-ac1e-cabb0996b0db", "value": "T11EE38D01B580C0B2D5BF1ABC2174DAA25B6F38309B255FD767980D3A5EA45D0BF34FA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087300, "uuid": "bf500777-d546-4fa4-bb22-25e804d2721a", "value": "3072:JOk274obWvZmRWdUJKFu5OvQ6kgzisQRgVAnDfmzk0qu6pFj:yTCvQRWdju5P1sQRgqfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781087300, "uuid": "65d0a700-0972-4b92-9a19-cfcb74faffdd", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781087300, "uuid": "f354a5bd-f992-4077-95e8-e3a0f8947d45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087300, "uuid": "091c0473-b7cb-4e35-ad65-1a6d7b09e3b2", "value": "a69f91b68f1298fa14845fe12817daa579060c1e9cc9d9f20ca784da9fec4770", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eec3301-64fe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781117776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781117776, "uuid": "24585a36-22e2-41b1-900d-11e2508dc2d3", "comment": "Malware payload", "value": "1a94515078d899f90b9d8702b826db24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781117776, "uuid": "e85f82c6-df25-4388-bc3e-40ccfb8c7d31", "comment": "Malware payload", "value": "a6b2cbaa8ae8430149b8022aa3bfbc764dfacb22166a750cf2ea99ccb21351eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781117776, "uuid": "272f85a4-80db-4ab8-be4b-3f183a527305", "comment": "Malware payload", "value": "963712f059a86cf14632475f3f33bf725642c6b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781117776, "uuid": "1e606d0b-b18b-4523-a3e8-1615473b4520", "comment": "Malware payload", "value": "6c52b998775629ac0cccbb9b375fc32dd6c49c0d174628b1d51e9fca4807affd3e6a146fe328ab421e3428e91076a091", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781117776, "uuid": "ec3997bb-1f99-46cd-b5ad-392f2ab0b292", "value": "T1B614C70A9F510EBBDC6FDD3706E9070239CCA45722A53B763678D628B54AD0F49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781117776, "uuid": "fb40d210-bdc2-497f-b720-8e1d2f23df7c", "value": "1536:xSRJWJuinL5ecDWx0ntFCpl+X3ON2P+xuBlnLZBYXt88HRX/Ho1wSA+SOKUJSE8G:w7WJLk+nGlk5PKmMxOt38DygHcsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781117776, "uuid": "a0047079-329e-4d9e-9bd8-e63a1c8ed26b", "value": 206088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781117776, "uuid": "7ad1f390-a4ff-46a0-8108-bf41ecd31042", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781117776, "uuid": "52fe26b9-b9b5-4e3d-a267-9a5e440abbc2", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1d7566-64ab-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781082495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082495, "uuid": "68d2843f-59da-4a0b-bba1-a1decb70b94a", "comment": "Malware payload (ConnectWise)", "value": "21c0750e92c5ee7bda26268cd32b2594", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082495, "uuid": "a4b72c86-cf83-45af-8699-98566895aca5", "comment": "Malware payload (ConnectWise)", "value": "a6f8edb254872e1f0707dbfc57b43bed91c9ea18bf0a083b53f8c7a9830e9c16", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082495, "uuid": "f769c4d3-bea2-4cf2-85b8-b6d0a2398a55", "comment": "Malware payload (ConnectWise)", "value": "f18b44f0d58793be60bce1a171f12a951199e179", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082495, "uuid": "a88df474-c6b5-44a4-a2da-2c13ba81de2d", "comment": "Malware payload (ConnectWise)", "value": "44746c183366d4c417b281bdefdb3b22bbad4e3ecf197558f424c92a1a95472b0bd2e9a00bfa5e8b324d8e7990e30221", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082495, "uuid": "ae3fd649-dee2-48bb-99f8-f71c74457a9e", "value": "T1DF646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082495, "uuid": "49ff0aad-9b1b-43c4-afee-cc10d39a8902", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082495, "uuid": "51dc9103-1a73-42f2-aeac-5466582f76e7", "value": "6144:CmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:B1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781082495, "uuid": "76b0a373-bcb0-4750-9988-4c64701dead2", "value": 312528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781082495, "uuid": "11ef4621-84d6-43f5-80bc-1ad392c87b64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082495, "uuid": "30846e75-bf85-415f-824b-aff528dab249", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb17ba5-6494-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781072270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072270, "uuid": "bc16c561-b3e1-4908-8939-935c7bcce711", "comment": "Malware payload (ConnectWise)", "value": "fd93f6144d7c3e24db66c7ac88957820", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072270, "uuid": "dfff14a7-82f0-4704-abf2-55fd4bca8a32", "comment": "Malware payload (ConnectWise)", "value": "a759dc81ff0574f4e255da80f0b19b2a3b176fc14442b320f95c5412cc5c1c54", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072270, "uuid": "cf6dbe1d-0561-4b41-b1f4-0a4404122b45", "comment": "Malware payload (ConnectWise)", "value": "e4a4195b61288d1cd4e80d40e412f55bbe6e40c2", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072270, "uuid": "4ab4a96b-2552-4b1b-8bba-8bdfcc119bba", "comment": "Malware payload (ConnectWise)", "value": "95099e6784bb59deef21b2562a7815681777d3cd7444f3b400c2cccde339a0c32028d5cce48eaf033b7cfedc4a08dd80", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072270, "uuid": "86d75f45-fab6-421b-9bb0-ccba7006598f", "value": "T183646D11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072270, "uuid": "9b924ea7-bbfb-4b25-94e9-65647c1b2081", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072270, "uuid": "8d938786-256f-470c-ba34-5de3c4b8c4d9", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9r:51iw7gryNkSV1hy1Z1u2JLu9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072270, "uuid": "9a067636-3747-4fa8-be0a-fbd06480f914", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072270, "uuid": "9846fc36-8f2a-4144-8546-716850977b0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072270, "uuid": "7dc8f50b-abc6-4b78-b7e9-5a8cf5737fda", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc40e2f-64a6-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781080142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080142, "uuid": "afef72e3-5319-467e-9211-b88041fe25ec", "comment": "Malware payload (RemcosRAT)", "value": "a7c8120cc80c42b1213aa0cff295a53b", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080142, "uuid": "ea3c5434-7e30-4b27-b0d8-d7fb35b0a3fc", "comment": "Malware payload (RemcosRAT)", "value": "a7805e8c93a87b6a6eef70042794f9a72eedb6ea7271167709b3f2c4979704f5", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080142, "uuid": "518e9cff-60e1-431c-a347-011fc7f0df3d", "comment": "Malware payload (RemcosRAT)", "value": "237637b3d9a15324bf6358ced8b17304cab90dde", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080142, "uuid": "0342f698-2422-4d23-bd5e-279ed0a7033b", "comment": "Malware payload (RemcosRAT)", "value": "6d4510462596f5a19fc02574a5c7a42f0886fbf6c696e2e002905686972d3d0a3df449c7ac04d76ec1262820cce906a1", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080142, "uuid": "26888049-bd76-4ea8-9888-dce78dbf0ee8", "value": "T16C9285B187854BA5BD6B967D8C8137022B74CFA0C17604DCFD900F04A1EE578BBF69A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080142, "uuid": "d9609ab2-ec9b-4535-97b5-918096859615", "value": "384:lzhea7RROU2NsEZ0Dy0zlHRS6cxrUZ9prVr8EEWR:lz8ex2NLZ4y0zlxX0wHr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781080142, "uuid": "905b7fa9-5e28-4116-8486-9dc5f26ef3a4", "value": 21192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781080142, "uuid": "49bb5cda-9d4b-498a-bd7a-ae63412794a9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080142, "uuid": "a81a631a-7c65-4b5c-8e99-8b0f42116513", "value": "Performance_report_pdf.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1337da4d-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1781108763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108763, "uuid": "8195fe0d-284b-4524-8ec8-1657f66e7125", "comment": "Malware payload (XWorm)", "value": "c1f3713b932eff99890bc529b0cf0bda", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108763, "uuid": "a9138cc1-ac1b-4a9d-b017-a5eaf90fb5be", "comment": "Malware payload (XWorm)", "value": "a7dc29e2e06da0093e93e3e424e2fb2bdef3ee9df4359e7c2ca9240baa9d2132", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108763, "uuid": "33f905f5-caa0-4c98-a246-a58a4fc28e5b", "comment": "Malware payload (XWorm)", "value": "1023903b67a76c55c6fee600ad2cd1f7a88aefb3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108763, "uuid": "faeb1a7a-ac2a-4eb2-a920-8aef41b87f46", "comment": "Malware payload (XWorm)", "value": "f83ba1ca4202e51226eb0902137f79d8a074832eb10e095a95674e2237b312da5ea19c6f8e169b27ef5797af792f52c4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108763, "uuid": "b42e9ee5-1c30-4646-990e-415801da5832", "value": "T1EB858CED3BCF0A0E46123AFC2F2B29516E9A4B95D703896D7E1D47560FC2880D592C7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108763, "uuid": "2a006165-e1eb-45ba-80e0-0b83a518e678", "value": "6144:soooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo3:c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108763, "uuid": "d93a484e-51c5-4588-b946-e192ad8b0de7", "value": 1830435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108763, "uuid": "b3993b6f-2a3d-4a5a-87e0-a97703c8177e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108763, "uuid": "b5993790-3d86-4d57-a805-ff4a9d55b9c7", "value": "Nuevo PO152331.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40ecdeb-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105651, "uuid": "21258cab-5bc8-4f14-bed3-864f21e8c78b", "comment": "Malware payload (Mirai)", "value": "cb6d52c89474c92ccdd14f8f0b05243d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105651, "uuid": "2229fb41-250b-48f8-891c-0fbc69c2a330", "comment": "Malware payload (Mirai)", "value": "a7fc379b28a1262c5b62ae716f5474aa373cadc8a6f0d4fd896c20d6d4fce783", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105651, "uuid": "a3415066-9166-41ea-a931-ddcab66926d0", "comment": "Malware payload (Mirai)", "value": "7267b5e09893a57c174adf4f8f800599377e6001", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105651, "uuid": "2ba1f373-d5d2-4f82-ad13-23745a805e23", "comment": "Malware payload (Mirai)", "value": "9108c42538509e9a771f7e7a93c6a7e753c25cb75a0916fa464f21b29883fb971985275c10c85138b9ab006738549a38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105651, "uuid": "45ab8509-b9b9-4e0f-879f-b51fbf31ceb0", "value": "T1C1934B02B3080E47D1A71DB0353F2BD197BEE6D121E4F689750FAB9692B6D331486EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105651, "uuid": "f8d5b800-1be1-42e0-9333-a50986e2882b", "value": "1536:XefrO+xXyy3U+M8JekB7T9/xtLUWnJKUBKgslCe/SNRcYJfqqS2JIN9S:XGptyz+VJzB7T9/bLUAx9e/SBJO9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105651, "uuid": "df4aa4a7-cd4d-474a-80d9-329df324138a", "value": 95864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105651, "uuid": "8e06dd03-da2b-416c-bbe4-f36df8b25b29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105651, "uuid": "8dad2cd4-d2ef-403c-85e6-a44cc13fd1ab", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d95f1fb-64a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1781077427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077427, "uuid": "ef085c3d-a4d8-410c-825d-594c558c4f17", "comment": "Malware payload (Prometei)", "value": "0582b2c39fbd6830d0af5b2020df44d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077427, "uuid": "2892a053-6aea-4082-8a28-c10664881d0e", "comment": "Malware payload (Prometei)", "value": "a8257682e67969ff1ab3b123be2dc088d09a3d18f7c72903dd72e67a26324f89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077427, "uuid": "86a047fb-1488-4117-a135-44623cfecb74", "comment": "Malware payload (Prometei)", "value": "1f31aded2991ffbd67bd8a6b66d5d95a63ac3473", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077427, "uuid": "ea46912b-5fdc-42e9-8b44-6e9d73193bb6", "comment": "Malware payload (Prometei)", "value": "5da9904752480d0dd7a0a3ea9569a1dfef2193ca3728ac5b9f82b1b52b767a1d5f769010d576856f323f6958c35fc70f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077427, "uuid": "8f25d7ae-9428-462d-99f0-31cd60bdec89", "value": "T13B34AE73A4BCEB9FDDD82F779C8B850713A62FD98890203E0D94751EFD2A5082E35616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077427, "uuid": "5aaf0ea8-3623-42f6-ba14-0fffec5854a3", "value": "899ad1596f9c6642245b3fb721bae585", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077427, "uuid": "6689d235-995b-4096-9e69-60f70acbe863", "value": "3072:uaZcM3pgOPBdu/XkI8KCcMrnfaoaGmK8K7AzZIl/7Z0NWehnLCW9IPkPduwXFo3N:TWO6fPkhKCDahM90ZGyNhLCW9IMPdwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781077427, "uuid": "837ef21f-25f0-4b33-9903-0e2b21935d6c", "value": 245860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781077427, "uuid": "3a6177d4-b99b-4126-8c30-f4bdcb36f5ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077427, "uuid": "a939b3ea-f5a6-4bf4-8fa4-2716b4f9ad08", "value": "a8257682e67969ff1ab3b123be2dc088d09a3d18f7c72903dd72e67a26324f89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c234d7d-64a6-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781080002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080002, "uuid": "d6587860-512b-440c-82aa-afd53d43093c", "comment": "Malware payload (RemcosRAT)", "value": "850f952b98265bc0278319e7f8a8452b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080002, "uuid": "3a6a91bb-b596-40ef-bb86-cb2eefd9bc5e", "comment": "Malware payload (RemcosRAT)", "value": "a899d270b9b1a069e61e0a0de0cec9332996811e382cd2d1e78753fb7bc8d2eb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080002, "uuid": "0c935725-4567-4705-a9b9-6a88954ffc22", "comment": "Malware payload (RemcosRAT)", "value": "5ae63b7a40fe25bb96c3b2cb4e8cddc554852144", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080002, "uuid": "a13de48a-2838-4b56-b6ed-fa8ec69251a9", "comment": "Malware payload (RemcosRAT)", "value": "31cd6cc8855aef14d93c787343fb80aa7d36672575eb41cb557b8637a9508ff3f33164d5b177268148ee24cfaf4ac2dc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080002, "uuid": "563b4d7e-5621-4964-83d8-64faeb8c68e9", "value": "T1AC85F7FB5FD83B91C13227B6AF9656AAF7B0815DCCF6AF06B26196408F24054405BF32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080002, "uuid": "ebf5d195-c057-42c3-8ca1-dd7f9fcd25f5", "value": "768:JggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggX:mU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781080002, "uuid": "70fc5a07-98d7-4f1f-8a26-a72400c29a18", "value": 1711317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781080002, "uuid": "40f49784-13c6-4c82-8921-4e658f4dec44", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080002, "uuid": "de6c505d-4521-4368-8404-2ac53139b909", "value": "LPO_L07845S.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae2f82e2-6491-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781071228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071228, "uuid": "bd5eb1c6-61f5-47e3-bd34-330730498e84", "comment": "Malware payload", "value": "b80b344f0b68804cb185392533be080a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071228, "uuid": "8927c6ce-c04d-47ef-a4d3-c95bd7d2f2b5", "comment": "Malware payload", "value": "a9a75a3539e237b9ec58a77bbe1da8821e70c606b66e7ea9c943fced7a7106ce", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071228, "uuid": "5b34eb91-0935-4d40-a998-1066eefeef70", "comment": "Malware payload", "value": "1a896ae5bb981136e95d5375422dbde397d6db89", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071228, "uuid": "63d47b13-f23c-464b-aa90-d932ac69ba46", "comment": "Malware payload", "value": "52cd3f8e39cee8736df76435057042eefef938942b6019cbaea44ad776ade172fb212c5f60e29b55f0d77cedc1b29d92", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071228, "uuid": "83e4fbb0-1af9-45c1-ab84-367941491e5f", "value": "T1A9E323C45212B1FCC23C24B54AB9765EC7ED781C23AA4ED5C690E7A2B4B79D0F246436", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071228, "uuid": "dbac41a3-5b4e-425e-8c9d-877d8b624a72", "value": "3072:aXwXLonhTwA17nx6hoWHcTpqKVoytwo06Om6pa2UyIYnt:BLUx6hoWH+pqsRtwo06p6paByIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781071228, "uuid": "9c6677ce-bbc6-4dc5-b56c-58d3486f8e39", "value": 152148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781071228, "uuid": "549f9cfe-0346-4d08-a7d1-d0e92b22b327", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071228, "uuid": "226679e6-ee38-488b-bf1c-f3429ba4c123", "value": "PO No - 481001340.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193788fd-64e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105767, "uuid": "d8c01e79-7b05-4449-a910-131ba3156834", "comment": "Malware payload (Mirai)", "value": "26d0245980197f3ee8b2584d37652071", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105767, "uuid": "97c5d7d5-f3ee-4af0-a66b-293e64a41b93", "comment": "Malware payload (Mirai)", "value": "a9b90964164f9219eed0f401708b2698a9336b5a34262b5af81554904c5a37fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105767, "uuid": "1f3d234a-53d6-4412-87a8-e0649f03103c", "comment": "Malware payload (Mirai)", "value": "c5fa3e1f79dd1b3812cfbdc7ee3827d47612a594", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105767, "uuid": "4eecc58a-5a65-4d11-a798-073a27047ad8", "comment": "Malware payload (Mirai)", "value": "2c34a0771f2e9f1df4a750b3108ece874c374f08c270a2b8f922b8096cf7f6cdfab9bd174aa8ff75bf8db7268e5ae97b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105767, "uuid": "5e17804a-ffb5-40a9-b35c-d44555350d5d", "value": "T13583C6297E218FBEF79D823947B78F22964837C637E1D581D15CDA005E7028E641BFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105767, "uuid": "bad824d1-fbac-4ea1-a8df-448325b2a931", "value": "1536:E6/iw/0w8HoQ5uy8Nx8lcJ0vXxh11xYqcn6BZOpkMoAfEG:x/8RHTg6cJ0fmqJZOpkM/8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105767, "uuid": "6b8f6a90-e086-4ae6-90a5-3445f1db8f65", "value": 85312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105767, "uuid": "b1621027-a9f6-44f8-92f5-4ef3e57b3a90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105767, "uuid": "ebf9a885-ad0a-441a-a3e5-993bf0830864", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1262dc47-64a5-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1781079556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079556, "uuid": "d5f1ad67-1902-4c75-b4ff-db59cf96c673", "comment": "Malware payload (PureLogsStealer)", "value": "22fe1c4370857f17215f1087f5079bf7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079556, "uuid": "cb466e8c-025a-43c3-ba4a-f6b2edaaaaf1", "comment": "Malware payload (PureLogsStealer)", "value": "a9d89b15296863842971bfdbd35da2034d271ab4ba74ee4ed74221ad137f8ce8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079556, "uuid": "727cbbd9-b534-4902-b608-b3d5de92e440", "comment": "Malware payload (PureLogsStealer)", "value": "8eb4c9db05291df007ed0edaae03e81c6fe2d9f5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079556, "uuid": "4f9aabc3-a7da-4146-a15e-42b7d493ca53", "comment": "Malware payload (PureLogsStealer)", "value": "00beb33721a605a02e223fd23b07bb03f6461dd879b03eca33f7fffe37ca1262d1740a4b581fc9ad854cf0d7b2659188", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079556, "uuid": "0c8c66e5-b743-41d5-abbf-47acd9ba2204", "value": "T144F4E43DCC18412EF136D919C89A095FF8E2058B623CE90760C6775BAE67482B7DB39D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079556, "uuid": "ab8ed094-7c61-46cf-b291-d5292180cf30", "value": "3072:6pb8RVGPOGCfoymvqrI/ur0ii6bA4/x30rmRqNP0HYtLqjc7eHff2/ag+goGGj9l:dRyH6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079556, "uuid": "7de4c9be-e471-4070-a0c3-46674369a285", "value": 792040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079556, "uuid": "e30b5162-5897-46ad-97b0-b32cb5960853", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079556, "uuid": "9fa81013-1dd4-486b-b058-56c852809c29", "value": "output_2bhoxio4.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec273ef5-6511-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781126307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126307, "uuid": "94f39cc5-cedd-4b10-8c4c-8fa5117de98c", "comment": "Malware payload (Mirai)", "value": "8431544e43cab7f0bbbcfacee3ad7c99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126307, "uuid": "e7115847-5eff-4f13-aa9a-3b1c550acda0", "comment": "Malware payload (Mirai)", "value": "aa1cab94fc4be8078649d0a8cc23e48e7d8394190be844df243afa819fb2936f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126307, "uuid": "413ca2af-15c3-4bea-a32c-119833a3702f", "comment": "Malware payload (Mirai)", "value": "2f0d1d2dc0faffe51a1569589cf88da67341a6ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126307, "uuid": "0cceb432-aafb-4cb4-b632-044ab0dc3ede", "comment": "Malware payload (Mirai)", "value": "3c0336b11053d366c8352f3ebef2e9b90797b48ce76c71b93a793a5db9047c3e5a2dab9303eb03e3acd2f1ea5bb8f70a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126307, "uuid": "223137fc-56cd-407f-b6bb-41d53b0728e1", "value": "T1EB337C67D82A4D98C5194278F4688D391B13F408A2973EF65E8EC762501BDBCF60E3F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126307, "uuid": "7a0d7647-d8c3-4fa3-b43f-2cb857230fec", "value": "1536:uaok/dgBORYzVUsvbE0u/EFDBiSurCei:uG1ftsvbE0u/wDYSur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781126307, "uuid": "60e15fd1-39cd-4ef5-8cad-82bf055408a5", "value": 51968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781126307, "uuid": "e91dfea5-cd75-4af6-8cc4-0ee737af2848", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126307, "uuid": "7c3eeb48-64f6-4cea-b855-b0892d3a35ec", "value": "kwari.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c78c219e-64d6-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1781100905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100905, "uuid": "6ce94336-57cc-4fb0-b0fa-ac59e7d7a0ee", "comment": "Malware payload (NanoCore)", "value": "0151d86b030907f240825c09a5484747", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100905, "uuid": "707140fc-a979-4bbc-a638-45859ee252fb", "comment": "Malware payload (NanoCore)", "value": "aa30b42850c09569f61611c2e314daca123911d189cc1b3f9fae68f53e6cb627", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100905, "uuid": "a0a60dfe-7d28-4d3b-94e4-50d774430076", "comment": "Malware payload (NanoCore)", "value": "091d08b036848e13e33c03496da108000a42ec50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100905, "uuid": "fe0821e3-574f-4de1-b412-b3741e20297b", "comment": "Malware payload (NanoCore)", "value": "0418b816703464825afc165b314464eae6e210ebd22e753ecd3f900871eb55894ce2cf43c1858bb2bfc767df71f1f413", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100905, "uuid": "e347db63-23de-46c6-a4e3-480d9b1f29d6", "value": "T19B14D02677A88A2FE2CE8279701256538379C2E3A8D3F3DE58D451B79F623E146071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100905, "uuid": "926b3cce-7cce-44c4-b190-0a93e3ee64c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100905, "uuid": "66eff9f3-3f46-4792-8d93-260a83c02e4c", "value": "6144:MLV6Bta6dtJmakIM5p93SLHnDfNZIn0eVq1:MLV6BtpmkeKHnDFDe41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781100905, "uuid": "64a0bcad-8343-42ae-8e05-980ad4e3273f", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781100905, "uuid": "8a379eb5-ad8f-4986-a996-8a35eae72b7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100905, "uuid": "e2a7a8c2-d92d-4abb-b51b-e73f137c7f59", "value": "spinlucky.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc5333ac-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105665, "uuid": "ac52d0b0-ad6f-429e-b2c0-c0e5b95f072b", "comment": "Malware payload (Mirai)", "value": "bf42b4ef6f4deb02aec418cc8e7f0973", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105665, "uuid": "18ecc2a3-ae4e-4e1e-866d-3ff55f219974", "comment": "Malware payload (Mirai)", "value": "aa99981bb38c434d5ecb617b689b331f7b875a3519202b84b1ddfb2f7f2f32fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105665, "uuid": "4f1f57e5-f286-43fb-afb3-52dc895f34ce", "comment": "Malware payload (Mirai)", "value": "44623be489720132468ba3c83c701ad67d0ee0a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105665, "uuid": "0029702b-485d-4580-bf40-ebe6793a830a", "comment": "Malware payload (Mirai)", "value": "4ed0d267f58557f3b5de30a2f883c1bcb596762acdc13eea8f8f23f2ffe40cda33511417b03e82b73d648dcef936443c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105665, "uuid": "8759fbbc-2b0c-433d-9598-3d1bf4a0742e", "value": "T175B33959B9818B22C5C212BAFA1E128E331357B8E3DF73179D241F6477C696B0E7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105665, "uuid": "1a040709-1ed2-4f91-8ca6-13b49160c885", "value": "3072:/gazwz102cpveoPaRl+UfacSAI8ywMJm:4azwz102cPPaRl+AS97Jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105665, "uuid": "83e1053b-8524-4fb7-9209-454ddd95b6a8", "value": 108208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105665, "uuid": "f2720a2e-1cdf-4731-bcef-61627028e0e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105665, "uuid": "0e2a39b0-f59e-4ff3-920b-fe94714333f9", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d315e1bf-648a-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781068283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781068283, "uuid": "ef6e9adc-6bb7-4795-95f6-a7a0a4016003", "comment": "Malware payload (Vidar)", "value": "0508de8094eca600dd185fc7b444f6da", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781068283, "uuid": "460ecc95-ce5b-4663-aa83-61e0503e8eaa", "comment": "Malware payload (Vidar)", "value": "aaf7e8e11641f518c408e0c5e30f9f6569f2a4eae0620b4e6dd55f346f07613b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781068283, "uuid": "2787828c-1d57-4850-85a7-dc656b86306d", "comment": "Malware payload (Vidar)", "value": "a3a057a5dd82c700d261a1cbc241ff32c73d765c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781068283, "uuid": "38380d75-7b12-4fff-8f8f-d798e0232dd5", "comment": "Malware payload (Vidar)", "value": "2b30aabc68596f103a2223babe945e326d7a86897339e73ee4d5ab88a080dbdb84dafa2815e49013828d6092a4deea4c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781068283, "uuid": "ff7d9904-029b-4cd3-850c-433d7feb9d1f", "value": "T1A3067C03B8A108FDC0A9B33449A2B6523B757C441B3613E72B52BB782E72BE55D3B355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781068283, "uuid": "71a6f334-a2f4-4dbb-9d7b-cf62f99dbc87", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781068283, "uuid": "aafdd2b3-d243-48b9-80b8-15a80e9a9fa3", "value": "49152:PHt1/3CKjKm6UJm3xw9gTXQKKXPNRQhXHPy0OwDPpdVjNhunnc0:P7y+PQhXHPyYH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781068283, "uuid": "0d0429bc-fc2b-48e6-830a-3e096f317a19", "value": 3897736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781068283, "uuid": "e6bc63ce-2d3c-4b10-bdf8-d3a5091488f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781068283, "uuid": "670dbbef-3fed-4db1-80c3-2cfd39d10810", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd32216-64a0-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1781077480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077480, "uuid": "50fc27ec-c1df-4d3d-85aa-c811dde20d20", "comment": "Malware payload (NetSupport)", "value": "cd10a03be0be9fc71672a2032cbfa25a", "object_relation": "md5", "Tag": [ { "name": "103-246-146-217", "colour": "#378C65", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "toomstray-net", "colour": "#7EE650", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077480, "uuid": "d489c81b-5f1f-4aa4-b0b6-72cf42da5af6", "comment": "Malware payload (NetSupport)", "value": "aafb40c832f80c84a560d219318a68540c48e3d6c779de0bba9315b36b9b7a00", "object_relation": "sha256", "Tag": [ { "name": "103-246-146-217", "colour": "#378C65", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "toomstray-net", "colour": "#7EE650", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077480, "uuid": "db8bf88b-6565-4f84-98aa-ae17d0a51506", "comment": "Malware payload (NetSupport)", "value": "142d89b4ba27c28f9cc15efdb98e69edc5470d55", "object_relation": "sha1", "Tag": [ { "name": "103-246-146-217", "colour": "#378C65", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "toomstray-net", "colour": "#7EE650", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077480, "uuid": "87ea3d40-ff17-4bed-bad1-7ca41e5085d8", "comment": "Malware payload (NetSupport)", "value": "49924e0cc3d6740240ad04b6e943f6af6ca01d0281fe4d9a3563a71d8ebbfdad6f86ef6998adedd94866619d0519ad72", "object_relation": "sha3-384", "Tag": [ { "name": "103-246-146-217", "colour": "#378C65", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "toomstray-net", "colour": "#7EE650", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077480, "uuid": "175669c3-8a04-43ee-aaec-6c380f532e3b", "value": "T12656CF21B99EC136E66ED136D968EB3B24BA7FF20B7144DB23D8399A0D704C14275F06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077480, "uuid": "3a774014-e9b0-4d09-bcdb-e041e4f01284", "value": "98304:4oSTy7kFc3NEj0bwjZcIVpS9nmCHigXEQcQNdTvUBKTeze850vE:gc3LbIpS9PNdTGUei850", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781077480, "uuid": "82d05a6b-d008-4b7f-970e-1dedf56f13af", "value": 6190592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781077480, "uuid": "e8c14f1d-f52f-4f09-ba45-b4a668a69f74", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077480, "uuid": "f6492163-181b-4bd2-af8b-891f22ede519", "value": "aafb40c832f80c84a560d219318a68540c48e3d6c779de0bba9315b36b9b7a00.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1f075f-646f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781056672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056672, "uuid": "de84e3a4-8fc1-4985-ae03-58522556840e", "comment": "Malware payload (Mirai)", "value": "9693212cbc96cf9bdce2c8f8a277fc66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056672, "uuid": "68943804-af4d-477d-80c7-8b56fde4de8a", "comment": "Malware payload (Mirai)", "value": "ab368d35a59475b0d1dd865cbc1222a59e00473bbe15a10582d5e4c6870f376a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056672, "uuid": "4cce0ba6-010e-404d-bd36-4e7f87330afb", "comment": "Malware payload (Mirai)", "value": "4f89afbdf773342478447dff259cf706a3b6bbff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056672, "uuid": "a19b1fff-4198-43cd-8833-30f90413bf8d", "comment": "Malware payload (Mirai)", "value": "e7f3e79420389cf05f47c37ba1e6fd0b488a8b30c72d074f1f7b455a179f48d9f9f39cc74142383f87300219a31234e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056672, "uuid": "0f83662c-eef3-4621-b5d6-8e57d58871aa", "value": "T1A383D605E9429B01D49731FAFB9F425973936FACE3F97101DA245F6123CAADB0F62112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056672, "uuid": "a2258d5e-9c33-4320-9e93-1f791064ad1e", "value": "1536:/EnmVonJtsh9p/QHsUva/nFI83JmaA0lmUBIimtragrYFw3T:2jCTYHsUva/nFI2JJQragrWw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781056672, "uuid": "d352af94-b5ad-4e9c-834b-5dd6e39a66d6", "value": 81316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781056672, "uuid": "a607696f-9db4-48be-853e-090102eb8c62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056672, "uuid": "3bca3df5-1dc5-4b4e-be2c-ec68a2ded819", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad318f0-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105662, "uuid": "ad8585fb-de75-4003-986f-2c5bdb1f3189", "comment": "Malware payload (Mirai)", "value": "ba5ba1cfd896319a7759f862aecc55e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105662, "uuid": "fe668756-f07c-47ad-90b4-1684eb2aec8e", "comment": "Malware payload (Mirai)", "value": "ab8c8d4f7853acbc1f3daa05d4bc193ccf47a3346ba5228ff61d3b5d93692c11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105662, "uuid": "90039d6a-2ae4-4f3a-a477-ba6bf62db7fc", "comment": "Malware payload (Mirai)", "value": "8358a579accdc81bd80048a65fe95baf4f99c788", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105662, "uuid": "ca3cfb95-10cf-438c-8646-b19db84c1311", "comment": "Malware payload (Mirai)", "value": "39d74a7571b1eba6a983f39e828032a0ec25fb4d72173091eb14cb6d82c09ee39fb61cf3bb6d259bc022903ffa267336", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105662, "uuid": "b6c12645-ff61-41f8-a494-cb23b455a76c", "value": "T189D2E0BD730A869ACE3EA2B50EF40B8D15E01FB3A453481F635D95D29F15A883C4BDD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105662, "uuid": "fae6ca34-c3f6-4b5e-9b38-7812250ca6cb", "value": "768:B4ylAtv6pq5abAv85+J35YudEt3Aw+UJgGlzDpbuR1JM:SMBiA+x5YuitQKVJue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105662, "uuid": "c3d602e0-407f-4fa8-8f72-e538dd748d9a", "value": 28884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105662, "uuid": "ea4cdc88-ef11-4e88-a295-369b5a44ffc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105662, "uuid": "a929ef0b-3a85-4883-b93d-0374cbf6e8bd", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db7b4421-6498-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781074310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074310, "uuid": "78eb2eaa-48a9-4a88-a44b-4ddb02872a31", "comment": "Malware payload", "value": "4cd8dd236d39ce8eeec743b773360764", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074310, "uuid": "f831051c-efba-4c53-96d8-db31e016b6ab", "comment": "Malware payload", "value": "ac16ad5990c20e81f6e4fdb3ade299824cbcc17fd1c6b8dbe8b1a6211f00401d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074310, "uuid": "06dd058e-f08b-4026-ba53-e144661d5802", "comment": "Malware payload", "value": "044e4ebeb2b85b8eabb2e65fda07d2bcdcef7b25", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074310, "uuid": "41bad87c-d159-4c9b-9aaa-2c31814f878d", "comment": "Malware payload", "value": "338979d4d017284c3eaaf2938392d5e96c9ab15f350747e4169b960078584a7327bd953edf2d7498b42c98a3e00fdc2c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074310, "uuid": "2cd213a8-072d-4da2-a94a-4c5f8561b00e", "value": "T134559D10E413C4A5ED8500F1EABDFA9E256CDB36032C5CE3A9C0A969FE615F36E34647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074310, "uuid": "c3bf5d22-f3c6-4a1c-b5ee-bb154d6a4815", "value": "780d4eb9d2d1d7187d692847a2002744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074310, "uuid": "f0866b79-baa7-4018-9aa7-44975d22f461", "value": "24576:zpsAU7vw8DMm0Cl5szcGX5sE0qtSTxle+SeELskEXbRhn9qTa:FeI8DhHAcGXCxs/eE3ubvn9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781074310, "uuid": "89888740-7a81-4ebe-a365-ed276fd95959", "value": 1378496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781074310, "uuid": "d5e12f80-8ebf-415f-ab4b-ca76b0b92735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074310, "uuid": "3f71e470-97d2-4ae2-b408-8aaeb310313e", "value": "libHarfBuzzSharp.dll.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a0b758-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105675, "uuid": "19d9fe6a-d4d9-4903-8603-b445dc18eb9a", "comment": "Malware payload (Mirai)", "value": "2fa6df4f1ff351d71625da3b81dcb993", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105675, "uuid": "e3562954-c309-4221-8ad0-8f139f1ca79d", "comment": "Malware payload (Mirai)", "value": "ac225832bf81e84ac0a9eb8ccf52275f32c7e1663ccf50ed27db64a9ae5111ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105675, "uuid": "1d0e96b3-9f66-4e9c-aa3a-1baf37e841cf", "comment": "Malware payload (Mirai)", "value": "e435f9d94f37516be98e7aa65c1bc5f5481a2b28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105675, "uuid": "b1261924-8584-49f2-841d-e412d96ed8a5", "comment": "Malware payload (Mirai)", "value": "41a804423188b8037373c2ce47e88c3e869305b4be9b0d6675121fcd1d96ff020486613e887fa56f1b61361e289af553", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105675, "uuid": "57ef347c-331c-4537-99d1-92f7bdf986fa", "value": "T1F6C2E1A350F6CA13C8F2837A6E3C5EA622605834A34EED2D77794BC477420D4657ACCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105675, "uuid": "84a62ec8-b0ad-49df-91fc-ce74cbc816bb", "value": "768:w5+Kcrb9VDJew2KTgdTHOBcK5ZCAyukANs:Plrb9veATg9QB5Vja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105675, "uuid": "4f9d4c6c-f23d-4ade-bf86-a6fb0f0f43b3", "value": 27712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105675, "uuid": "8ced36b9-bf34-4afa-ae03-f882953e4970", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105675, "uuid": "38d39e9e-8b32-4cfa-ac0e-1f685c3cd1ad", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "259f47e1-6509-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781122538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781122538, "uuid": "a5e40b5a-c79e-4791-9d0a-6d5b926a71dc", "comment": "Malware payload (Mirai)", "value": "86fdb98f835acc7324581b03fb40f955", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781122538, "uuid": "5d4e7b31-d322-4550-adb1-2fdcbdee502f", "comment": "Malware payload (Mirai)", "value": "acddf2ffc4b58073a1a5ebf0b42eac18d7896a60b7dd406cd7b84493011b6426", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781122538, "uuid": "53be4d02-b05e-4ad1-84fa-59dcf4f23168", "comment": "Malware payload (Mirai)", "value": "e09beffd3f83e7b4161a240b014234db5df1acfb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781122538, "uuid": "d4079d87-c9ed-47bd-b813-182914163120", "comment": "Malware payload (Mirai)", "value": "efdb58a3437ceb39913cc35ad1f945097deae6f51a988867435c0aecc358cd0a3621056a33e3c9da245ae55dda0013d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781122538, "uuid": "a7418bbc-6bde-4958-a47e-93fe33bdd81c", "value": "T116C33873CC252F68D224D974F0759B792B93A9A1818B1FAE54A7C3748083D8DF9463F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781122538, "uuid": "1aca8293-a0eb-4706-9e4d-457794d9e160", "value": "1536:8gv8/KdSoRSvKOTQQYlJTyCPi3fCM/5ODSzWc4MVKAI3MjVtIrpp:8gEGR2TTQQYlJy55OWzWXM8A2rj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781122538, "uuid": "4a846c48-f531-4d25-94df-9bb2235acd9e", "value": 129908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781122538, "uuid": "309f01f4-b124-44f9-b8c0-540dace291d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781122538, "uuid": "ff938e3b-2be4-436e-ac35-49670254277e", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff23fc62-64b3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781085966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085966, "uuid": "414dcfa9-30f7-4c55-b46f-1df9ae1af6ae", "comment": "Malware payload (Gafgyt)", "value": "821f3b99ec2ab19cbeeee604dd088625", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085966, "uuid": "163b67af-e82d-4630-aa1d-623a929ff3f2", "comment": "Malware payload (Gafgyt)", "value": "ace33b0ff620088469ffdb872e7a376db3e910c47988bc044b8f7c5795039db0", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085966, "uuid": "2882e92e-0f4f-4cf5-8ec1-4e2a8f070c1c", "comment": "Malware payload (Gafgyt)", "value": "f3b673514b7fb657cd37275dd21bd37d972109fd", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085966, "uuid": "ac49a32e-c35f-40b5-af68-68a3f6ba9cf3", "comment": "Malware payload (Gafgyt)", "value": "31058250b1fe3aceb9a473299a69e06caedf00553c58d418248d4b3a4ac60c3be554975045b143489b85739a8c3403e9", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085966, "uuid": "ef239858-0dc0-420e-9809-75663ca0e8b9", "value": "T1FCB312A1E3B0F057D3A04CF39D2749D0727C0931BE92B2D7969569CEE3A0B4A937B149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085966, "uuid": "9d5ee160-a111-4221-a20e-cd2f2c6410a9", "value": "3072:0rZpgTbyHdUz9b2KatUPeY1+Lq4niCxTeIG69NHM:0D0u9Wh2JY1w6EeI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781085966, "uuid": "9b27af97-cdf0-4841-8a9a-d5c2c5c223a4", "value": 107960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781085966, "uuid": "1d0387a8-5b11-4b8b-9426-a5eb91d56192", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085966, "uuid": "ca1c0959-259f-4ac0-80e1-331883d51fe7", "value": "kworkerd-irq-bal", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20dfa539-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781108786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108786, "uuid": "226ea6dd-10bb-4197-a44c-c0226d871746", "comment": "Malware payload", "value": "f9cf5795f2a605a2edb3934f28744364", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108786, "uuid": "26781d96-daa9-470f-993f-4edb00305772", "comment": "Malware payload", "value": "ad251dceee390178e4e8c8664ef85bd70e65b9254fb6230967a37a4afd4152d1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108786, "uuid": "5698d999-c563-42d7-bdc9-3ef3de42e88b", "comment": "Malware payload", "value": "fe5709d629697123d43ad966344445d1801402da", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108786, "uuid": "3a4f5167-a69f-4796-a319-9ae3419857c4", "comment": "Malware payload", "value": "f32b734a243135504e43fcee2bd3cdf59ea422c9371a1cd3a0325af2fa353d0e3554e1ad211ef661862e971abc273f2e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108786, "uuid": "bdbd017b-c80d-44bc-9010-75f0f0752b0f", "value": "T197E30968C91142774B83AF4CBCAA0A21C5EECB1C857799F4E6C6871D900D9FCF379266", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108786, "uuid": "86ee8c1e-07fb-4eb7-8ab5-d1707e5ad63a", "value": "3072:FdRdkrB/kPoFpZOlwSCXeow1IxRjIr+BFj74heWlGXlfaMfnENU4JcSRHXHo11M4:vo/YA8ro4lyMM8NhJNRHXHoo4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108786, "uuid": "dfe79666-a645-4511-a843-d8d963201bef", "value": 152133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108786, "uuid": "61cbb43b-c303-4b8a-b21a-1e5920d10aed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108786, "uuid": "954f40a5-88c8-414d-a6ff-058a983123e1", "value": "f9cf5795f2a605a2edb3934f28744364.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0275a4-64a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781079282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079282, "uuid": "6f3b6c58-a934-4f16-ac47-a439969ae1eb", "comment": "Malware payload (Formbook)", "value": "d6f3bc38f1ed751c9c6c278d7ed2e23a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079282, "uuid": "a409df35-10ea-483c-ab80-3d951311e6d3", "comment": "Malware payload (Formbook)", "value": "adb6adcb960e22b1047a76999ce236dcbbcce6fb14e706b18167b31569881ba4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079282, "uuid": "7f71eef9-ea38-450c-b000-66cfa887de09", "comment": "Malware payload (Formbook)", "value": "56fc8d6bbd830a55ef5d2c887f087ec81aa2aa8b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079282, "uuid": "b4cc2545-4c1c-43b5-af52-0a28a55d38ba", "comment": "Malware payload (Formbook)", "value": "46c788009dd66d512ff4c757ba93f6b5d0e265871d58738f7b1645655c3b8bdb7ab39472ba3654cc8c3f033addf7e9d8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079282, "uuid": "11361dbb-0bae-42aa-a1a5-542911ab4d79", "value": "T183E55C17C66F974D180A3B61106A5D9AFE89CAFCEF727BC4E0CF90B614EA1110B851B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079282, "uuid": "bcb23f90-abd8-42b2-be09-5a0cc85c3fb0", "value": "49152:K+OT79/wqR77oZDYBVniKjZS9JG0C31D7gx5BSND1dYIO:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079282, "uuid": "b9925863-451e-46d2-a74c-643c3c961053", "value": 3087887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079282, "uuid": "a36288d0-defc-47ad-ac4d-8497d2e06dcc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079282, "uuid": "f9857e65-70e1-4f72-bdc4-0e398cbf6d17", "value": "Purchase Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73521e0e-64a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781080148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080148, "uuid": "ec29acd2-c1cf-4b73-8039-e2f61eae598b", "comment": "Malware payload (Formbook)", "value": "e21eb28f3461aaf3c6cdd126aeffa138", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080148, "uuid": "52396cdf-4c35-462d-ae3d-98026394ec31", "comment": "Malware payload (Formbook)", "value": "add86e84bb76decd85081877dda2189383abf10ffe0d4f9567c41e983dff0f34", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080148, "uuid": "278c8e6b-429c-481a-91b3-a32a0a0ddae7", "comment": "Malware payload (Formbook)", "value": "ba1e68ecdf76a673e9467f8f48be1c9fdffeea69", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080148, "uuid": "a74d9385-fdf0-4d38-8dac-e2cf0c1c89be", "comment": "Malware payload (Formbook)", "value": "f7e4cd738483d43ae751f8d4d48575fadb99755a69b0e8e6f848729d5257c03cb59dfeebb4ea841cc04adf77eb3a7b4a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080148, "uuid": "d2a341eb-5ecf-4140-be5e-129cd18a60d4", "value": "T14F64393439EE901AB1B3EE599FD47BA6DA2FB3B3370654591090038A4723D41EDD263E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080148, "uuid": "517493b4-314a-4aac-8d92-f62d5efe0d09", "value": "6144:dfc1CbWSdziU6TQCOzeJyBdNWrnFWkyQUSwbUvR0vFNNapW:dfECbWSxiU6TQjzWyBdNWrnFWpQxiqRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781080148, "uuid": "793544b5-87a8-41e5-b34a-5bcc7fc61e24", "value": 329828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781080148, "uuid": "a9a4665f-2090-474d-a26a-9ce5654c2396", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080148, "uuid": "f247221a-5816-4c0f-8e2c-6440bc751d8d", "value": "New Order.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb6bdcb-650b-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1781123649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781123649, "uuid": "449b0863-ae11-464f-b9d6-783ca5319e26", "comment": "Malware payload (Prometei)", "value": "3f6daf15e3fdc7fa5f55a17084795088", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781123649, "uuid": "917ccc77-8844-4f20-89e9-2b81c8d7dd43", "comment": "Malware payload (Prometei)", "value": "ae1d55fc04172996f46f372779ba9192cec524d8fdedf9b77efa8c57bcea8584", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781123649, "uuid": "a555a614-79e0-431d-aea4-89783fbc6e2e", "comment": "Malware payload (Prometei)", "value": "ca24487443d29214a865e15545f7f4bc25d8bc8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781123649, "uuid": "86689a5c-2687-4819-9a31-121f058d4090", "comment": "Malware payload (Prometei)", "value": "0fab3753b159be65a9506379096f6358ca813d3dcfe0ed5fe41e9822cdbbb8a7b31fc074d558065118161fbb17d1e165", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781123649, "uuid": "b5bca65f-0bef-4c85-9599-7ac89e8f2927", "value": "T1269423F4C37B9B9AC5872A758B7AE381D674BD555BC70849B3ADE9330138322A750C32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781123649, "uuid": "4f4fe5c2-0c53-4e39-966f-e533debfd7e5", "value": "6144:3584cmYYMg0EzyNP34/Aam6xbQJPlViUWxUzgFjVyBXH/0r1HTUcm6hEt:35843YYXyi4am6OPj7WaaVyJH/0ZHTBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781123649, "uuid": "e71e6ff0-2826-4310-8270-c46d907696bf", "value": 436151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781123649, "uuid": "b2986c35-279a-4225-aa60-b50881eb8cec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781123649, "uuid": "9d6c443f-2db1-4620-ae17-3d9e940be300", "value": "ae1d55fc04172996f46f372779ba9192cec524d8fdedf9b77efa8c57bcea8584", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f25ca980-6511-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781126318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126318, "uuid": "2049158b-8cd9-4da6-944e-534252708b37", "comment": "Malware payload (Mirai)", "value": "6fe891a9080e8a4dd22a764dc069820f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126318, "uuid": "6c87b9c6-bcee-4ca9-8370-96776fd75ca1", "comment": "Malware payload (Mirai)", "value": "ae3011372b07bb2860589c959324f7ad48d7db350a10104c40e871a17be924bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126318, "uuid": "15a10caa-d305-44bf-ab7c-3a6992a148e7", "comment": "Malware payload (Mirai)", "value": "44fc5ee31e293f1d1aaf136f63bfc6498aa2ccd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126318, "uuid": "459e4519-46e6-45b2-b984-1df8511a478f", "comment": "Malware payload (Mirai)", "value": "139f0c6409060700220e97c467d7b08fa4ef6e0fc09e009b3f7614d0618a2c2c2dc879332e02a44d8894f4714142ac4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126318, "uuid": "e4ee3a55-0abd-4993-9e58-d003dd695a8b", "value": "T116535C21BD3E2E17C0D4B47B62F78754B2E1274E25A4CA1E7D720E4EFF12A4066631B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126318, "uuid": "d207e5d3-d3c8-4f56-ad92-d9f6ab8a4e34", "value": "768:wVoEN7X6F4mvqvgqW7NSma6eFDaamv2qBtnO+CPKWgrqmK:wVBX6F4mvqvgqW7N6uaYt72ezK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781126318, "uuid": "c218fddc-405e-4ae4-b3d4-66c00189bce7", "value": 61076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781126318, "uuid": "d762a042-caa4-4337-ace1-7f9d49bc5522", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126318, "uuid": "f548b184-79ff-417a-910e-56c53294febf", "value": "kwari.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fbbb9bc-64bd-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1781089994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781089994, "uuid": "682dbda9-0569-4af1-a96a-07b0a8a19352", "comment": "Malware payload (XWorm)", "value": "78f97bf3d42c913b64da968c926592b7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781089994, "uuid": "a0c1deef-7396-4476-a71f-1b5dfe2fa6d6", "comment": "Malware payload (XWorm)", "value": "ae340c8b69b058f91809b62dbd4bef72dac085d9810f56ae4f50e19afe903912", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781089994, "uuid": "ab43dc02-2d5c-4114-a8c1-e02f69bcc2b8", "comment": "Malware payload (XWorm)", "value": "8b564c891039b0ee80d62dd5cefd72f571212ea3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781089994, "uuid": "286be97c-31c7-46b2-bff0-bfe8c716bcf2", "comment": "Malware payload (XWorm)", "value": "d40c6a51b7b686fe5ee5e3a098b11e81747caf15d95a1b7209001d36d18848e5cc4a0567038939892bae0b43c4203aa5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781089994, "uuid": "2c8b394e-e1f4-411c-b848-41aa985a7312", "value": "T136E249A1FB1641334B01A7DCBF89D260C9FDC3158826B9B1FA8FC31A960A9CCD774959", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781089994, "uuid": "ad62ca50-9a52-4a40-9f18-78dc673613a8", "value": "768:XVwtYVLphIkFE8Kzq4Z1FkuIpdsGwc4kUH4eprSN:xVLp6W4uns3cnUHtpON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781089994, "uuid": "11b99bd8-c097-410c-9f26-c245091395e1", "value": 32555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781089994, "uuid": "cb16691a-5274-4f81-bd5a-1c7ec95457d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781089994, "uuid": "7436a57b-c55c-44ad-9570-6e3360a86f50", "value": "Stile.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d88036b-646e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781055952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781055952, "uuid": "254b22a0-650a-4220-8755-6b97280c06f0", "comment": "Malware payload (Mirai)", "value": "9ed809598e355e34b5fd6b613a260095", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781055952, "uuid": "7c81c53a-abdc-4419-8687-d6ea1337f344", "comment": "Malware payload (Mirai)", "value": "ae7ebc264de02b105238a0141626818cb44410abc1993357a9f11810976807ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781055952, "uuid": "be15e7bd-d7de-4f27-a0b0-51526e5404ef", "comment": "Malware payload (Mirai)", "value": "47a00359337c238558c6af648885e9255c0808bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781055952, "uuid": "d09b19d6-3112-42e7-b35c-74e81a575df6", "comment": "Malware payload (Mirai)", "value": "b89a8743ccaaa4b21dc7ad8c285285a76fbdb63da598fe67ffc5cc9e3f9141e8e8d0a78e7e14fe5f053bf9b1e1e49724", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781055952, "uuid": "62d565d8-9b4a-422e-8dcd-9424bae96604", "value": "T134D3F845FC519F17CAC2527BFF4E4388372A17A8D3EE7202D9256B25378B95B0E36142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781055952, "uuid": "7a837040-ae01-40b8-b6ac-130e3e3940b1", "value": "3072:PwQfH3Nr543bMLmvuLEkaiKmE4bCGq745+Zac:P9fHdr543bHvuLEliPE4bNq74Igc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781055952, "uuid": "f304f5f4-ef83-427e-9e4c-5c811058141d", "value": 139020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781055952, "uuid": "aa67e00d-d7a8-4ef2-9317-864e6b08e70a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781055952, "uuid": "32327f47-e0ff-49e1-901a-c65b7dbc74a5", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912a599f-6474-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781058723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058723, "uuid": "33444691-138c-4bb4-a4cf-2c90864c230c", "comment": "Malware payload (Mirai)", "value": "2433269cfa5e759e9550be1e05df5bb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058723, "uuid": "aa503c2c-2f84-4b34-9ed5-751360aa3ed0", "comment": "Malware payload (Mirai)", "value": "aea37d8cf915eecad91bac7ac070484765f4fc6fe66a4a3940b9cfac7b0a80b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058723, "uuid": "311ca40c-637c-4f74-99bc-0dd23ef4c628", "comment": "Malware payload (Mirai)", "value": "c544a5deb2a29adba96e575850c5286bcbc7a411", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058723, "uuid": "3cd69b64-a262-4513-8c37-61295cfcfbb6", "comment": "Malware payload (Mirai)", "value": "079cb5358f5d8060c8eecf91caa0693e57a73f88aaf9578d405c7f7f70b4f0c3d74b8c0d7aabf702ad3bdea363eb0cfd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058723, "uuid": "65527f1f-9e77-415c-ab39-20c2fe01b87a", "value": "T19FA3E785FC514B17C6C765BBFF4E428D7B2A1758D3EE320399256F20379B96A0E3A102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058723, "uuid": "6d1852d9-cbc7-4dbe-bbeb-2293a316f81c", "value": "1536:86sT3U1KAhix7a4VAYz73+9kTLO0AMJ/D+99ZOlorywywiznPub5tPslbBU:81Tk1Krw4Fzb+u5+vHAZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781058723, "uuid": "bda9e055-6f1c-430a-a3eb-551ab5b41983", "value": 100812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781058723, "uuid": "d9dcd309-8acc-4f1c-bffb-2cdab9c8133a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058723, "uuid": "2e59d054-ffd0-49b1-b2ad-871236aebf63", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a9567e-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105657, "uuid": "652e6038-b08f-44e3-9e63-b345aad2f6fe", "comment": "Malware payload (Mirai)", "value": "1b9a282b4d51fb24a2e60bd00ff820ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105657, "uuid": "f60e5b97-04a1-41b0-98ab-8b271406abb8", "comment": "Malware payload (Mirai)", "value": "aef3f427d4b73e63447dedc3cf1d952951ac2186739ef79fbea243e5e3fd445c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105657, "uuid": "8cfc1a92-c7cd-4592-bd59-57f19e8eeb65", "comment": "Malware payload (Mirai)", "value": "fcd7d76105625cb3bb8db6eb3316f3a14d17a096", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105657, "uuid": "189b53ea-a47c-454a-bde6-8a34896ee3dd", "comment": "Malware payload (Mirai)", "value": "71b31c8bcccbb86f18a162a3552b78c4c9874141bad982c72046c1f4a9cfe7ce2c2fb14b5788a9f2622148dbad56c80b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105657, "uuid": "03a1e84e-467c-40bb-a1f9-77ffcc1ab0bd", "value": "T1E2256C2AF2B370BCD167C030439FCB636839B07901216DBB76D49A352D62EA11B56F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105657, "uuid": "7febf588-2971-4352-b71c-9d0156a6acc7", "value": "12288:P51iDGRgrHKejMt3Q8jXn6SfCWCwFUQtJ4+YqPyyW2wpA2wHRL:P51iDGRlEMt3QaKSf1CwF/tK+52yRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105657, "uuid": "57289d71-fa29-49db-9bf9-704e3b287677", "value": 1044976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105657, "uuid": "ba73e6d6-e31e-4478-9d3c-c1ab89e15e36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105657, "uuid": "07f4a64d-d567-49c3-83dd-04c8ceee3b6c", "value": "dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e800c6-6498-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781073979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073979, "uuid": "9923da92-2389-4e2e-8c48-1c33a889802a", "comment": "Malware payload (Formbook)", "value": "078c584e7b3eccec295e0bf1eb5d8c0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073979, "uuid": "b83b5687-6a8a-4545-91b3-e18652082dd4", "comment": "Malware payload (Formbook)", "value": "af3a25f876e1685971b8afcff0f49d0eac035f096255bc54c4e09677f89898d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073979, "uuid": "c0927b00-5162-4045-9c2c-6d215aa802c5", "comment": "Malware payload (Formbook)", "value": "87725f245d4b61a36764e0212d9816c70402de6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073979, "uuid": "5338083d-71e3-492c-933b-0a3ab59155bb", "comment": "Malware payload (Formbook)", "value": "d69090c29301902513a449adebce889f5205f8ff0e659ff6d96bd35b5c96394bb933f951566c40c9554b1923e1b66b68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781073979, "uuid": "b37f7b2f-e7a9-4e9b-b292-fd78080a372d", "value": "T1933502946B56E907CA0517742AB1F17846BD2EE9F602E22B4FE97DEBBD36F040C14243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781073979, "uuid": "cb085515-7a4f-4df2-abe8-48723cc49675", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781073979, "uuid": "98e492b8-6954-41ab-a7e1-869fdb487583", "value": "24576:Zr+qgLQ31gWvOurnJyB2nqXNlwOO0PdjmiGd+1br804H3:1+xk3vOAK2nqX7wOO0PJwdk8hX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781073979, "uuid": "dd4ea384-911f-432b-9bda-37ee419178d3", "value": 1098240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781073979, "uuid": "0a7f2132-e7a8-4033-bcd0-3bfdf6b97e76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781073979, "uuid": "dc718501-49e9-4cca-abab-92f32d2c679b", "value": "M.T. MH.HIGHLANDER.VESSEL.INFORMATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "439bbb41-64b6-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1781086940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781086940, "uuid": "a1e1c9ac-19f6-40f8-8856-f30d08c6fe0a", "comment": "Malware payload (QuasarRAT)", "value": "1e345656ba6a2090f9211a08a59e652e", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781086940, "uuid": "61587512-a6b6-46c5-bea6-149f9e73f360", "comment": "Malware payload (QuasarRAT)", "value": "af4bf0887368a86ea9b3efc1c215c1e59c663de1288777b67246c4b641897bd3", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781086940, "uuid": "2ce949d9-7000-4bb2-a1b2-759ce90f31b8", "comment": "Malware payload (QuasarRAT)", "value": "72af69534dab7b5000903f28f296fc0a0cb3463e", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781086940, "uuid": "a95bb8a5-21ea-40f1-b8ce-f3e6aeacbb6b", "comment": "Malware payload (QuasarRAT)", "value": "8922e8da4a516227041d101969f057b0b959cf11cd459ed3df768f3916b05d18f06340a1d56d919d23385ae18209a38c", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781086940, "uuid": "2ecd0b43-070f-4f99-bece-cd00813764a2", "value": "T132D34A5523EC8A27E2FF5BB9E87401010372EA27E576E78E9D8860DD1A727D1D1813B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781086940, "uuid": "9031d6ab-23a8-4b06-86d9-90a2a9ed8273", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781086940, "uuid": "e96f7ab7-ced8-48b9-b23a-14fa22a4b5db", "value": "3072:+cQOYD7/cEYQ3vgzgcY7Ga+4EgHBCJZpbQGCa6R0fWTEo:nYX/cLzhYKa+4YZpbQC0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781086940, "uuid": "72dca61d-1d51-4e8b-bd6b-ae0c33bfdfa0", "value": 139776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781086940, "uuid": "5068153d-8aab-4edc-88a9-3d860324694a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781086940, "uuid": "e174d48d-0a40-4e62-afef-dc3facbdecad", "value": "citrum.io_077c34e8_q_acrobat-reader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4077bd4-646e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781056312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056312, "uuid": "0b2f04b6-2815-4a14-a1e4-b712cc890ba3", "comment": "Malware payload (Mirai)", "value": "c0bb787c49446a26fbb7b65bb78cc7d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056312, "uuid": "970efa61-544c-4b35-8483-6750c73bd313", "comment": "Malware payload (Mirai)", "value": "af855afaea615eba946645fc9328d4894607a4d3894eb897f596cf0600626b0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056312, "uuid": "accd0495-733c-4c97-96e0-4659da166e32", "comment": "Malware payload (Mirai)", "value": "76000c99160db35ebbb8059fcbde0a500e43d46b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056312, "uuid": "9fab245c-33a6-4557-8ba9-02f3324e5372", "comment": "Malware payload (Mirai)", "value": "6a96ab0c8a6e4fe7fc41222bc58a29af3806df8087b16598512ffd804beb75fc185016a7b0db8f1b9b6a5e49bfc42eb0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056312, "uuid": "4d080fdd-1d3b-4d33-82e9-7e292d4b3a8c", "value": "T1C6E3170AFB408B17C4C61779BA9F53423333DB64E7DB730A99289BB43E8775A4E62501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056312, "uuid": "8319d7d9-ba3a-480c-b2fd-475e38ce1079", "value": "3072:vkv71if8r3uQj6NTynrH9Pmqusb7v0L/Kp6V8er:vk71ikr+g6NTynrdPJuJL/KpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781056312, "uuid": "932316d9-d8bb-48b1-9a78-01eae18f7424", "value": 156120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781056312, "uuid": "a22a114d-b73f-434e-84a3-02834f63323b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056312, "uuid": "b0954c6a-68dd-428a-b010-4c46e6d6a394", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24be2a8a-64e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105786, "uuid": "ebc94978-59e1-4c8a-a9bf-19aa63e4829e", "comment": "Malware payload (Mirai)", "value": "74ad6e94383cb022661257818c928d7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105786, "uuid": "898d8880-ab18-4284-8dd5-941be679ee2f", "comment": "Malware payload (Mirai)", "value": "afdfff393e47f91d561a4bbea52e5c697e15dae1ffa4db1ca36e037e70f58144", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105786, "uuid": "90002f45-ea19-49b6-aad2-d40c1653dead", "comment": "Malware payload (Mirai)", "value": "4366f525c6e9645c82aa4202d47c408ba6596c0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105786, "uuid": "5dbe80f5-df2e-44e4-814b-5f471cfa2c09", "comment": "Malware payload (Mirai)", "value": "8921326fbff5ba5a7eb689cf035076f2c6540ced6122be4283b33705f3e8b98a9421d2d0a2a5683d445018960ae53b66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105786, "uuid": "0bf5091b-94b2-4a2e-92d6-104e6e084fcb", "value": "T179533C02B2180A5FF9D31AB0343F5FE187BFE9C025E0B689695ED7598635E332485E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105786, "uuid": "cd92c84c-52f3-48c7-8c87-d60648d7bd95", "value": "768:L9ETpVKRF4LoDfud18vSmqzQgdPfe0mzC+N5XYizjrs+yRDQf/1qfgI6iSV:BET6Rq1gSmQ+ZzDIiEbW/ogI9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105786, "uuid": "f73b4fbe-3dde-426e-bd33-0efd1a895ff6", "value": 64240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105786, "uuid": "00ce491e-8cbc-4c31-b605-bd9f9c0d8dcc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105786, "uuid": "eb258861-b261-4518-822d-1f1240ebf518", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a26c06b-64d7-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1781101205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101205, "uuid": "255074dd-2c55-45b3-9099-2dc8f140c703", "comment": "Malware payload (NanoCore)", "value": "4b06434571f66a54217f7fedf477cde5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101205, "uuid": "101b35ba-10c5-4775-95c9-69f43d0084ae", "comment": "Malware payload (NanoCore)", "value": "b019d85c1ef75b8c379259e6201ba1f85f88b16536f8358a01b72c2eb569704d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101205, "uuid": "67ba71e0-d492-44bd-9fcd-74acc6cb5f0a", "comment": "Malware payload (NanoCore)", "value": "3d04704aa3956915b2d51f55460be3ac85502342", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101205, "uuid": "eb3b98f8-f8b0-4fe5-acaa-1d1afb3c4429", "comment": "Malware payload (NanoCore)", "value": "db5028316020da059485700e3747aa31b90d0b6338a00f57b5f70f1f33c4611e2d3b9aa983444a16d035bf280b52256a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101205, "uuid": "d914c13e-f0c6-4648-a55f-3993031eb8ce", "value": "T11614C0553BA84A2FE2DE85B9712212139379C2E3E9C3F3DE28E451B64F567E10A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101205, "uuid": "ac2383a5-bb15-4d78-b4b3-bfe9b49b0067", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101205, "uuid": "71c9a90a-2da8-425b-85cc-10afaa8feeb9", "value": "3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIjKsC6wwBLsjAIZnB/nFgMbszM:sLV6Bta6dtJmakIM5P+LsjAcW/zhIRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781101205, "uuid": "0cd6cc58-9688-400e-a326-456e0cf1f9a3", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781101205, "uuid": "46414bfa-4962-4baa-aede-01ce02edd305", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101205, "uuid": "8b4192d2-03e2-442b-93a2-fb5b965b5945", "value": "utilus.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b50e4c4-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105529, "uuid": "0dc68d12-cdb8-462c-8569-5a89a40cfdaf", "comment": "Malware payload (Mirai)", "value": "0f395d6846e2f062bf66ee17857f27e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105529, "uuid": "733dcc27-9ca0-40d3-a4f3-0d09df51a148", "comment": "Malware payload (Mirai)", "value": "b02f03e8cbef4125c5ca5967e03b76bff194fb7b7d83d2827f93c46575763d52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105529, "uuid": "3f0ca354-65fe-4bc7-a99b-079fa190e10b", "comment": "Malware payload (Mirai)", "value": "433986fb58bc675077289e0302f06bd8b568b593", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105529, "uuid": "2010300c-d113-4d67-8577-6055cbb732f4", "comment": "Malware payload (Mirai)", "value": "5e3edbac3188b306e37318df16f3e57566d48165197e142f7a559653880057c6789a49e124d51a96110a878466aaec9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105529, "uuid": "741fe085-dac3-4295-92a6-013c007d1047", "value": "T1FBA4E04AF7562D46C9C7DA390487C2804A5EE1EB23F3D3452B43A5BB386A3725F39349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105529, "uuid": "0fad0fea-6cf2-4321-9605-f53fdccb375a", "value": "12288:YvOkzNorguwW8Jd9VyLlpGDHM7Gx4gpILomV:aKr+W8lVyL0Cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105529, "uuid": "60ccb49c-be90-4d36-822c-d9c59831b4df", "value": 474800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105529, "uuid": "4dd09131-0dad-4131-8d21-60def0d79bb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105529, "uuid": "4284a4b9-dae0-4a20-98fe-3808a5e95b5d", "value": "bot_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3847727a-64a5-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1781079620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079620, "uuid": "32282d92-32dd-4ea2-ad22-6a58d517e6df", "comment": "Malware payload (PureLogsStealer)", "value": "6077cb673cfd815cdd03e290910fb9de", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079620, "uuid": "38de544d-39b7-45fc-bbf3-9b46559655ae", "comment": "Malware payload (PureLogsStealer)", "value": "b0724f9d6d771ff9de0f58017c521b6b6482c479e5d84369400f488c5bd4aec3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079620, "uuid": "b2e8755e-c36f-4ae5-be56-ab4699d24c16", "comment": "Malware payload (PureLogsStealer)", "value": "8717b59d8e259eccb9888aff437ed2b8e03aff44", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079620, "uuid": "342e16c1-1252-4fa3-8e21-f31de575b569", "comment": "Malware payload (PureLogsStealer)", "value": "9fad3fa30d6075856f10cc041f47e56783090bad3b2eea8b275c3bb5b37275d7f3a858d540532694e1368b1181fc4b5b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079620, "uuid": "1ea77dad-9a76-486a-98f9-bbfc6a747fb1", "value": "T16505E53DCD24422EE432CA19C89A056FF8D1069B222CE94B90D73B5FAE7358277D725D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079620, "uuid": "8f6bbf60-3c51-464b-b0b7-4b31eed78276", "value": "3072:W9n02qqv1+t7f0y16V3SgO2vHqo/ZtVL8dxdz/wjyUL5B7Zb0C9NBx9INdK3DGDi:6qup3So", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079620, "uuid": "c3c85f9d-f142-47a1-97c6-9ad3e8265b47", "value": 838494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079620, "uuid": "4d683cc9-b5f3-4ba0-952e-c8c62ad52026", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079620, "uuid": "095d627c-7bbf-4fb4-8d78-684b9b297818", "value": "New Po # 32472.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43bfd18c-64e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Rekoobe)", "timestamp": 1781105838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105838, "uuid": "2cb91873-b3b1-461c-ab74-701e5b261e10", "comment": "Malware payload (Rekoobe)", "value": "57b16fcb30b2db7ce9c783086ba65d4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105838, "uuid": "fe6d0df1-3021-4b0c-b397-43ac38d07120", "comment": "Malware payload (Rekoobe)", "value": "b08e99d6bc08fb88d7fd6503d5ea11005c5e8bcd0e5c9392116fc21947a05baa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105838, "uuid": "4adeabc8-1383-4abd-8cec-221484a8c1d5", "comment": "Malware payload (Rekoobe)", "value": "8aefb7d527906094fb8baaa45f518d4407de602e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105838, "uuid": "a64db051-a32e-4afd-8dc5-14cf7bc6dca4", "comment": "Malware payload (Rekoobe)", "value": "62d0fc5a8bc13bbd9b07686e5e482c558375ab643c974fb40b91f991c62f27a5a2fb516567acbfac0cd163ba9a1431e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105838, "uuid": "100afe44-c3ad-484e-a9ad-6285214298cc", "value": "T1CE156C4AB2B3B4FDC657C43043ABCA72AD35B46502126E7BA5C4D7302E26E701B19F76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105838, "uuid": "13ea2b5d-b375-4bbd-86b4-b4630a7bc8e9", "value": "12288:i8PNY8VbT04m7uE9AI/m9p29AZd92OQEyrXCpwDwerUOaPyl6EqbMCHm:i8PNDtT04m7q9p29AZdkOQEsXfxrULP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105838, "uuid": "59754c03-bff2-4bc4-b4e6-decf1aa459b7", "value": 893408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105838, "uuid": "a7d49d6a-f61e-4e69-9f8d-88fa274c4fa1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105838, "uuid": "fdca20d4-93aa-402c-aab9-9504ca8b5b33", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc251d2d-6493-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1781072217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072217, "uuid": "b3770024-8c68-4b79-9d00-4429847891f7", "comment": "Malware payload (SalatStealer)", "value": "1eaf6629604ff0f45c92f8ceb0132eb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072217, "uuid": "0c3839ac-563f-45c2-aa22-89f41115557e", "comment": "Malware payload (SalatStealer)", "value": "b1ef11ff13a7dd1937a5b24a3ff4138744f5db07c87410ebdce73f8416e74b23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072217, "uuid": "940e2a38-30ca-4ce1-bc25-23c2f9a021ff", "comment": "Malware payload (SalatStealer)", "value": "e5257aec3812fb03b79aa3a3d3990ddde36d8705", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072217, "uuid": "c5a92980-fbee-4a89-9fbc-7ae6ae87e911", "comment": "Malware payload (SalatStealer)", "value": "bff6fd0667838a7e1030331b7d25a5846dbeeb915d3062d2ac6cfb1680671d5dfa2e31468fa9ef47368016296742165a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072217, "uuid": "26fbbbb7-3873-47bd-8adc-95fbfd39c7a3", "value": "T129C65A11FEDB95F5E9035831406BB27F23315D048B28CB9BEB547B2AF87B6A20C66345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072217, "uuid": "010c3734-623f-4817-817a-217289c3f112", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072217, "uuid": "7ff052b7-186a-4cb1-8b62-da9c38a60754", "value": "98304:Rs6wH5Pglridd0QMcFUu9Cp4+8nwEnMEj8:8HpdZ+uw/8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072217, "uuid": "115be7cf-08a2-47a8-9a5d-f807baf7069c", "value": 12578816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072217, "uuid": "bd131e66-cb41-4bb7-9fe1-669747437377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072217, "uuid": "5c10e038-3041-401e-a512-f17d64daa65e", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e39ac7b-64a0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781077509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077509, "uuid": "4bf35aa5-2f6a-476f-811d-69f4004826ee", "comment": "Malware payload (AgentTesla)", "value": "403a8829c40a153be57edbc96beebc07", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077509, "uuid": "ffc4e268-06a0-40f5-ac39-7175f404aa41", "comment": "Malware payload (AgentTesla)", "value": "b2db30272ad2d2227477960be4879bf9644f573377c7e0ed31b330e772fe3d90", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077509, "uuid": "16c25075-b247-4ca5-a354-d5c4d80f10ff", "comment": "Malware payload (AgentTesla)", "value": "4ee4d111fcb69b9492f5c9225a92a0df88b9d129", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077509, "uuid": "fb6738d7-552e-4a5a-982e-3c86e73641c6", "comment": "Malware payload (AgentTesla)", "value": "dfae90babef348e11f494eee0aecf3e6481bc137cf4fcf1993d4ab016cd17bd853bbe779d4b92455559ea7619f00595a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077509, "uuid": "a114659d-4739-4b23-a860-8aabd4e87def", "value": "T1D5B412067644E037EAD4BB356F15D2339B887C012250166633F6BE8B773EB336A9E158", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077509, "uuid": "eb09647b-ab18-4d58-be59-c86d61411fa0", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077509, "uuid": "658794e4-1f1e-4536-a4ce-120ffb0bdaaa", "value": "12288:4baXAwILIPIyxWw5EjbJ29tuJV0uFqj/AR5:4baO8PIQTSbJcg0ucDAR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781077509, "uuid": "89dadb35-26dd-4e63-b770-742228fd8103", "value": 503712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781077509, "uuid": "02925985-77eb-4005-a0ef-774c1cd9b132", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077509, "uuid": "1db7fa1d-2ee6-49da-92d5-0892ae28447a", "value": "COMMERCIAL INVOICE AND BILL OF LADING DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9eff586-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105661, "uuid": "9c25ee8c-7618-4829-8783-e7351e7f5bc1", "comment": "Malware payload (Mirai)", "value": "0148a7629bde078ff2c426d8cad7d991", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105661, "uuid": "31f2abbd-9619-4b6c-a8fd-f3f999665f3a", "comment": "Malware payload (Mirai)", "value": "b2dd4fea4693173388f9ed6ac37d11b2621c2d741f7cc5ed18bb607393b9fa68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105661, "uuid": "d9d7e73f-3760-46d9-8653-ef3979f6a8c2", "comment": "Malware payload (Mirai)", "value": "be24e20dc592b1e07c2a7d940b8ab32c87207371", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105661, "uuid": "138778c7-68bc-44bb-ba47-79ba71d9a4a0", "comment": "Malware payload (Mirai)", "value": "2c46d3b32ba595fed6a6e331452a5846659130326f69b2beb0c4503e0b5c8b652c8fcfb4fcaaf1dc297ab2a0d5170082", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105661, "uuid": "efef5f9d-dad0-47a7-8fa3-a3950fcf190d", "value": "T1DF933894BC419B12C6C6227BFB6E028E372663E8D2EB32179D215F2137C785B0D77A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105661, "uuid": "a54d1f23-c73a-45e6-9d71-a5c5f70c3b14", "value": "1536:eyHRPRmLKhFIWcMlVW+GCVnB3foiMjqLonCQmz7bQ6dXxZPWlk7M2DA:eyxt7W+G+3QBBntmzg6d7WidDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105661, "uuid": "69d8d207-4557-48cf-81fc-195c51f38324", "value": 91744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105661, "uuid": "4054d0ad-54e3-4661-baa7-512b92fd66a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105661, "uuid": "b7a2b734-e0d7-4dae-9add-3b86470ca4ef", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694c5a41-64a6-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781080131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080131, "uuid": "43df07f9-aba6-4b66-8c1a-db31137f1b86", "comment": "Malware payload (AgentTesla)", "value": "53e61586a7fc6c11cf92cd40c3799a79", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080131, "uuid": "65e73b43-1a4d-4b04-ab65-619daabf45a5", "comment": "Malware payload (AgentTesla)", "value": "b39f95f79a6f3c28bced3e03b8845efd8bc1884deea1a50e383d3e3aa7c2c783", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080131, "uuid": "efdbafff-3395-41da-baca-73882ef14918", "comment": "Malware payload (AgentTesla)", "value": "a8a9e2744e9414dfa34888faed0f794b53758868", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080131, "uuid": "0cdc0130-0ed0-4a96-be7f-d4a1a78a269e", "comment": "Malware payload (AgentTesla)", "value": "0ed52300e029db8ab6d25c33fc40a7885ebd75ece71c18bf0fa23a811d6e318224ff0b81344fa36e24ea7575aa989118", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080131, "uuid": "5b598ae7-2e32-4124-babf-a7db5b601dc5", "value": "T107237374290C45EF24D7EAB4B088A7E3FE6C0A5C8FED664F525487DA163E68734C3981", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080131, "uuid": "a6b4b350-e02c-4a21-95f9-23ed9b88c4cf", "value": "384:PuKzJEWeAynInFTh0LJ/RkGKUnpfPnoiWZZMnFOXRI7p2TjH:mgMKN8JCXUpWKQBI7pgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781080131, "uuid": "9e09d310-dcaa-470a-b7ed-0e88950a8c01", "value": 48962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781080131, "uuid": "52507776-13a4-4d36-8261-726b9fe094df", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080131, "uuid": "8be22c8b-0cc0-45d0-98ad-4a631fa54ea9", "value": "Juni 10 2026 Harga Request.pdf.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513ba76b-64ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781083098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781083098, "uuid": "db97733d-a6d7-4897-afb9-1da8fc0715f9", "comment": "Malware payload", "value": "30b9601c64f34079964fb0df19d17d6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781083098, "uuid": "732874db-e8d8-4465-bfb7-dd7f58b78422", "comment": "Malware payload", "value": "b5cc1289e6985637cafcf9dfc6c3590a7ae513a27780e0b1c2c1a20596c7798d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781083098, "uuid": "814eb177-c7fa-4e66-9507-0c694eb31f80", "comment": "Malware payload", "value": "a8fe963797450dadde3e96f81e874ba0e858c4cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781083098, "uuid": "4ec5aafa-d1a3-4843-85c2-066a7d99d7ea", "comment": "Malware payload", "value": "5e52e48f355a735ad8e91aeb080e0292613bcd49c165599768e18159b14119c518622a23c5c42fc91e84340dbfcb2cd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781083098, "uuid": "daf0aabf-bc34-42c2-94ad-e560b7e12d64", "value": "T1F262E92796B36927C0C1A37610EB1716B2AABF989018AF0F7E191D5F7F803112D1B798", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781083098, "uuid": "af244871-a521-4ec2-8e76-161d83e28b56", "value": "384:OdkL6jhPANHcLSh9MVwBAUcIPoR6pM7P9xw1wko:OdCQhPYMPUcV9xvD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781083098, "uuid": "0cf9f881-0949-42f4-a02c-d37eff3b34be", "value": 15080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781083098, "uuid": "2439a6b1-baa0-49e4-9b0c-03de6a8817ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781083098, "uuid": "a6f37e95-2319-4ad0-91b6-f5ba57f4be7a", "value": "zero.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1148af95-64a6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781079984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079984, "uuid": "699b8e70-ef9f-4e7c-a8f9-24e7413cf1f6", "comment": "Malware payload", "value": "7ec99979a05029cc1232421bc7ef53b3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079984, "uuid": "138bf514-fb91-4379-bd09-364689b07f0b", "comment": "Malware payload", "value": "b61edc3ab85007e68d2d2e7df78acfd5ac2ab99d24e5e737bea7b7c2b479f6df", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079984, "uuid": "c2de095c-a35b-44df-9af7-855acfe7e1f0", "comment": "Malware payload", "value": "87f9a7b529f700cbe49dfa94d44039e5eb6842f8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079984, "uuid": "49caaceb-9e7f-4d2a-a6c4-400daf8eb160", "comment": "Malware payload", "value": "49f4c56a54b9803e2bea9ceafe0b964164933fbd28fe90e5edf6277f15c12354dc20f2d774ec98d4b2e7ca65a42e1ced", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079984, "uuid": "fd72870d-c0b8-467a-b117-fe30a8f15a99", "value": "T1A8C1B53ECAB8666A869F49EC3275019C601AC370A3217E704B4F8C4BEFC1575CE795E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079984, "uuid": "86d4a304-facb-4e79-b3a2-70cc4d96bbe6", "value": "96:y+IRr56V2cbdscSz52Mdkzk0+jjqaHtLsP0x87spGpFg7pi3SAK:y+IRsccbmzMk9jVpxqspG3qU3TK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079984, "uuid": "48d10e65-c93b-4598-9006-64e19afb9df5", "value": 5885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079984, "uuid": "707e0c9f-e637-4d52-9d15-8a1ff005789b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079984, "uuid": "31068cd6-712c-41d4-a82e-f2443d6494ea", "value": "VqNOdVSAUpZup.jS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0039c582-64b4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781085968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085968, "uuid": "ab554cae-d085-4964-988d-b534d19e904e", "comment": "Malware payload", "value": "dfacd470205cc0e996bbfef7728c18ac", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085968, "uuid": "78d6a36f-4fb0-4144-bf69-604c1e90225e", "comment": "Malware payload", "value": "b638d4d5fccbc89bc3aae0a8593c71a4bf61e5b2842d4de7e0f729739b3c416c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085968, "uuid": "3039a660-fc8d-45e2-9b63-6b93c422123f", "comment": "Malware payload", "value": "68bbca93d97145cdaa49df88fa090509a24bbea8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085968, "uuid": "df48c59b-a3b5-400a-80ac-16b61438b343", "comment": "Malware payload", "value": "b75c7c411c318efc0c3814a14eddf2ca00a6ddbf22cf675e01611366c158c1620bef446620524d2203be5f924c292216", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085968, "uuid": "b3c5bb95-4701-416e-95ec-f3591df12d6f", "value": "T15BD312196B224F9EF4264C3C52F3AC110B4C7D5EA983A2649A4CECC81FB46CF555C7B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085968, "uuid": "f92ab4a1-a1d2-4311-9c39-2e444d3d7b30", "value": "3072:SofwvRrcyfvP88FbZ4Oc82heqcPcP+20GvOq/dfz4bQAIUpo:2vRrHfH88FCOcnMqcED9T/hgQDUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781085968, "uuid": "93e55700-e3fd-47a4-b217-eba5bb201048", "value": 138436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781085968, "uuid": "f130957d-a26d-421c-a493-5da3c63b1063", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085968, "uuid": "479d4420-a47f-4f84-9151-5b3adc9bbc64", "value": "kworkerd-netns-rt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af5f4c6-64a6-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781080000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080000, "uuid": "e453ded3-8ded-4ef7-943c-441f5f1acc37", "comment": "Malware payload (AgentTesla)", "value": "6134189766417a41106eaa4ce24f5fa4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080000, "uuid": "82f0f38f-d2d7-4fe0-9d8b-88e7f0ee95de", "comment": "Malware payload (AgentTesla)", "value": "b654713c9d14d537df7e9b8f99debe477e57311798fdbe4f8b4d8d13b3a601f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080000, "uuid": "ee994643-46a1-47d6-8059-dd673dc576e9", "comment": "Malware payload (AgentTesla)", "value": "e3eca35366c3ba6cadfdcffc2b81325cd10f215b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080000, "uuid": "bce5a183-9a01-440e-84ff-dd476f3a3448", "comment": "Malware payload (AgentTesla)", "value": "97b44bf26a9d9ed4b34d9ef03a6c1c7f1a65ec46b88aa47105390c8e614906f23240c58d002bbeb82ac05d6c0a0d71a4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080000, "uuid": "00ec67b7-d79b-4ccd-ad27-c8904952c870", "value": "T1CA66079107819272B3168FAD2776F9A0D40A584754E8DB06745DEB3432BDC27E3BA3F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080000, "uuid": "ea7f76d2-fb03-4d6c-9709-6db75a42c928", "value": "196608:1/dXNsBmrF+8xrwObddlLlhW/dXNsBmrF+8xrwObddlLFL7:S8T1lhV8T1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781080000, "uuid": "68be9c8c-96c0-4bb4-a4eb-71b7a01357d5", "value": 6732324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781080000, "uuid": "d1fe8611-b080-4c13-ac61-169f7245ffc6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080000, "uuid": "d6a10e11-9516-429b-805a-008bd1932e70", "value": "100626000024.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd8c793-64eb-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1781109617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109617, "uuid": "36af66a4-b08b-4bb3-9477-58363a0206d2", "comment": "Malware payload (DCRat)", "value": "0d6925a19d09354f5247820d746efad4", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109617, "uuid": "ffca9aa9-cf2b-4bcd-9ccf-6b28ab852151", "comment": "Malware payload (DCRat)", "value": "b6973c2ced99ff4ce53c7bb7b347bc891955c327efaefa87b68e95b7c0bafd31", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109617, "uuid": "8580568d-308f-49c5-bf47-d9e8dcc9ae34", "comment": "Malware payload (DCRat)", "value": "40005993e78117eab41a4ec7d1a3fe7e9ced5141", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109617, "uuid": "a6cb06dc-4775-4e8d-bc03-f718b868eae4", "comment": "Malware payload (DCRat)", "value": "4593bf6e9be8d54d81bdd58d0ab8dda7fb90e1f8176a2c20f0902e233b7e2de8cd45137a2b7d81204e6bc2bc50b367f5", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109617, "uuid": "4acbee08-b657-48df-abfe-271589e630fa", "value": "T19C05D5027E84CA11F0191233C6EF494887B4AD5166B6E32B7DBA376E55133A77C0E9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109617, "uuid": "87aa62d3-87f2-424b-b6e4-5ec7680ec0b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109617, "uuid": "c0dd5b27-ac7a-4622-b99c-c4ce1e196c74", "value": "12288:RqgfDTG4o8FsL3DTdB5mFZc3tF6mXDOaqEk/lXKWeO:RqGSl8FuDTdB5mFZc3tg2OaqQWeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781109617, "uuid": "1acf431c-f893-4d7b-b9bb-5c6590bf743a", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781109617, "uuid": "1d278c7b-4655-47a5-b66b-7af8f6d493bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109617, "uuid": "3984d307-a111-4e37-8415-c002e62cdc09", "value": "0d6925a19d09354f5247820d746efad4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e6c87f5-6518-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1781129049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781129049, "uuid": "dfd49ac9-9759-4a2d-9eae-aafbd2490a9f", "comment": "Malware payload (Stealc)", "value": "9302ed8d438bcdc3cdf3cf8e09e6a225", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781129049, "uuid": "53af6787-631b-47bf-b12c-9cdae9f17059", "comment": "Malware payload (Stealc)", "value": "b7060387c40d51ac08a6e7ce33226b02f975ccfdc8ffa95c7412110e4adbe855", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781129049, "uuid": "0fc9ebc1-1190-4bc8-a8f8-98533029811b", "comment": "Malware payload (Stealc)", "value": "ab8595ca89d68292df3274a396159788499182d0", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781129049, "uuid": "44cc05bd-71e5-42b5-bb15-c9a54f7d40ca", "comment": "Malware payload (Stealc)", "value": "363e114c0fb20002b41bbc81af062b3e5c3d1fdbbc41109a161adccfd1197ce5b2e49b0060727b065e90a4115baad394", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781129049, "uuid": "c507b1e2-b78b-4287-af40-aca6924acf3e", "value": "T1F3D4AF12B991D076E1724635CC64EB549B7DBC700F219BCB63C00AAA6E716C0AF37B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781129049, "uuid": "259c2ade-55e7-4a01-819d-7a77a58ee966", "value": "6f6a2d13c671ec1552810ff82e0b59e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781129049, "uuid": "2a8c5d96-90d3-4150-86ec-2a77b9894885", "value": "12288:TqhdhP0xZ5WDNAcRx+NlGFULw8yxBlDetAqxSvkkKofgF:TqtPSWN3RAfGFow8ybs7ofO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781129049, "uuid": "aa0a438e-1401-4346-af03-4febc6bafe10", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781129049, "uuid": "a78af902-0a9a-4aff-b7d9-3f5c041bb727", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781129049, "uuid": "6ba7c24b-e558-4f32-aa9b-b7dd7eaae9e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0227314d-6495-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781072657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072657, "uuid": "a1f8a26e-ba77-434c-bbc2-095e119b96cb", "comment": "Malware payload", "value": "971462d58420c0ced92fd1090eba2d6a", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072657, "uuid": "56bef7d2-59ff-45fe-a059-9fb59583390d", "comment": "Malware payload", "value": "b7bb3a5d16eafd1b9ef1a78f1803ea064b81f70b1a0c6e886383024d85e498f7", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072657, "uuid": "5e8ded08-c061-492c-b682-cc063907b7f9", "comment": "Malware payload", "value": "6d8c00f4c77cd1028f7dc3ab2bce13d18b7beff9", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072657, "uuid": "15da29d9-c9f3-447b-9053-3fe81f2b7323", "comment": "Malware payload", "value": "082c45648c7b3704f36735856c67016c5a3b2e5cbb6aca940f914617691d6d2f901b0e61e74c8e3c9964af88048019d4", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072657, "uuid": "2b87bde2-24ce-449c-8104-76adeabeae84", "value": "T1BD953394E9A8DB1BB4CCC87319B6850F4191CDC3C254CAC7679526468F2BECE2F0D9AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072657, "uuid": "06fc5c2f-743f-450e-8ab1-3cf4d63475a3", "value": "24576:28gRMq+ewBOuDX4218HzTS0pYCTh9KO2Mq2Q/9oWxZwk8Yf5eTs94kP6wYg4oLsb:zUwoujj4ZTet4Q/9vxZZ8G1r4YmzQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072657, "uuid": "e405dc7a-67c9-4a73-983e-364b558187a2", "value": 1887916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072657, "uuid": "fc8e1ed7-56ad-4f79-a4a6-b8c1566fbd75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072657, "uuid": "2b3a1ccf-3ab7-424b-8947-b9d0cab2c30a", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd92d75c-64b3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781085964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085964, "uuid": "544328d3-6e2e-401c-853f-1c04cb5acd6d", "comment": "Malware payload", "value": "68b7215633b5e013cfee5f3fff2ee75c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085964, "uuid": "fc676a77-920f-4ec9-a6b6-9259e41cbd35", "comment": "Malware payload", "value": "b7d78cc81ba3ea0f5f288087c10847a763e6bad9399bf8b9afad2945b6b33cba", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085964, "uuid": "b8a65ab4-4634-4fb4-9132-d1c1d384a952", "comment": "Malware payload", "value": "403764290ac1aac06a3a99d23ce281b523b27ba1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085964, "uuid": "2b112104-b948-441a-9d00-bd0f94926b03", "comment": "Malware payload", "value": "77f9c0c6ca6724cf3a54abcc2de172c975d21c224ee0fc82429a4384f5672ddf344d8386aa4e3470d7cbd8006fd4387e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085964, "uuid": "d0c4e44a-8126-4a7c-bfb2-4e0c4f56158c", "value": "T1B441CE8679A3D53243CB84741F86B301E356654308A7D8D8B49E7D313FEA050FDA0E9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085964, "uuid": "a362033f-e029-49e0-aa65-caa494de3962", "value": "48:joNVdtxzIIamf1KG1efwFWZY4r/YNgNimQp/P8p1MlmlBFInKIYgVDF9jQul4dQ4:Qd78/mdwfkepbgnm/2nKI3VDv6wGHBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781085964, "uuid": "c0fb497f-228f-4c7f-b92c-bc927b42da2c", "value": 2432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781085964, "uuid": "19711e1e-4210-4757-8104-12fec9ba212d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085964, "uuid": "7681dc83-cce4-4b99-a817-3b47805961a6", "value": "init.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd1418e5-650b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781123651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781123651, "uuid": "b74f3040-47d4-4756-a6c6-454554b716af", "comment": "Malware payload", "value": "b9a670f9c157117e2293aa8074e63ef8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781123651, "uuid": "8ced3910-a7c9-4798-9c2c-00eaf4fe4b9f", "comment": "Malware payload", "value": "b8ae6ab9e9aef6d799f7dc4ec50ea2757bc90c9d0ce3beb2d113b2dedf41c6d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781123651, "uuid": "cd5184b3-6993-45e5-aeb1-8d78120809d5", "comment": "Malware payload", "value": "877343e764f1adf74bc9f911f06ee7c0cb857e95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781123651, "uuid": "c797ff50-216c-458c-97d1-463f14678a26", "comment": "Malware payload", "value": "e48d451d5b257bb98f257d9af2f8fcc4cf6df9adcb3f1553996e8e230232ea3051b3e54dc28a2236e104da92d4ae195c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781123651, "uuid": "b88cb368-d748-4a4d-8ebb-d3c80bda41e2", "value": "T15DD3F745FC518F57CAC252B7FF4E4389772A17A8E2EE7203D9256B24378B85B0E36142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781123651, "uuid": "baf592e4-ffd3-43f8-8a53-d5bd5846be99", "value": "3072:1XDfD83WT73yk357+vAXn93MaWKiI4QSbNwXpBRm8:1XDfD8mT73ykJ7+vAX93NWXI4QANwXHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781123651, "uuid": "b635e1fa-e1b2-4956-bb29-ff17543581ef", "value": 142636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781123651, "uuid": "a8cb3848-97cb-43dc-95b3-a6e2d7347a2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781123651, "uuid": "3e483c0a-d450-488f-8689-dc73f7d6f56d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea838b7f-64a1-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781078201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781078201, "uuid": "e6c67f74-c0de-4ff0-a7e1-348d0d7dee40", "comment": "Malware payload (RemcosRAT)", "value": "c564c40586f7855f7ca4438aaed3ffe8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781078201, "uuid": "084c8e6c-4c70-4a9c-9e95-1e5113de405a", "comment": "Malware payload (RemcosRAT)", "value": "b90c9b81aacb7c5050647e916f5ee5e3dc42c35fcd116ba559a8671f03de04cf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781078201, "uuid": "8501aecb-af54-4581-88de-35206aa25f3e", "comment": "Malware payload (RemcosRAT)", "value": "d7ee96c4fa27a370dbea619ed9d0b2e7e04518a2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781078201, "uuid": "8300aeff-358c-4e4b-9e78-241ed2e54779", "comment": "Malware payload (RemcosRAT)", "value": "ee45bfa281f10cc46cefea995246fa30bc1e8f1159475ed4d5c18e2158e4645d344a0ec2ddbd3ab932c10cd49d4f1a87", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781078201, "uuid": "f33cbdfc-ce89-41c3-8174-07e6a29715aa", "value": "T116265C17D66F974E180D3B51006A5D9AFE89CAFCEF72ABC4E0CF90B610EE1110B456A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781078201, "uuid": "c27a8d81-6cf9-46d2-9a09-fbb7c8bc2c70", "value": "49152:rWPvye904w4Z7hYF/qkGSYd6Q4QphXknDx1FH0C7aWPMv47PotGrHumB5+9rpoMP:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781078201, "uuid": "d4f47119-438b-4e07-b056-62c2d9a9e39a", "value": 4617855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781078201, "uuid": "73fd840b-3182-48b2-892f-ddacbd05792e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781078201, "uuid": "e8b00abf-4476-4c89-9673-e90c772dd263", "value": "Order#026051121005976369417807.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "899bc192-650e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781124853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781124853, "uuid": "eee4aeb9-6b3c-4add-abb4-6cb55192c9bc", "comment": "Malware payload", "value": "ca8b6e547a4f877b68dd8b1f10f7cca2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781124853, "uuid": "c544d553-806b-49a5-9023-eb06652f5b94", "comment": "Malware payload", "value": "b9698cf73eb3cf48f31e78e1582a4f03853da14b20081991af26393a2d171944", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781124853, "uuid": "d144cbfd-d143-4b1a-a345-7668ede76baa", "comment": "Malware payload", "value": "49f0fd93b9926158186a24b7d207c7dfe7e69a85", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781124853, "uuid": "c652fbb0-3150-4e5d-b2f2-ec015bc11755", "comment": "Malware payload", "value": "0cc7538bf8be789614d311b67208beac387f6a368d98af8b1aa43a89471435b40d72b162b2efb3f943c66973e9dd29da", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781124853, "uuid": "ecb1b588-417e-4016-8090-bbb98d9a0208", "value": "T12731A8EB0B2E3ACD5501DE6973A5154DE094A9CA244FE764FB880CBBE2C914C3259B4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781124853, "uuid": "87bd541a-d292-45ce-b45c-87596479398e", "value": "24:KaI5htucCpAsAnUmtQ8QXlRWYMNjyoh4MPIiZQkcTBzM:CxucRhPH9PNjzDqVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781124853, "uuid": "f2f7881d-c603-4e75-8549-fd303b16f92e", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781124853, "uuid": "0d604181-a2ca-4ff0-b41a-0afec93c1b52", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781124853, "uuid": "0e74cfbf-4c0c-4fb5-b95f-0c68d362487d", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe982ed-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105644, "uuid": "a7236a4d-07a5-444d-8699-0fbcdec77a3a", "comment": "Malware payload (Mirai)", "value": "12f10bdccd17f5fd7d324b0d0d4d73fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105644, "uuid": "e447b270-8e55-4860-b751-5b8b5ee5e633", "comment": "Malware payload (Mirai)", "value": "b985df1ed9299b2812d981149ab1ae895943dca7a50f6a1ada24a028f9b540a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105644, "uuid": "b7ec6324-1867-4e2b-9995-6450ff9c2d25", "comment": "Malware payload (Mirai)", "value": "57ceba6a5e0f6b9bbc94523cbee109030bf86de9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105644, "uuid": "9af9e90b-af75-44b1-8d50-fb4d2995db24", "comment": "Malware payload (Mirai)", "value": "3df6fe49f114a8a0dc1b4bfd1779b67d8e2d8ec5708cacd01f31f551dbf4f76c32dc2e62e14cc0bc85c345955fb6f3c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105644, "uuid": "a26f51a7-79bb-4929-a5e1-33a31c059567", "value": "T197A35D97F401EE7DF80BD5BA04670A0AF630E3E51B930B366397BD67ED351A50826E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105644, "uuid": "91b630e1-daf7-47bd-98fe-0e9faac1a18e", "value": "1536:iPhR5NhZp+huOzP6DxHd8P9foRRfZAuDbAV3GNPt8Qk3a:ip3PSVWxHcqRhzhNPt8Qk3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105644, "uuid": "7156bdc6-0e22-469d-805a-5259e37d7821", "value": 106760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105644, "uuid": "9ff5e10f-a0ce-418b-a0ce-12198c7afd8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105644, "uuid": "2eb4e2eb-dc20-429b-8abd-c61176871bfa", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81fdcc97-64d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781099930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099930, "uuid": "3fb08d97-ccba-445d-a5dc-edfc8c1f8911", "comment": "Malware payload (Mirai)", "value": "040816022bf8ace39f38c8bb4982f267", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099930, "uuid": "ff58e4eb-58c3-4bb7-94ce-c6cfe252e62e", "comment": "Malware payload (Mirai)", "value": "b98f9f58d15e051daf10c63b717780204a18c38a8b8ac23d3a2f686d30c07e09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099930, "uuid": "0cb02dc1-0fed-4447-83f9-3522c5ed01d3", "comment": "Malware payload (Mirai)", "value": "dea2f5b59573a9b2419f759feb86d180549da673", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099930, "uuid": "9d24c80d-23fb-48bf-aefc-c73d9951ec58", "comment": "Malware payload (Mirai)", "value": "c211416c18a3bdb023d8344bde8a098b94e3e82bbe3682aab6fd5f40eee52f7f131440130b65fc0a6ad3c87265b5b763", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099930, "uuid": "98c3bc65-7155-4f92-8b25-788c5282efed", "value": "T19193195BB9819B11D5C412BAFA1E118E331357B8E2EE3312DE14AF3133CA96B0E7B455", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099930, "uuid": "6d082c6b-a563-4ee6-8e33-d12b7de45373", "value": "1536:DZngNODk88cg/VYDaa/kibyWNWMaq9IBGcpdiQlOLl3/7LZ5cY8uhp:msDZ8n+atiRNWMaq6lOLl3/3Z26p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781099930, "uuid": "48d44072-a6e6-4020-884c-50fecb0d606d", "value": 96252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781099930, "uuid": "b129dbc2-001c-4f70-a765-6f44be12a60c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099930, "uuid": "f2fb39cd-8486-4828-842c-c704e13b7427", "value": "obmsxxvnc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2284d437-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781108789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108789, "uuid": "634d9542-8773-4099-9eca-71b6ec358cd7", "comment": "Malware payload (Formbook)", "value": "95c78a415cbce2c0d7790f6e94edfa13", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108789, "uuid": "c27b17b4-873c-4485-802a-1bd579a2c208", "comment": "Malware payload (Formbook)", "value": "b9ffd24643748eaa6f9af99381a672513140ba74ab8f384a17d412cee0c730c2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108789, "uuid": "7c60cda4-3784-4014-9375-bcd0c15b4f63", "comment": "Malware payload (Formbook)", "value": "911aaff22fc8ed3d92131326253190dcda9342a0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108789, "uuid": "bb4570c8-d0c8-4b80-afa5-cf0f9adbb8e7", "comment": "Malware payload (Formbook)", "value": "a7a263d8d3fd948719761853405e88aad266ffcb44e53fd16ada326a2e9e6842210e2a6384d5eac3fdd8c55b91563c70", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108789, "uuid": "c8683a00-7771-4f8a-8d92-2f63914673f7", "value": "T1A5E56C17C66F974D180A3B61106A5D9AFE89CAFCEF726BC4E0CF90B610EE1110B855B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108789, "uuid": "27febea1-cee2-4e5a-af18-b738ad2801d8", "value": "49152:jN/43qqM5h3nuCRWM6Jv+S3PswNGX7SaKoz4VbTZvvPip/W6H6QhwD:+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108789, "uuid": "80f14bb0-19dd-42f1-a46b-7ad1ac3499ee", "value": 3151012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108789, "uuid": "3a3d52d4-c1a3-41a0-80a0-84c705673225", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108789, "uuid": "878630c4-76fe-40ac-b1df-379c90e852f2", "value": "TR9302.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e22930d-64ec-11f1-a769-42010a9c0008", "comment": "Malware payload (NWHStealer)", "timestamp": 1781110258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781110258, "uuid": "efe0804d-29d2-42b2-b453-5605b2434251", "comment": "Malware payload (NWHStealer)", "value": "ed47423c14d6d6622bd478876cddc64e", "object_relation": "md5", "Tag": [ { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781110258, "uuid": "ee53d8ff-bcd7-4834-b983-2f09bba5b1cb", "comment": "Malware payload (NWHStealer)", "value": "ba0cb805e9c834ac74903d865a9e4adc73efcf2738acf82b97a3ae880c32a4e3", "object_relation": "sha256", "Tag": [ { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781110258, "uuid": "ded3df01-8176-437b-b307-7ba090be8afb", "comment": "Malware payload (NWHStealer)", "value": "fa5406b55060037f46622c0d64c340248b26ce6a", "object_relation": "sha1", "Tag": [ { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781110258, "uuid": "56b10300-c039-429b-8527-fd826f874d15", "comment": "Malware payload (NWHStealer)", "value": "c667d0304ab42d8278cfb9a6212f49cdc5ee083b8768d4eb101074c174849aae8668eaeef146f0d1c4e1a99b0180956f", "object_relation": "sha3-384", "Tag": [ { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781110258, "uuid": "f1432ad9-8912-41dc-a263-c5afc413631c", "value": "T1289733DAC4232B4BD4EF96329BF5514EC2B4805BEE40852BB0D263BA14DFAF7857C506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781110258, "uuid": "3abc53a9-8239-4242-a323-275d5db754dd", "value": "786432:0Kwja5G5fyIEaSkJ8QlM4HX4t8RMesS+3Pu48p5txDgcJ00SeI4Ax:0nG5GFyIEW874HXY8RMe+Pu4w57nPSeE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781110258, "uuid": "f3a057d5-ce7b-4939-9500-2ea7e9a7c31f", "value": 41724256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781110258, "uuid": "f6c753b9-b378-4f2b-ac45-7d8ceed2fff3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781110258, "uuid": "4560586e-0e3b-4ddb-8d87-34406fcec163", "value": "InstallerX_2026V1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "272f3f60-64ac-11f1-a769-42010a9c0008", "comment": "Malware payload (LeetHozer)", "timestamp": 1781082597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082597, "uuid": "ad684d54-987a-454c-bb03-c4ffa4446a8b", "comment": "Malware payload (LeetHozer)", "value": "96f20ef47d62ca49dc69c3992799bdcd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LeetHozer", "colour": "#A57159", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082597, "uuid": "980d4724-1efa-4f66-9e53-7827bfb09113", "comment": "Malware payload (LeetHozer)", "value": "ba47271532231975d45c37851b13b4edd6dbe7a1be4fef2e9634c66dcc63c02e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LeetHozer", "colour": "#A57159", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082597, "uuid": "ec6bcafd-0e74-494a-acae-ef5e0fe558d5", "comment": "Malware payload (LeetHozer)", "value": "f8cbf69cbd3f50adb27d01ab435f8d3c692053d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LeetHozer", "colour": "#A57159", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082597, "uuid": "85c4e7fa-6760-411a-b477-d951b4e75b4c", "comment": "Malware payload (LeetHozer)", "value": "f7d79a7ad67fa94d5106c06e5ff8ab0c44de00000d9834611ca26b050a2beed9a86292cef6cdc7d7d15b4c84d40400c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LeetHozer", "colour": "#A57159", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082597, "uuid": "a6c9c043-e5c6-4b58-ad7c-f1a8d5696239", "value": "T1D103E19163E82876E7B02C3BCF644242B13F24E5E5CF205BB588479091C9DEBB0795EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082597, "uuid": "83f36379-8b83-426f-982d-72070e1557d6", "value": "768:tgJd6mgfghqXopuyXi8T5xkNSUYMw68U1vzjj6ZFrUIa82o5zs3UozX:tOd6mg4+opxx+SUGhU1vzyZR3wzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781082597, "uuid": "1c352fe4-01d5-4586-b525-b5667d46bb42", "value": 40860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781082597, "uuid": "0a536d7e-5127-40ff-b9b2-c9807c8ee5d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082597, "uuid": "a76c66d5-4183-4937-9150-170efbc3957a", "value": "zero.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a5cf6d4-64be-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781090441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781090441, "uuid": "d75be252-56bd-4935-a76d-f5eec4b2fa12", "comment": "Malware payload", "value": "5bc46149958e7b561037f81898e022a6", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781090441, "uuid": "ab362537-a87a-4ed2-ba60-27c975af0503", "comment": "Malware payload", "value": "ba6e13ce41abc5ff7b272002de76bae16554b4ab295cd07d41d10e764a4f29f3", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781090441, "uuid": "9f9d6051-24f6-44a4-83fe-ef48612fe3bc", "comment": "Malware payload", "value": "8a7f1a3222e044a3f70f6a95596619903842ade1", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781090441, "uuid": "19eba3aa-cba0-402f-b547-093fe5fe057f", "comment": "Malware payload", "value": "ba24e04ef0bdaf77f91e0db4e0eb55cc6f0e7fdf0d081be1b0edda32eb8ff4b6429ce412cef16b1feed6753ba79659ff", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781090441, "uuid": "2cbd9159-0212-4e96-a8cc-46c55efd26ca", "value": "T19021B1544C08C748A83223B5DB7AE744F9E355A3320BEF52744CE9836F35126D964EEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781090441, "uuid": "c080b1f0-275c-48ee-92b2-a68f1d8b5819", "value": "24:hP2AHFj2bu66olytYt+Hra5+gg4rOUGHAel9WgOMC+:t2E+v6oljHGgiRC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781090441, "uuid": "e7630452-bdd8-49a7-93d8-7c4bdaf9f255", "value": 1306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781090441, "uuid": "ceb1acd5-9bdf-4bd4-b2af-7152381cc0c3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781090441, "uuid": "201f8aab-af32-400e-820d-9a1f8949fb24", "value": "2.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8b30a11-64d1-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1781098760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781098760, "uuid": "a7883e3a-819e-479b-84e4-a1ae7e08632e", "comment": "Malware payload (Gh0stRAT)", "value": "7a6cbc6c83060d7d513c3cec21631ec3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781098760, "uuid": "ba991310-a666-4f44-855b-9e4a41bab8c7", "comment": "Malware payload (Gh0stRAT)", "value": "baa25e933aa75148368de25aedfe804f10cba3d6825860dd2b34a34d6e2ceff0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781098760, "uuid": "6a988b52-31a1-4ed2-9019-bd39487d9a12", "comment": "Malware payload (Gh0stRAT)", "value": "07aa1bb8fcb1cf9ff43ce569cf5eb17ef71ef179", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781098760, "uuid": "d4cab8bc-0529-46b8-8cb6-3b2900388894", "comment": "Malware payload (Gh0stRAT)", "value": "8739c28fe91e8f8d38ec3359939ee7561c6aa0d1c4512a51571f534ca12aeb954236496dae5ef68cdc3e8cfc0b854443", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781098760, "uuid": "730b2b28-1266-4bb3-841d-78a23c86c8ac", "value": "T19127333FF2AC613EC5AB07320572932099B7BB61752A8C1E57F4848DCF2B5611E3AB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781098760, "uuid": "2fe58ca6-6fd3-470e-9bd1-6bb19374fd32", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781098760, "uuid": "8030470e-ca19-4eae-a475-70b9be59f78e", "value": "393216:uSElz43wR4EYOw0zGXUAYi4CPoRIxFj+gL0AbTsa8uNDBmYNdMiIaF2Rrk3rl:G1/DYOw0zh7uj+a0K5sy0k3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781098760, "uuid": "95321325-509b-4f00-8925-057fed2aa7fe", "value": 20344366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781098760, "uuid": "06e22396-18fe-41ff-a0d6-374be1236537", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781098760, "uuid": "40c2330c-dcb6-41b2-9489-64b613312db7", "value": "SecuriteInfo.com.FileRepMalware.86872113", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e553dc-6511-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781126315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126315, "uuid": "024c8c47-c18f-4974-aaa0-a9f46bd29e89", "comment": "Malware payload (Mirai)", "value": "8155c88e3783586c338f701ff3ebd96a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126315, "uuid": "082d7b82-cbbe-427d-bae4-fc38967fa5f0", "comment": "Malware payload (Mirai)", "value": "bc390bbf8ab84102c08cfec67a32393b20644b2ed35b293ba752e24f4a2ccdd6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126315, "uuid": "81239794-3741-46d4-9512-c94052a35c13", "comment": "Malware payload (Mirai)", "value": "8609c54341e01d374ccefe355f7c03b46f88929c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126315, "uuid": "687771bd-3d1b-46cb-9b90-7836c839528f", "comment": "Malware payload (Mirai)", "value": "7c9374902600fcc459e876e5b24d79535b04975f7e7425701324663ec9a985b1df1d3993c0b6c7da5b25100c15a494ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126315, "uuid": "111aea59-844f-46fd-8663-8fc6e5b8dca1", "value": "T17663E646BD828E16C4D512BAF92E018E331317B8E2DFB2239D146F2077CB92F0E67556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126315, "uuid": "594bceb3-47ec-44a2-a239-b10c07f4bf3c", "value": "1536:TZn3xRZOk3U1V6V8glRZ+WBP/0GX+VQnPPI0iVITdGsGC:VZ9BcGGIdGsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781126315, "uuid": "81c6d5af-727d-4b2d-95e3-002f26161b29", "value": 70788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781126315, "uuid": "f5ae24e4-d6eb-4d22-a688-453fcf385bd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126315, "uuid": "848a1546-3850-4937-9fe0-cf05795348f8", "value": "kwari.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac19449e-6491-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781071224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071224, "uuid": "6995e331-11ba-435d-9702-74ff28bb5f12", "comment": "Malware payload", "value": "ba74676c9c0634efc1c1cdd425d0d84d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071224, "uuid": "1990a933-ef6d-4ce4-92ab-0767e8ce61ba", "comment": "Malware payload", "value": "bc7af534a47d4433ce698b0b3dff9061d80308effd7882751d1ffab73e173452", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071224, "uuid": "b6505c6d-e0be-4c76-90ca-f4b0391b1fd2", "comment": "Malware payload", "value": "34e5a0f1adb93a82bd710eec47bdea7a76781a22", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071224, "uuid": "ab015f38-640d-48e1-b8b4-43efc0805d82", "comment": "Malware payload", "value": "55637c9b0fcfbdf377e988e9d788b52aa1fc7751362b008cb88c166617c07c30a17de98d2e737682e6e3162fa6a4312b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071224, "uuid": "49d5b91b-88df-4c0a-a695-a95d3e650e4f", "value": "T14C1412D15422B16681A320FED5BD1234C2C13EB50B89ED0A3AB73758D0BF6BA1FD5B16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071224, "uuid": "f92aed29-d4ab-4953-ae14-aafac431e8c2", "value": "3072:GI/kIXQICOzuNPAmw9q6frVatMrKtX/Ic3L5wKTih6S9xdwt3bb7Ovi0/GPccKnZ:3sIgznNPAmwJYtM+h/IAWhJ9jU/d9Pcx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781071224, "uuid": "412e8cf6-10b0-4c31-961a-7ae85032454b", "value": 191486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781071224, "uuid": "ad64a972-3978-4e95-af63-704e82b3ace2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071224, "uuid": "4350af3d-aaa5-4fa6-9403-12f37a1e4e5d", "value": "po-15716127.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b216db-64b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781084529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084529, "uuid": "ce599930-3c2b-4700-bfb1-553c753134e6", "comment": "Malware payload", "value": "031d021363e7e3f29c439072f74dd939", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084529, "uuid": "38d83af7-1f50-4f34-8e61-afd91a04d83d", "comment": "Malware payload", "value": "bced8cff5d91f64e4788cf3fd4e3008b2d0703d3957689ae77ce7b86e8c2b412", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084529, "uuid": "7451ccd0-04e4-42ed-a372-06f789e913f5", "comment": "Malware payload", "value": "a6b7eb14079e809fb48236cd933581a68cce55cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084529, "uuid": "780ddea6-2fe6-4e75-9a3f-8d603fa721db", "comment": "Malware payload", "value": "c4137e6097e43a748d313511ec829baec0f1cbe898118b117f30bbd417c796871069d805fd51cd801ceb9d9b6f595c9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084529, "uuid": "d2b2d7c2-c5c1-4919-8693-74fd1cd550a0", "value": "T104B59C443365D847C29867B85851D2B44BB14E92BF739BD16AF12CAFBEC738B6C0A443", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084529, "uuid": "50f5b808-73a3-4425-bd8a-b00ae84e45ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084529, "uuid": "53cb09ef-2aa2-438f-b7ea-c6485d7249fa", "value": "24576:3BtfhHn8ek4kh2XEUGPhaPKmSxDuUKClKGxjCEOU6s6CVphF2D5tSNgk+XA82bJ:3n5kheKhDvKC8GxjC27Vfz8qJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781084529, "uuid": "921b48a7-a6d8-4277-b5a8-8aac3eb7f1d3", "value": 2338304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781084529, "uuid": "d351d0b6-1e19-4ebf-b84d-5132bb5edba0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084529, "uuid": "a2095f36-03df-4bb1-b9e5-3e474cb17651", "value": "SecuriteInfo.com.Win32.MalwareX-gen.85513839", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "657efe96-64a6-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781080125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080125, "uuid": "15e51458-2b87-4e27-a3b6-c137f9eeb9f5", "comment": "Malware payload (RemcosRAT)", "value": "f5d14eab857282318efc2c7097189c34", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080125, "uuid": "55d5c990-f8ad-46ec-a9b6-0c52f84a2e8d", "comment": "Malware payload (RemcosRAT)", "value": "bd02cccf73c33e10e8451a1e9278b56ab0a5374318427c2b7c8032c8313d4a84", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080125, "uuid": "125a9ef0-4cb8-4c63-9648-3489a29e80d3", "comment": "Malware payload (RemcosRAT)", "value": "2113427347a734f059a3a04147a5893f28302101", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080125, "uuid": "15aec72a-1e5a-4c63-8412-1d26d1ed4930", "comment": "Malware payload (RemcosRAT)", "value": "1ac0a9526138b45831a61027d224103ff137afa9dba26d7e0cd76a5280da8037e334bd4f1fc9bbf7bbce59442d08ada4", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080125, "uuid": "d50b1206-25c1-44a2-a02b-ba6999afb7b4", "value": "T1C89274709A9B0B95AB8B177ECCC07A40A724DBE4853204DDFE961B08F13C474BB65E99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080125, "uuid": "0fd1b3ed-b1fb-4cbc-b33e-efb094b8131f", "value": "384:EnccH9VAYWKaZnrxeUjju3Ei8g9QAxHr/CWpOhUvQ:yZ7taJrVK3Ei8g9QAxTHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781080125, "uuid": "ae431de2-7d2d-4004-bf4c-412599539453", "value": 20366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781080125, "uuid": "c8a77047-04da-424f-9245-374d7bd839ee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080125, "uuid": "c7bb5aa6-4469-4ecf-84d8-c0907dd731e8", "value": "h\u1ed3 s\u01a1 nh\u00e2n vi\u00ean.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6af33fc-6473-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781058384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058384, "uuid": "a463b222-a0d9-437b-b945-bced77d7392d", "comment": "Malware payload (Mirai)", "value": "add298718f105381230791b085cb739f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058384, "uuid": "f41aa114-f004-4301-9ac0-20995a7aa386", "comment": "Malware payload (Mirai)", "value": "bd1c2c8c1508e0f00a3273063fddb0b6e8466035ab711015057fc21e40317314", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058384, "uuid": "43d85eb0-2709-4eac-bd2f-b9e62741344f", "comment": "Malware payload (Mirai)", "value": "f848cad7fb828f05937d2a0d09c7318af2bde464", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058384, "uuid": "d84b0d4e-06b8-4eea-b3e0-51b2b567afd5", "comment": "Malware payload (Mirai)", "value": "4f747c6e4983b98c6e2ca5f86fa29ef037b2eb9b6be79b8fa10a1921c619ae304ca468e432e75694b6c09da1acdd3b01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058384, "uuid": "44a0ceb0-ba53-4824-81ee-da8dea75539d", "value": "T16CD36CD3701C7E7DD2536C3EC1425703AD1C8F51AA420A2680E967871BFB5EA6F2B987", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058384, "uuid": "114b8742-2992-4a38-95f5-83d0f0e11d05", "value": "3072:8WXVWPRPlP+jgxJPgQJr4yiAvRGgg4/HKo/1KT:bXgssLPBJ4EvVz/HbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781058384, "uuid": "4a8baad1-4d55-4ea5-a019-e3b08e3aa4f7", "value": 134228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781058384, "uuid": "199217e7-409c-4e22-953e-c9886f87e863", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058384, "uuid": "313c3bc0-b5d7-4f88-8a60-c75139203d76", "value": "wife.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4185cb8a-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781108841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108841, "uuid": "98752a35-582b-43a9-8e82-66c93efd7003", "comment": "Malware payload (Formbook)", "value": "580d990791ebf0372008b729922c92d1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108841, "uuid": "2f9c30a7-17ea-4df3-ae26-72c40c019d88", "comment": "Malware payload (Formbook)", "value": "bd6dc1b2bf27d2fe7878aca3fffacf5240c2c0e19b003a31b80a266f4203173d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108841, "uuid": "006fcf4f-434b-4d61-9416-c59450f96135", "comment": "Malware payload (Formbook)", "value": "50fd3a883961716d4dacac54da968122fa8b68cd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108841, "uuid": "7ddf3592-4afc-42fd-bd01-1613a0081141", "comment": "Malware payload (Formbook)", "value": "8c2cea41ffd126da995a5dafff2d68bcd4d3082d8b23c44c8ae7917834a11854bfbc1774cabb089ee9f175c3c14e47a2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108841, "uuid": "eb22d12e-b55d-4565-bd35-d8cfc15763b8", "value": "T116E55C17C66F974E180D3B61106A5D9AFE89CAFCEF726BC4E0CF90B610EA1110B855B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108841, "uuid": "fb40d359-5023-4d8b-8def-5662ba062b1f", "value": "49152:msSGQmqulZQUpJJBWkE68E7pmfvos53dYFWDtEuo+:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108841, "uuid": "43851d30-fd46-40c3-850b-4d72edee0357", "value": 3142004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108841, "uuid": "ab5a3608-c992-4b74-8fa8-76b52f9368e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108841, "uuid": "d0376fca-9a96-420d-8291-cb7df4923fa9", "value": "New Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62179025-64cc-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1781096440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096440, "uuid": "ca0799f6-d6af-4cef-824b-222737db93a1", "comment": "Malware payload (BlackMatter)", "value": "8a4929a4cdad1a28d9bc273df15d8cdd", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096440, "uuid": "3b397d02-8b90-433f-8e68-69d550fd676d", "comment": "Malware payload (BlackMatter)", "value": "bde1040f09977c860333464af390159fffeb3a2156f0cc0607369c3115c2f2da", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096440, "uuid": "1d9fa4ec-4d62-4d5a-adde-b3fcfabead79", "comment": "Malware payload (BlackMatter)", "value": "0548fb5f1b424e2cdbc17b057916ad5d1e6f3777", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096440, "uuid": "e0bf2cb5-d4c0-466c-8d50-fcbe3670373b", "comment": "Malware payload (BlackMatter)", "value": "c3ef98c71b2d7e6f13b710ddb29216685daaf1301873876ba6a75eec4c81e6d4c14a328281009022284e233cddfcf204", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096440, "uuid": "d2b46b8f-9928-45e7-ac75-b80e9f90bbcf", "value": "T128E36D21F222D0B3C87718F13736B572B3EE4D2C19A56907DAA80F5DBCA58232F45697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096440, "uuid": "efce5572-5abf-4fa5-9473-c9cfaf34a307", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096440, "uuid": "27f23afa-3849-4150-be4e-2742042005e8", "value": "3072:L6glyuxE4GsUPnliByocWepkW05zpyJhg/A7:L6gDBGpvEByocWey59s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096440, "uuid": "2bb659e8-b6f0-440d-9f05-742e52ae37cf", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096440, "uuid": "4303f8e7-ab69-4157-8796-8ec5524af7fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096440, "uuid": "32d349f4-128b-4ad3-960c-284804305efc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0903cc4a-64be-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781090278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781090278, "uuid": "ea38a38d-ca31-46b0-8339-bd90f2b80236", "comment": "Malware payload", "value": "c5a59c3906137787b1b911dbe8f38b48", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781090278, "uuid": "a0f8243e-09a8-4102-8239-d164f160a0dd", "comment": "Malware payload", "value": "bea8640980d020130ca2e40ff862f456866246c886f6e24b11c696921d227e8b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781090278, "uuid": "091bde17-8286-43ea-bb2f-6c5dd2d99592", "comment": "Malware payload", "value": "850532bccf02f270c6f280c7f0b06599a576a325", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781090278, "uuid": "e8456a99-7df4-470a-a789-908867cda04f", "comment": "Malware payload", "value": "059031361cce198d4833bedceef4941a29f9db135bf9a35a51d14e33c76f97908343f405b496b39eebcc48798feadcb1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781090278, "uuid": "fe2078e6-1854-4c88-98d2-d54042f97d4b", "value": "T162218405CA8E052DE0926F7FBD4A22552D710D5584D13EF34E00CA84A77611DBBE7516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781090278, "uuid": "0d843c03-73aa-40af-a31f-aca4a71440fa", "value": "24:9irhGDd/JuXwmZU7vAEdEVu+u5dT2sToLxzPRBw/S7Dc2:9ir6/ww3IEdE0+iTgLx7Q/S7Dc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781090278, "uuid": "97225722-b542-4622-98f8-397ec94c0ba8", "value": 1219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781090278, "uuid": "7547384d-cef7-4a6b-97bc-ee19e4ed3f8c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781090278, "uuid": "1584bebc-7ea5-4cb2-a502-aaf4aaaffa31", "value": "Adobe_InstallerX64_11.5.2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee67a30c-6511-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781126311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126311, "uuid": "bc573e77-5af6-4154-b38d-da7f73618e2a", "comment": "Malware payload (Mirai)", "value": "870040a89d944842f8a9a8de6316c7cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126311, "uuid": "610af9d1-2b6f-4e72-874c-224955f45382", "comment": "Malware payload (Mirai)", "value": "bf6be1b8b100bc3ca6763f0d7e412108ed3fd60f05f2e5aec2042be3f1cda66d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126311, "uuid": "5f0af87d-f4ae-4af0-a45d-5bac4fb7ef1f", "comment": "Malware payload (Mirai)", "value": "313664210fa6d6c39fb88f3594dfb1abcc14e827", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126311, "uuid": "b201f4a6-51f2-4e8c-b665-18c55b52c488", "comment": "Malware payload (Mirai)", "value": "fa924c9f7a6e9e44cc976dfa2e5aa9f6896ba820f0629d492c404bf09d54de60c8c1f3a4d7c1e230bd1d57028b00226d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126311, "uuid": "c3914183-75d4-4880-930f-ddef2977f3c8", "value": "T11D7386092E219F7CFFAE423847B78F259648339A36E1D585D25CEA011E7074E341FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126311, "uuid": "66e22f03-dbcc-4a59-8b70-b98f7b7fe055", "value": "1536:PCxBpGYuQsvvfIkMvdaGuT+tp32xIogGrYzgp1J7:kLduPMMGuYkxIogGrYsLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781126311, "uuid": "4f57166d-a952-41ae-b0b3-854943a1f577", "value": 75836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781126311, "uuid": "be64939a-5480-4865-b826-eb0d7130b6ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126311, "uuid": "f20b3466-77f2-48f2-a35e-0a1aa63e7e13", "value": "kwari.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e5b602-649e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781076524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781076524, "uuid": "484e1aad-c339-4501-9ff1-48d801938077", "comment": "Malware payload", "value": "ed6bab4edf384a23ba544658fbb234d6", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781076524, "uuid": "90b2569e-c814-487c-a425-f02b412668e6", "comment": "Malware payload", "value": "bffaa6b5f069dc01ceeda942a52106cf65a521c519e44ff71ed2a31a834d6b21", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781076524, "uuid": "ba10b6b1-9101-41e0-ac14-db5b1e0a1fb9", "comment": "Malware payload", "value": "c789faf1eeff8a06a6345005341b096a1e0c0cfe", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781076524, "uuid": "9fd04ffc-14a8-4c52-8bcb-26535265954b", "comment": "Malware payload", "value": "12e8fd9b4bafe43c40cdf8c67306fdae13f786b8b99a0e2cb01e9fd8bed4c6cec2680814bc341c5cd40cbfefc7c51751", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781076524, "uuid": "36aeb5cb-a17e-48b0-a2e0-651afff335c3", "value": "T185B22B06E3B304BCC49CC7B5C22F9512AEBE3C161B60BADF27A126297D307947529E75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781076524, "uuid": "47ca6d9c-58c2-4dc8-8024-8de088f520d3", "value": "a2706f6f638154d2b431abe5e1551efb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781076524, "uuid": "efe18425-bab2-4370-8d8d-184403c3bde0", "value": "768:JpmljpNfUDnCy8Dbmk5lwkeshAAAAAA6C:Jpm9pRUDnCyGbmk5Oke5C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781076524, "uuid": "a4037aa3-71dc-444a-9713-bc2a3b5b24cb", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781076524, "uuid": "e027b192-f03e-48a9-bc0b-9ece2658f633", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781076524, "uuid": "c9d8fd57-9dab-4ef5-9497-0f6971dad64d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6077926-6498-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781074328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074328, "uuid": "1ae0cb49-575e-42bf-9f30-69b5e01fb373", "comment": "Malware payload", "value": "df00d944c138c8193329a0a98dc2d3e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074328, "uuid": "31494b6f-655e-43c3-bc30-bd72b282ced4", "comment": "Malware payload", "value": "c00640cc14fcff47ac94631050b5a7bf9e164cae4cfa4bce450be41af665b6f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074328, "uuid": "e69bf367-730a-4b03-b45d-116a6c09465b", "comment": "Malware payload", "value": "5dd9ecfc8d1e8a21e1d46138a041ed9eedf2f39f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074328, "uuid": "ce80613a-7b61-4471-810e-e7c7e974e428", "comment": "Malware payload", "value": "a7472281eb2b77e1e5692fa80f6db1cc6743739b762bfee4a16d7c6a8424d594d9f823cf7a286ca1fb44ab4ce8924d64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074328, "uuid": "38c03b12-624d-44c2-94b9-fdc172c8a876", "value": "T111C57D5AA6B840A4DC9AD174C42B8A0BD7F2B9518A74C75F406113AFDFBB3720E1F325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074328, "uuid": "44cb080d-74aa-49ae-99d1-7cec5eed3347", "value": "8773db76b0ed464873af9ba3e3b79198", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074328, "uuid": "36d2dd11-1c8a-4997-89e5-01e27766be4e", "value": "49152:vgl1UMcTAJiV1YslJoM/9ajuZH8YbbUw1laANk:0BqCzYbbUwzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781074328, "uuid": "61672791-13d3-405f-acdb-19cf7d31647d", "value": 2613792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781074328, "uuid": "defe6f0d-25d7-4a93-9755-d24f494b6a84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074328, "uuid": "0c3eb9d0-7783-41aa-8c1d-1e90710b78da", "value": "SetupXML.dll.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aefb8d4f-6470-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781057056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057056, "uuid": "6d145a59-13e6-40f4-9fd4-5aa15fb3f03c", "comment": "Malware payload (Mirai)", "value": "594aec7569273ee4ec8e65097cffb534", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057056, "uuid": "3a992b74-4509-49bf-8530-0ac70db4361c", "comment": "Malware payload (Mirai)", "value": "c121214c9aa4f606dbb19898d974c8448cb3c9676bbf26f7de2fc76f992caa74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057056, "uuid": "1d8fca97-b629-4d96-b4c2-4dba2002a36b", "comment": "Malware payload (Mirai)", "value": "7441367b922bf448c2fae0b5c7da7c0b7a6a4ad9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057056, "uuid": "c3f82f55-795b-4d62-8e8a-40e013190408", "comment": "Malware payload (Mirai)", "value": "5d25c1bb21d4e3f6e17dc9dab5a8a248178d554567fdc77f9d598fbc74d818a55041833da30fbc4363eeb8cd6a98e773", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781057056, "uuid": "17015379-f8d6-4b8a-9dda-ea30f75e777b", "value": "T1E273021EF55538CCDFED21B86A1145A0C843B9A0352A2E591317CC6EAE76F03ED4A1EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781057056, "uuid": "4c7a3c62-0ca0-4aaf-b3d6-7aae4188fc62", "value": "1536:nLZ2s27OS4h60U+PG98y94XhngmvQuJ+axkqBDSCLv3tBmDv9rBbgEv:nLZ2s2774kuA+r4I+GkqRxLv3tBmvHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781057056, "uuid": "6a0659cb-bc09-4529-9926-43c82813c603", "value": 77992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781057056, "uuid": "b62db696-f2b9-491c-8876-c7864134c666", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781057056, "uuid": "9fd43a54-beef-493d-9480-3562b2839d05", "value": "wife.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "781e723a-64cc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781096477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096477, "uuid": "8973382b-d4cf-4e02-b757-65ff1bc0efd9", "comment": "Malware payload", "value": "3ed7a02d06acaa3ace69e675e1900264", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096477, "uuid": "9e705853-0a45-4522-9683-2dbefc5dcec1", "comment": "Malware payload", "value": "c18d5fb0bd6747b11530290d60f4974b86681d36f6891ef4a17192c2d4be9b16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096477, "uuid": "92e1e6fc-f075-46a0-94cc-897e486a7102", "comment": "Malware payload", "value": "df695b8b1e52ca771afaa6d75f5299ae32238883", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096477, "uuid": "f2900bc1-2672-4267-8142-aa0943241ef7", "comment": "Malware payload", "value": "a9c89552e9b22b155970e6a449a6b299b488001003aff99be1da32f28e763ac9008a08aea9e4e72b2166fe9d229207cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096477, "uuid": "96b05693-004f-404c-a127-741fed1ed7a5", "value": "T1F722E604BBD98236E4BE8B7C08739311267AF6029933DF9DACCD515E4C667418C52BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096477, "uuid": "d3767f83-7c84-4ecf-815a-ddbb5d9ddfc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096477, "uuid": "745efa95-d623-4993-b3a8-b74132303530", "value": "192:MtVBjeMtLyTugHaC54uuX1uLYZw6HaOaC9PF4+wy2gUWN:SeeSugP4LX1usZwuaOaC9P7wyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096477, "uuid": "1cc13923-b474-4416-8075-ae505770a2a1", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096477, "uuid": "278ca121-3692-4829-91d3-0bbdbf7f1eb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096477, "uuid": "0728e0e3-8982-48a6-95ef-809e69193c88", "value": "rSaraLucianaLuizaFreitas.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "051c144b-64cc-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1781096284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096284, "uuid": "787f7db9-2360-4075-b049-35d974fa94de", "comment": "Malware payload (XWorm)", "value": "81be90b877e982c2fab8417f9fe5865a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096284, "uuid": "5aeb5e16-10b5-4cd1-9bf2-416129b0e9d6", "comment": "Malware payload (XWorm)", "value": "c365fb4056768fff09d504a81621c669371ba623ec3098c71ed34e257f9bf7e5", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096284, "uuid": "39bd9b3d-dbec-42a6-9362-bceaa26440c7", "comment": "Malware payload (XWorm)", "value": "709c1d21aa45ef712aee16878746490a654fa729", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096284, "uuid": "4e75431f-9222-42ec-8902-3c1d5f8d5833", "comment": "Malware payload (XWorm)", "value": "1d519dc8e2193a44b7f2e2006feea2a9658570e0a4e0eb90af4426b771d0fefe2cf0b31530312cc760c680e81a86ffbf", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096284, "uuid": "a57df4b1-4082-4be9-b98c-7f42c2c21f86", "value": "T1D49512B6864E43ABECF3427115FD2A8081612EC486E3C28BD0666E45F137E765BD7C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096284, "uuid": "5320396d-18c1-46f3-b0e3-d5843971791c", "value": "384:W0cGiWTofWmDlum8Uwc9iIllUHByf+jG9+mMiFByXIBqiW3liHcGUWjoi+jGSgCi:WryaQoT8NLujyE8/ldro0B4x7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096284, "uuid": "98575666-1f88-41da-9fca-2badf83fa31f", "value": 1978388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096284, "uuid": "403feb7d-6e97-42c3-a727-a31d962b45e0", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096284, "uuid": "b68aa181-40b4-458a-a30f-389e06957678", "value": "PURCHASE ORDER_16658.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "470c5c20-6511-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781126030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126030, "uuid": "4be140fc-b816-43a4-8fde-ed470e61d5cd", "comment": "Malware payload", "value": "93cc01273af1e2b820188641c0bd9686", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126030, "uuid": "246d14da-5744-44bf-8c6a-d7635c139e10", "comment": "Malware payload", "value": "c3d3d02c884f1a4964fe5c01b2d8c21f77027388d54082162f3e35b8a72c0a68", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126030, "uuid": "0d72f20d-77d5-442a-a41f-508bc83dea7a", "comment": "Malware payload", "value": "5e0fafe06a82c67b8d610ba4b982d36b31d1777b", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126030, "uuid": "f3a4b5fd-ee35-4464-8652-aa6813b91ebb", "comment": "Malware payload", "value": "667492b950a843a0d47cdc9e8777870e925003cece0946a708212e329c4f6cecf9b52ea53c79486cb831ba7af97a6ea2", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126030, "uuid": "151b50e7-8fc0-4f7f-baa4-bde311359b77", "value": "T190068D07BCA109FAC0A9B23189A792557B35BC491B3623C72B51BB783E73BD25D36350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126030, "uuid": "558804e9-5c1f-4e7c-ab87-72a7ca915db4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126030, "uuid": "a8d17d07-1e12-43aa-b562-b6704a513d3c", "value": "49152:ApTYk/IsJOSVD/3CST0A1DbGl1BZ7Oh0ZDxeucXX:Abrglzzdw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781126030, "uuid": "2fd1b2e1-20d5-4c41-9ef4-e38911649dd7", "value": 3745720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781126030, "uuid": "ae6b3564-78f9-428f-acaa-38eada4f56fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126030, "uuid": "23fefc63-0ed5-4f44-9089-500f0d9f1594", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec818ed-6515-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1781127761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781127761, "uuid": "eb6fdb1b-d1ed-4e97-8d22-43bd71ec55ed", "comment": "Malware payload (SalatStealer)", "value": "2b0ede286e82b7d48f40e2f64513026d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781127761, "uuid": "00e66d1e-1c4f-4a5c-a08d-871b518f10bd", "comment": "Malware payload (SalatStealer)", "value": "c4028d2f6fd3c0a11a7ae73810c3923cbaa7455d19b901ad1047c3a9c5c73971", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781127761, "uuid": "2301c6eb-cfb4-4731-9eab-07db5253a5ae", "comment": "Malware payload (SalatStealer)", "value": "978c4b32394cdea9039f7605e00680250039585a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781127761, "uuid": "7e95750b-18fe-4bbc-bda6-29b5ae6cc714", "comment": "Malware payload (SalatStealer)", "value": "9bf1896006529ec3ea5fafe126a7fe5f98f97ea1d1172b66b0e7035b28c944cb6f295013d374aa8bcbc84375ec480a24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781127761, "uuid": "92c860e3-e9ab-493a-aa67-86bd81ded945", "value": "T1F2C66B11FADB95F6E903583100ABB37F63315D048B28DB9BEB547B2AF8776A10C66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781127761, "uuid": "092cbdee-5b54-4245-bd80-64c17f103333", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781127761, "uuid": "bdd2e15b-75f6-416b-9ef2-de99898307c3", "value": "98304:thsaYAe/J7EChHvcFy0FR9/omr4L3HxmcE5O/:jYAifHe79wWsM5O/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781127761, "uuid": "5faded3b-6632-402a-a9c6-6096fbeb6ac0", "value": 12572160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781127761, "uuid": "a411ffb7-260c-4e26-9de3-0743d44986f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781127761, "uuid": "e88460d2-2339-4d4f-8599-cc393ccafdc4", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3970942a-646f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781056429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056429, "uuid": "683b3276-3aae-4b01-bf09-8a6b3f7063ed", "comment": "Malware payload", "value": "fa1925701808296e0e8e191bb14b3bfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056429, "uuid": "72b41a9b-43ad-41e4-b7e9-b0b2572d52e8", "comment": "Malware payload", "value": "c4a3f1ad17ebf83f3d9de0037f541a4f9433e7787f65178d54a136bd5d1cf543", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056429, "uuid": "5b8ddc57-ebdc-43b2-bec1-439f7f3b97ff", "comment": "Malware payload", "value": "e77ed6788bee6758755b8a5bc3fcaf7e42907191", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056429, "uuid": "978f070d-132b-4dc1-bf40-216cb7fe0fd5", "comment": "Malware payload", "value": "71be26ab78207f3f371861ac51b37dc94aaeac0bad8211912515a1480be9e17d00000381e229e8d98d058ff966e4c678", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056429, "uuid": "7114fbcc-aff4-497a-abbc-753fc920f774", "value": "T1DE63F765BBBA0A0BC4D4F4B662F74226F2B5834A14BCC6173DA20E8DAFE954031177F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056429, "uuid": "318f56fe-ff31-43f4-bfa4-5319a6c29c31", "value": "1536:aC++NTlPZ4N7ML4FeP8pCP/3s+IOnJwVHOUSUv6q:MQh5IXv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781056429, "uuid": "08ac629e-48c7-4067-a150-21e817869e9c", "value": 66976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781056429, "uuid": "fafdd353-d975-439c-9767-3bbfa3488b4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056429, "uuid": "67773afd-5487-4ea9-a406-b34bd6e5ef50", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87699beb-64cd-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1781096932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096932, "uuid": "defe6a44-c3e0-47f0-aa85-8781ce2efe03", "comment": "Malware payload (BlackMatter)", "value": "e019287458f08873bc49474c54c302d7", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096932, "uuid": "d02abfe4-d121-496b-b968-4e924ad845f0", "comment": "Malware payload (BlackMatter)", "value": "c527ebf0bb60a09e78bc1b4605573d93fccc7df0d3776120dffff79e4ffccf45", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096932, "uuid": "02d7a2a0-ca1c-4a33-b955-85a4ba03f46f", "comment": "Malware payload (BlackMatter)", "value": "136e2404c5ec23c2420953019ff9a67b7eaa3f70", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096932, "uuid": "ec0cbbc9-f9f4-460c-9a40-f58af0f4ab29", "comment": "Malware payload (BlackMatter)", "value": "cfb8ff713b12886508c9eae0a89f358ce236d9286ed49fc1856f989a48524ad3fbe3ec507d9a5004760de0d28854160c", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096932, "uuid": "d19acbd2-0004-4fc5-a925-fd84b6fb484f", "value": "T12CE36D21F112D0B3C87718F13736B572F39E4E2C1AA96907EAD80F99BC648232F55997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096932, "uuid": "1059c898-c4ac-4b1a-98d8-bb755c6b4d95", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096932, "uuid": "47aadf21-e107-492e-9b96-4567c3ce8c53", "value": "3072:F6glyuxE4GsUPnliByocWepZH93UgIBoIe9ls:F6gDBGpvEByocWeVU9ve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096932, "uuid": "7027355c-12e9-462d-804f-a9f3610411fe", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096932, "uuid": "c9506674-12fa-4b93-9c3b-d0a43e707a0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096932, "uuid": "7982c24b-c94e-41e0-b23a-e08019ea4e8d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d13d8931-6498-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781074293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074293, "uuid": "77e852ef-e402-4eea-872f-630c6a3e9588", "comment": "Malware payload", "value": "17d5018075cc00e23db76351d2384d04", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074293, "uuid": "75bf2420-3444-42d8-84fa-e4b51dc715f7", "comment": "Malware payload", "value": "c5bd69d4964c01e119f27bbb4a7f265e634270e9a91d40084b420c3afdd6e7b0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074293, "uuid": "83cafe4d-b636-4b7a-bbda-b09e9153c4d6", "comment": "Malware payload", "value": "4044493df6de00ed2b8149c0f8ad3931825e1706", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074293, "uuid": "64e116a6-99a6-410f-a290-ada14a58c73e", "comment": "Malware payload", "value": "0616dc6cdbf239976f2fb4bac6eba6b52a4884a258f93d0e9014ac730493dbf90098215a8e8fbc8491c0c946b1f53bc8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074293, "uuid": "f79bbe52-19f8-46f6-bec4-9df0baa27390", "value": "T16B349D407982C436D1BE19355479E76219BCB8211F60CAEFA7E84E3D4F742C0A735ABB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074293, "uuid": "0206e821-e65c-4955-b381-5fd0b4269931", "value": "8619be7c887d78f08177b0b3012af982", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074293, "uuid": "8fcaf7ea-e0d9-465e-b5d8-a83709627048", "value": "6144:f7it8SxdR2ZWtosRkXI0kAOvICZH25Qf5:WecdR2ZWbRkXaNI+H25Qf5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781074293, "uuid": "959e7e2a-81e9-45ce-91a9-fd12048a9905", "value": 243376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781074293, "uuid": "e9c2b64d-51c1-4cba-ae92-c333698e0966", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074293, "uuid": "af398756-d7f8-4dcc-b50c-2a974295be1e", "value": "Log.dll.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fbdbccb-64eb-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781109643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109643, "uuid": "e2b1723d-0d0f-4dd1-a88e-5cbf84031490", "comment": "Malware payload (Vidar)", "value": "4cc305b83fb5e7bdeb55970f5d5cdb56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109643, "uuid": "90b2f55d-823f-4bd4-9454-886ff717a9f6", "comment": "Malware payload (Vidar)", "value": "c66ab9597b64c0c59878461dacaca49d745acc7f06a228fe126effede63acdc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109643, "uuid": "8601045b-6a65-4a14-b514-5b3e3cf637aa", "comment": "Malware payload (Vidar)", "value": "dffa5556a34df5b8f91f123e463154e0eebc1ecf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109643, "uuid": "fae1df64-d7e9-4400-8725-d6a2729330de", "comment": "Malware payload (Vidar)", "value": "38ba9262c073c5d8fac7934bfb452aae6223d6da4547121f58cda5831cadf49563420480f02d63d2aa972fe41bfb6896", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109643, "uuid": "ed0ef2d3-941e-4834-beae-c79fbb254d32", "value": "T19ED58C066EE90AF5C5BE663648F221427F7A7C884F3293C3255273791EB23E0AC35756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109643, "uuid": "ec034bcb-64ee-4740-8a4f-b618f86fd01d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109643, "uuid": "24ad6482-710c-42e4-bb1e-e874a00fee48", "value": "49152:zeHZpoP0/RanWTIqjUl/WmSFMzWZuwT/RFFicnAM:zXA0o5Z/RRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781109643, "uuid": "e61bdf03-c4a4-4939-bb61-e11b3204127a", "value": 2925416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781109643, "uuid": "936f4d76-ad85-4526-b5d6-c3d9659d64cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109643, "uuid": "f5ac61db-ed55-4848-bcb2-fbecc04782c1", "value": "Fly.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c92409-6498-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1781074191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074191, "uuid": "da0cdc30-35d3-49b0-a127-61643c677665", "comment": "Malware payload (PhantomStealer)", "value": "83fb966610cffb5717f9c3b154424aac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074191, "uuid": "c8805a93-e59d-47d6-a534-ad99a4b40722", "comment": "Malware payload (PhantomStealer)", "value": "c6f8729d491286d2deaa843edd031cd48e735b9c4963825d94b53a2bec084be4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074191, "uuid": "787a7595-e301-45df-840f-d87a47a8c020", "comment": "Malware payload (PhantomStealer)", "value": "bcaa46a421698614b7d91a8b5e185c30441aaa45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074191, "uuid": "0456b9d0-c197-4d14-ae82-a916ad5e7cdd", "comment": "Malware payload (PhantomStealer)", "value": "21760ec8d8d293d442a53ba1b78974796626615cfc315056093ae7476e90e91d5fcfc216e2532ba0d6f00255e5d5e177", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074191, "uuid": "50d7d878-76cd-47da-9451-dc68094c3d89", "value": "T1FA75126D6A16E607CE5167344E70F27917A85EDDBA01E212AFDCBEFFB826B104C04193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074191, "uuid": "8ea624e3-ad6a-4b1e-b1de-c737adcf4700", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074191, "uuid": "26c5e6cc-ce51-4ab0-85ba-2658fe3f72a0", "value": "49152:aYNZ8bpLzUaIP0ICAQBE7OK1ZQl17FuM0:J38bpUaIP0ICAQs1eLUB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781074191, "uuid": "e4306198-8f79-4777-a766-fc5911338616", "value": 1577984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781074191, "uuid": "b0fc6aa4-3d09-4c83-be81-20eeaf15f873", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074191, "uuid": "508f3b5b-88d6-42a6-ab0c-dc293d5cb46a", "value": "Ust_Yaz\u0131 Yakias\u0131k Maliyet Fiyat istemi_ihtiyaclistesi_1062945_20260609 Teknik sartname.pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f148727-650c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781123977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781123977, "uuid": "f86ae4d3-2823-4d9c-8bb2-7576d1686e84", "comment": "Malware payload", "value": "b6389ba76327366e1ee934017c794be0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BTMob", "colour": "#3F15CC", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781123977, "uuid": "fe2db7fb-01c1-4a63-a09c-ccf0a13f33fd", "comment": "Malware payload", "value": "c7944bdac5ce3255a56e77c6f2a83917f4b8a909646396669d408f207e751772", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BTMob", "colour": "#3F15CC", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781123977, "uuid": "6b30a5b9-e1d9-4300-81f2-921ebea7a93c", "comment": "Malware payload", "value": "3061265b0a175c3a1e8882c4deadde84fea01f9e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BTMob", "colour": "#3F15CC", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781123977, "uuid": "c13c64ed-96fa-4d7f-ae15-ecae44e146e1", "comment": "Malware payload", "value": "8d5368aacb70e7c3aabb63b8945f95f3742121507c61475b2248b4038d63d465b120d62883a1b2a63da1b4d49a971ca6", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BTMob", "colour": "#3F15CC", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781123977, "uuid": "d6b84d80-e42c-4d88-b10d-c2d83a8af79c", "value": "T1BFE6AC23F5052AAADDC6A134F5E7179577301E540393A229171FF02AFDB25CECA27AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781123977, "uuid": "e3dbd42d-9769-4936-81f2-8bd92fa88db9", "value": "196608:D+djqswQtP6FO0oxQQ7PVVnhIBkbOOiW6Ou9b1yK0x4FVutm+4e1e:DYjkcKcn7Prnk0Odv9h047CJe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781123977, "uuid": "6d3df30c-c13d-49df-95d9-266a47815aab", "value": 14557807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781123977, "uuid": "53a44185-2b1a-465f-a9b5-35c6cc8eb214", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781123977, "uuid": "a17b83f3-40ee-4f0e-9bd2-23c64f9dcd89", "value": "0e2f6e7f-fcad-438b-8698-c796d047ba98_signed.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b7744d6-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781108858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108858, "uuid": "d47dc3df-193b-40ef-ba05-56817e7dc982", "comment": "Malware payload", "value": "13760be457bb0ff33a7ae8b865d71c61", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108858, "uuid": "aa403f92-e36f-4df5-8021-4a9be031f549", "comment": "Malware payload", "value": "c7c3ddb41d3e30bcd73caa5c313efd86d6c247d6044019c4dde1bbfea884b326", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108858, "uuid": "39fcf428-3d81-48e2-8ca2-30f03e416904", "comment": "Malware payload", "value": "18a1010298e3c5e550738d51382759b3dc99e9ca", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108858, "uuid": "b333a7a0-c27f-4577-b827-73762f27bfd6", "comment": "Malware payload", "value": "5c4e41dfa6482eacdadfe8ffe93a2be5b48cfdc778bacd480648a650d5f1b37017e4214cc9e59839dcdf06fd27f73ee4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108858, "uuid": "17148697-83e7-4561-ae30-131ec718a87d", "value": "T1A705C43DCC55012EE173D929C4AA049FE893660B633CE90B50CE675B6F63846B78739E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108858, "uuid": "8b025b90-352d-4cb2-a1b3-7b2e8718abc7", "value": "3072:DRq8hNM5QAVAkToIkxbl4q1TFMpwGAgMyH8G3njG/nJFb1A5YPlfCxpt026kc6OK:A85s8l4g8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108858, "uuid": "aa87b2b2-e289-467d-9b66-f9a1f53e8cfb", "value": 840840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108858, "uuid": "749ebffd-d11b-4a87-89b8-b8d302f496b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108858, "uuid": "5cfaf1cd-1462-4416-9bff-7030e1cfaa33", "value": "Shipping doc 630967210.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176e8355-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1781108770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108770, "uuid": "48191c2e-f859-4c47-8826-2f4156eb072d", "comment": "Malware payload (XWorm)", "value": "8e9d0cb821291d0770d9711856d5dbdc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108770, "uuid": "7f1bb260-0d04-4419-a7f5-b8b39d7f090c", "comment": "Malware payload (XWorm)", "value": "c7ef76a4546ef91f4f5280d0febd6febd6b0e7762495ed6979a8f49255d326be", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108770, "uuid": "03dcd63a-5d3e-4469-b817-b02d3e0606b8", "comment": "Malware payload (XWorm)", "value": "62bf6b5e1d833ce22a4af819b8217f2d92e0ff71", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108770, "uuid": "a0a95879-aa20-4d4d-9337-f026a9a98d03", "comment": "Malware payload (XWorm)", "value": "8f019217e5f3eeb9869fe707ef9f3a691184f128e81c3d5c8fd936a68429f49bba0a7e232f16fe205e867da5137fd43e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108770, "uuid": "25bed58f-d437-454f-b980-5620f174b564", "value": "T195B51283D69B3D298715AF0D4C681055EE61183E64EDF26DBC9890CA706438DDE3FE36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108770, "uuid": "c09bc081-1664-43eb-9e0d-589783a0bbf3", "value": "768:/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaf:L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108770, "uuid": "8a972117-f2f6-4c2a-87d7-516d911651e7", "value": 2471714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108770, "uuid": "6a3276e6-a3e4-4469-88db-2fdf1569394f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108770, "uuid": "1f899a7d-aff6-4042-8f0b-3e5b103d1c6a", "value": "RECIBO DE TRANSACCION.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b6fd92e-6468-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781053372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781053372, "uuid": "106238de-3c29-4e77-b53e-1ef630519c05", "comment": "Malware payload (RemcosRAT)", "value": "aca2cd6c666d1261216167f16925a739", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781053372, "uuid": "aba46442-e1fb-4c82-ab56-f528b1eb47c2", "comment": "Malware payload (RemcosRAT)", "value": "c802e37cd04a2a3c6b4215350373c4cf90611eda4cf5a83a94782e9af90c8f5d", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781053372, "uuid": "6bd68370-9bee-4851-a999-c09aadcad709", "comment": "Malware payload (RemcosRAT)", "value": "47a60c5208c79d23965941a93dffeacfce907613", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781053372, "uuid": "748edc3f-13ce-4fed-bed3-24cf3c563125", "comment": "Malware payload (RemcosRAT)", "value": "3e21022489db687b1721fa9828b2ba8d9f3d2d7e5378c3a392d06ee62c8101059701b05bc29ad73d97fbb8be2bf863cb", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781053372, "uuid": "7e02cb0d-fa14-453f-bba6-c1db02341e4e", "value": "T197A25261B6620BE5ED9B6AFCDDC435083A24CFA0017308DCFDE5678CA60D5747BA2E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781053372, "uuid": "3134b763-13c6-4775-92f7-c778c5b4ad45", "value": "192:ruQk7hdoTQFg5CWK8Y7XO+UjuWNN8st96pCwJI7PelgRIwGPP0+AYnwH7fQPzInx:ruR3Rg5VKG79Q+h7PlLdqLqQuFSgv0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781053372, "uuid": "6bf667b5-8338-4dc7-aa25-cfd0b801f10b", "value": 21299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781053372, "uuid": "b7d9c4a9-7069-4541-967a-1f37962a0cf7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781053372, "uuid": "9b2afe2d-fbc8-423b-a460-c678ed64c185", "value": "Reconquest.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "573a28bb-6511-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781126057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126057, "uuid": "ea280a49-a111-4ef1-a0ff-633adc08913c", "comment": "Malware payload (Mirai)", "value": "2a0f85b67278971c3d13a817d14abc8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126057, "uuid": "52a43eb7-1683-47ac-9bb0-226af9c346d7", "comment": "Malware payload (Mirai)", "value": "c82b2e1f9f0eb866743b4990fd160bac98676c14825a65c13944c129268041e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126057, "uuid": "392ec2b0-7acd-4dfb-8180-e43370b99241", "comment": "Malware payload (Mirai)", "value": "dac21bb9b46e8c8ced386b14157d34c9d55dd13e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126057, "uuid": "7e113ca5-e1b4-4b69-9fd9-12775d69c4ce", "comment": "Malware payload (Mirai)", "value": "35a28a3c8b1f5a09b4b6a88f100086843ca7da91b0fb9f1696e822d0f6e7954f6ac5b507574fb587356d930183353a31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126057, "uuid": "6cc8e5c2-68a4-4086-a7bc-961b2db97fe1", "value": "T18EF318D7F900DDFAF80AE73684530805B130BBA258915A376257393FED3E1990977E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126057, "uuid": "b16d3ca2-b244-4245-8e0b-fbf4e96f4ebc", "value": "3072:vX/HFNJCzLNYk0gJEKWQ0hrVTjbi1LCnFhGpP4KGtLXbyCSdMY:P/HhCznJEm0hsLCFvl1yCmMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781126057, "uuid": "de8be530-ae4f-47c5-86d5-ddfeac449c55", "value": 160716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781126057, "uuid": "75a7585a-fb11-470d-917b-dfd2eb9cf765", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126057, "uuid": "b7fa8ddd-ed41-44ba-8e0a-e9c5e63b1bd8", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff0d9aa3-64b3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781085966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085966, "uuid": "636e58e7-6e28-49cc-9328-4c29a275fc94", "comment": "Malware payload (Gafgyt)", "value": "ad37f16afb30841e995a3ccd01d3802a", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085966, "uuid": "57c15bfa-ffc7-419b-8d2d-4480af2f6939", "comment": "Malware payload (Gafgyt)", "value": "c90197d80fec84e03147a7beb3ec030509127c3f574bccc6f6ba0766ed1b4680", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085966, "uuid": "5854844b-45f4-4356-9eda-455830b2e3a8", "comment": "Malware payload (Gafgyt)", "value": "150aa0dd81f52669765a0378c119669a61a450ee", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085966, "uuid": "c03fbe2b-2428-464f-b7bd-4cea499147a6", "comment": "Malware payload (Gafgyt)", "value": "66b32933b42b67898aa90370d764602aa21cdb4a43d1e600b6df473cf4a461b751e1d0ea6c76317d61886ee021b5ea24", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085966, "uuid": "25665a6e-8199-4d66-87b3-6556185a9eb7", "value": "T1F1B312EBF8560BA47AA60EB68402410DB8744D2CD744B1575727BBB39D4B8C0FEDEC49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085966, "uuid": "67ea89ed-be5b-4813-9b4b-22992fe7129d", "value": "3072:7E/3ntZi4RvnTSh3ULzHR5U8JbRt0tW18:7E/3n9nTS2LPzJbgW18", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781085966, "uuid": "5f1f6e84-c950-4b01-8995-2d8e6948c883", "value": 109612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781085966, "uuid": "24ef40ad-a533-4241-a551-8386ad864da0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085966, "uuid": "6f525a28-04cd-433c-bc85-134a6d1e7142", "value": "kworkerd-irq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25908f3-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105648, "uuid": "27a86ef2-738e-4385-b460-652c67c9b7fc", "comment": "Malware payload (Mirai)", "value": "f47f8c46498afc4b36e80caf0703bca8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105648, "uuid": "d102bf45-75ad-4033-b38e-f3ea5ef4a269", "comment": "Malware payload (Mirai)", "value": "c990c2651c79b473d438f7ebfc2354aaa7481a50c54ed6e200a30774197feb10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105648, "uuid": "3dd9c8d5-082b-4ec6-a485-17d20b5bcf38", "comment": "Malware payload (Mirai)", "value": "0299f573df1b9a897b4d8b673b2553435793f25c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105648, "uuid": "88d60502-e4bc-44be-9af1-ef1c58466ef0", "comment": "Malware payload (Mirai)", "value": "3d6964b2c95491b442cb4caf7d995237449ce9ef20e8f22e93c3b0da10e45d0f56dabb0a09efa2d8fb62dcce1b021644", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105648, "uuid": "8dd2bf5e-7b1d-4d19-9f00-89352a3e0df2", "value": "T168733B81F54B80F1D847487090BBF33FCE31D69541B5D66EEF699F36EA63202A60629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105648, "uuid": "c46657bb-8ed8-41cb-8774-d98fac34de48", "value": "1536:uVHQ0rPyMQn+JgVV/SGQ+ZsbSSfFWLIk1Q9j+Lxty4AHr:uVFrPNQn+WVQ3EXVUk29jgxOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105648, "uuid": "4c1c811c-f29b-40d9-ba69-54de5529c2ca", "value": 79232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105648, "uuid": "62ad1d75-a434-4965-9894-2dde1e2eb5d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105648, "uuid": "ec45b8f2-a709-44a9-9150-d6d395ba7cac", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f1c5f8-64d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781101418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101418, "uuid": "f19a4cc5-e127-4309-b100-d3703d945673", "comment": "Malware payload (Formbook)", "value": "498addabc7efd8d2adb416d996cb7459", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101418, "uuid": "d2bb09aa-d003-441f-81c4-ceef6e55cced", "comment": "Malware payload (Formbook)", "value": "c9d9fb517eaedbaa2bbded7da38371da772c628fb04b55cd8445a8a81d613f80", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101418, "uuid": "8e03a37e-ec43-4238-ac52-9f2af4e3ef76", "comment": "Malware payload (Formbook)", "value": "445d04b6463650156dfa6167e38e09cbc30c4474", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781101418, "uuid": "9515f2b2-1ef8-4825-bedd-16970860d395", "comment": "Malware payload (Formbook)", "value": "5af311e85b87d125804c8dd9d2a95bc8d3c5dde2a9346ea13355e499ae54a4ddebed5cd5e0408955bccc54be3ea263ff", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101418, "uuid": "d4f4e8d8-3488-452c-9d9b-7796435373df", "value": "T111731F50C968FD1F0FC89A2FA9465FD0DC4FE25B9273F8EBE6950B9DD080A871815A70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101418, "uuid": "7c1258d0-20bd-4090-8c67-919aa5b82f25", "value": "192:le2RiFZdumVatSRa8znWodlrey1ID331MNxriJlZpCIoylPfRctoZuJCqA1l:lQt/zRa8zWsID6YlHJf1vqAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781101418, "uuid": "3c525ab2-c34c-4ba1-99a3-c232d2dde70b", "value": 73388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781101418, "uuid": "a060b792-2a84-4ff4-ab64-b61376f156a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781101418, "uuid": "4e4cf5b6-b5c1-4f35-a615-053170262120", "value": "SWIFT USD 22.496,32 20261032254113.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80c98f10-6493-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781072010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072010, "uuid": "892b078f-97b1-4a8c-ac2d-f54eb7c70daf", "comment": "Malware payload (Gafgyt)", "value": "e5181246603af8683a0f6f18ce42aee1", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072010, "uuid": "a728f557-bbc5-4f75-8f85-d2164c7f419b", "comment": "Malware payload (Gafgyt)", "value": "ca8e0342f44a20ebdf48ff741aff4789d2b53222b7c1a825488d44fbf7c4648f", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072010, "uuid": "9b8a3e63-92c7-4ac0-89f2-a0ca83493034", "comment": "Malware payload (Gafgyt)", "value": "45dee024dfea3690541edc0f0459ef98af4db6c7", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072010, "uuid": "9c1a43c1-3e06-45d9-a823-654cd6c3c15a", "comment": "Malware payload (Gafgyt)", "value": "bcbd879fbb4cb44e31d71cc8a99fcb235639759dab1104b232f9af27eb557febaf767d8eb822874816681c587d2a27cf", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072010, "uuid": "dc874d4b-4b1a-41a9-83c5-068972936896", "value": "T16FB33A56BD018F53C2C315B3FB9F47887B1667F8D2EF3203D925AF61278A4D60926990", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072010, "uuid": "662047cc-455f-4cc5-88e4-e1da5d529cdc", "value": "1536:tFLUYuaIwW9MgwPG84b47XGF2rwGDcCa6rwO0923qVbvR0hrh9Fvo5hJppvq:tFYBT9qu+GQcGK6/U7qHro5hJppvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072010, "uuid": "209c2aae-0690-4317-8d00-2485b3e9b965", "value": 107720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072010, "uuid": "6f048b2c-74ce-4445-a583-97e78f0bd2ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072010, "uuid": "37cbfefa-83fb-4189-82d5-0e000e78258f", "value": "FBI.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "613d6269-6498-11f1-a769-42010a9c0008", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1781074105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074105, "uuid": "27879a09-bd2f-476e-84c1-e256e626f563", "comment": "Malware payload (LxBaseRAT)", "value": "2f64a570d87f5cb32a41e020c82f8293", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074105, "uuid": "fd52e4c2-36c6-4631-ab59-f1d3253f7252", "comment": "Malware payload (LxBaseRAT)", "value": "cac1b78157ccfa79eb37e556430f5f05219a3571fc4305d14c3cbfa2f377f3f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074105, "uuid": "41cb604b-5b80-42f4-ae7b-d839a040725f", "comment": "Malware payload (LxBaseRAT)", "value": "43ce936a625aa4a6fc26b1d22c575e71d5ee1997", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074105, "uuid": "7acced4d-fcca-4ff4-9915-f19b9a2823ae", "comment": "Malware payload (LxBaseRAT)", "value": "02b72d47c022069ccf14173f467c6f933d424e2000715811969024999a4557a7b3cda772ffb1d993b14a288490e5c549", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074105, "uuid": "8ef9205f-2263-4c4a-941c-57adc8f0c67c", "value": "T15465742126FE90C4F43A7E71CBD4A752AA7BFFA22125D49A940677CDC233807CD845B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074105, "uuid": "27c315ea-9fff-4d46-9c55-46c6cd4a712b", "value": "12288:PKGczyGZIx+ivfs1ZeLwM2IgsgkpPZk+6IJVRDTsWWtPKmFIHUAwGfwquyFX2aEY:Pvczy9x+s2cpfp5wA/2KJ5CYFPOf7pk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781074105, "uuid": "cea04e41-714d-4eb5-9bbb-8e33164ee659", "value": 1544704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781074105, "uuid": "fd1053a9-2704-4191-9b1b-0b89dd8ebaf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074105, "uuid": "0690c82a-16e0-449b-b37d-004e18dba6b6", "value": "Purchase Order.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55960f32-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781108875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108875, "uuid": "d1c11a00-51f2-4470-bd36-300a550550c4", "comment": "Malware payload (RemcosRAT)", "value": "be8286fae39e4b1916addd5de13dd459", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108875, "uuid": "eea11346-1067-4417-838d-ddb1427997e3", "comment": "Malware payload (RemcosRAT)", "value": "cad5261c8b2daa6af3b922a598ed9cfc3ae4b974231461e66a53d61cb135c198", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108875, "uuid": "cc66c67c-ee0d-491d-bdc4-ba7de202e1c3", "comment": "Malware payload (RemcosRAT)", "value": "e4c67c5e5b162b88b6c0f66e42210b26d391bd68", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108875, "uuid": "066c60e5-90d9-4113-802d-79540177bf5c", "comment": "Malware payload (RemcosRAT)", "value": "a47b67513f7a82c8ec49c23c08ccf27db215be37c4f09c69c3ec777d900254e68afaee4c8331f00188b948af90c8a98a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108875, "uuid": "e7381b17-2a05-4999-9171-76e4fe16e29a", "value": "T1D6F6F03D58F38B06C6F215289CA9C81A2F95B8335A3869F914FDF4F4C5D1D064EB8A63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108875, "uuid": "92732299-45a5-4119-b1b4-b313df076f8d", "value": "1536:fDP8x2CuCNB+Vd6vvye6p8TKNNya5DbQzpfliZMFL0OdlHAyRpC/jVf4voHUET2Z:OlpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108875, "uuid": "24013082-cee3-4d3a-881f-b74588a5e325", "value": 15846850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108875, "uuid": "0d3c2b90-5383-41c4-aaaa-24c58c8de30b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108875, "uuid": "d4b6a628-4ed9-487c-bbf2-c459f71e7ae0", "value": "task.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c612b3-64ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781082595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082595, "uuid": "5032e46b-59b2-42db-a253-0432a1da75d9", "comment": "Malware payload", "value": "a9703f8c6cc07063265dbfe12b323c06", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082595, "uuid": "2ef852b4-a507-45bf-8209-4e47be48561f", "comment": "Malware payload", "value": "cae8a07ea351d73ee3fb4d649d38eed3d752e1e122b9537e5bfb28b0f5aba3c5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082595, "uuid": "df732172-9521-42f0-8011-76d424a27ee9", "comment": "Malware payload", "value": "e35333d7b717adb4224f16fa0318719f79b8de06", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082595, "uuid": "3bbcde98-60ae-4927-8a41-49d185585b10", "comment": "Malware payload", "value": "7a7cf57b396beaa6c53a4bd70b74f6af6e7c2d5365b398b9c7d073d73ed61d92ca0d30bd6c62d20bda6055632858f4f5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082595, "uuid": "915aa22a-16ad-4fad-b55f-67bee4369ef2", "value": "T17BF44A6B527AA4D4EC4732787B8A3BF7EE40B47763B5E4A9AA42513488F3374513021F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082595, "uuid": "ed84c151-75da-4d01-94a0-4964e9fda134", "value": "12288:bUoLDfDCf5ATJthqgQZcotxO4yDZQYLEeulVkc/Z1uP:bUoLvCKTC41IVkcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781082595, "uuid": "2314103b-2529-4586-986e-5cb5f7dc8035", "value": 723072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781082595, "uuid": "382d4604-968c-497b-ae35-9d9be04cdd8a", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082595, "uuid": "4b67c7a2-2abd-4ff2-af80-24bce101356b", "value": "update", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb41a03-64c3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1781092725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781092725, "uuid": "2ca8c516-d3f8-4cbc-b04f-b2e0f5fbe09e", "comment": "Malware payload (Gh0stRAT)", "value": "69c3e0d327a88342012386f0833dda64", "object_relation": "md5", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781092725, "uuid": "33625cbd-d032-4776-8087-9419edc228d6", "comment": "Malware payload (Gh0stRAT)", "value": "cb138982d5e7ea3917370d11adce32311761fd431d10a5c2cbd24f8b6c76cdba", "object_relation": "sha256", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781092725, "uuid": "86909ae7-d7dc-4185-af87-7709d896c923", "comment": "Malware payload (Gh0stRAT)", "value": "f466eb0a8f8388a59fdd38c981fd8d9f0640d319", "object_relation": "sha1", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781092725, "uuid": "8db6c397-5324-4797-b430-a6a57f22931f", "comment": "Malware payload (Gh0stRAT)", "value": "a264e3a414d26dc81ceef7d966d5173e273225e39f1bce5f908801e491f7bbf5f61d78555365751012bbf77937f1ad4f", "object_relation": "sha3-384", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781092725, "uuid": "24b22909-f77c-4d1d-ae58-4bbe4373e3be", "value": "T17FE63311D2D850F4D1B30A3605D6EA6A09F9B8239B781D29F322C7C557ADAC17A06FF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781092725, "uuid": "07c622a0-596e-46a5-8634-ed12b990f1d1", "value": "49091c5c46d1ed156931ed11f43d3afa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781092725, "uuid": "f27c4154-75f6-47a4-beb9-5636aa4d3099", "value": "393216:rBHzZn1FQ8yazg5Y86eRgKwRGc0Cqd/aC5tsXw11k3:rBHzZ1FQ8yugm86ggC4qdCStGwHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781092725, "uuid": "02e0372b-6ccb-4f30-beef-3e996b3a2177", "value": 14114809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781092725, "uuid": "d24a04e8-2b0d-415d-bf5f-1ca5f6f59f7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781092725, "uuid": "836eee2f-6a8f-44c9-b41c-de269b127e46", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f68af9b-6503-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781120139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781120139, "uuid": "f906796d-293d-46dd-8d26-e50d4696ba1b", "comment": "Malware payload (ConnectWise)", "value": "5150e0a34537644776b19f413d6ed606", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781120139, "uuid": "8ad4388c-bb60-4f6c-b019-4dabe3f0191e", "comment": "Malware payload (ConnectWise)", "value": "cb3b100dc4d0c8e4d6ad3bd584f1dd9f23644896d18844f44512cc1fe21c3945", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781120139, "uuid": "bd89e053-6b65-4c5f-8cd5-fc23b471e659", "comment": "Malware payload (ConnectWise)", "value": "6cf1ba56f2cfe865591c2b2acaca0d127a4c47ff", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781120139, "uuid": "f8cb80d5-94af-4b76-b372-53428a1e9573", "comment": "Malware payload (ConnectWise)", "value": "a3467baf4efacd949160369a6b7235b324b3a368abd56978e40bfed07be56078292339500353c0986fe75f9d285a124f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781120139, "uuid": "e559b8bc-f08e-4a21-bc13-aa39a1d676eb", "value": "T16C646C11B9C48432C673383107B4E2B28DBDB8302D655B8F57A81D7A9F745D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781120139, "uuid": "5a138bbe-a2dd-426b-9975-a87a6247f357", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781120139, "uuid": "299e1bb0-b701-44ae-8d30-1b9f4aabcf66", "value": "6144:1mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:A1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781120139, "uuid": "c2ed93cc-9c3c-4765-b76e-2a02c15a27d9", "value": 312576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781120139, "uuid": "0ae3b53a-6493-4f48-b6b3-3eda456bf5ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781120139, "uuid": "398e9968-e4df-4264-a6e7-1de9f55ce7dd", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7c3078-64d1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781098442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781098442, "uuid": "e2dd0fb0-1c3e-4c96-8d12-78577138ee19", "comment": "Malware payload", "value": "8dea128c9f3dc6730c1984d89b2278fd", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781098442, "uuid": "6eb77305-1461-4add-b6dc-a9accfb8b2cf", "comment": "Malware payload", "value": "cb50d3a74dfe38aa84e0064e3782f5a60aa9e626584e9a4b576558b84ae3d40b", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781098442, "uuid": "380d73dc-bc5a-4c0c-a5ff-52d08abddef9", "comment": "Malware payload", "value": "83aa46a495c7d8ce99b5754a04d2f7d4de9fa8d0", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781098442, "uuid": "798a85ee-9560-49ba-bb0e-d3b72707e00c", "comment": "Malware payload", "value": "339236b81063106ded2e507e5c07669f1886b0b2fa2ca48e6b3dfd7ce0a110816255fd750c57848275074cf3e4318025", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781098442, "uuid": "dc7322e0-429e-40df-ad75-86ebee52d8f1", "value": "T150F07EB039229BA1F3F218F6C12E876982E434D4BF41290831263A330DF22728995E03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781098442, "uuid": "99fb2e3c-8061-4c23-a407-98203939d60b", "value": "12:Gi52ExvJpIGMQo81dY3qNnj73XCwhpvh5i66I1qPo5zKdwY:V52YIGMEdLNHXnP6wtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781098442, "uuid": "907da61d-f58a-4b9a-bfee-ddcb1a548681", "value": 546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781098442, "uuid": "69080b91-a47e-4f95-a1a1-ac1ee9598206", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781098442, "uuid": "0c2463f9-0c82-40ed-bf16-b76758785b80", "value": "sap_vigilante_guardarcomo.vbs.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a415c85-6466-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781052726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781052726, "uuid": "f589b47e-260a-4b8f-b537-4cfc3942039f", "comment": "Malware payload (Mirai)", "value": "97ddded8b22499011a893ee55ec0b88e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781052726, "uuid": "d2a564ce-3c2a-426b-ae7c-4ad9ed19dd04", "comment": "Malware payload (Mirai)", "value": "cb7a2df07ac71b6a10b36011b4ecaddf3d2870a670a22c07223d4d675c823f72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781052726, "uuid": "a0fa7bee-fe8c-4730-a0e8-7786a3b20560", "comment": "Malware payload (Mirai)", "value": "825e94e98a932b20cc9ae785f9b9aee4dcd1639d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781052726, "uuid": "122eedee-58ca-4177-9b9a-b71a7677c2d2", "comment": "Malware payload (Mirai)", "value": "12391c6e8ad4eeed5e7ec491233192fc953265985b03125c1e1d1ed91269246bfe5d5b18b18c1e859e4304d2241a69bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781052726, "uuid": "8412722c-bbfc-4a82-99d7-0fe446a06680", "value": "T106D3F845F8919F57CAC152BBFF4E4388372A17A8D2EE7203D9156B24378B95B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781052726, "uuid": "a03c2e3e-afac-4613-9a43-91af6ef27631", "value": "3072:4J1SPMkxW54zCYrTCawmtahmKTVQ4ET0Hx3bGt2AK:4JsPMcW54zCuCawmc0ay4EwHx3CgA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781052726, "uuid": "d4f2a341-685c-46b7-854b-cb2cdfe4e52a", "value": 139340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781052726, "uuid": "d1da1b21-b8d6-49f3-8296-881ca567e3b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781052726, "uuid": "5bd0d704-1b6e-40ec-86e1-769873eb7eee", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84942a8c-6493-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781072017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072017, "uuid": "de703cb6-7ed3-471d-9dc2-01e73f9f2fd3", "comment": "Malware payload (Gafgyt)", "value": "c72144cbde4f4fa3ba88145d9b39b54a", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072017, "uuid": "d71c4208-9e44-4f83-8de9-32acf34d88c4", "comment": "Malware payload (Gafgyt)", "value": "cc0dc5102a70c42739689511a13e60a7bcd24ec4a5f8d49f2631581c7e27e02f", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072017, "uuid": "5f17a794-6e26-4a20-a440-ce8ceca84cd0", "comment": "Malware payload (Gafgyt)", "value": "c40d25977255af0552e30518c7bc0997b22d1864", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072017, "uuid": "53fa697b-7379-4925-b136-0d613adb1c6d", "comment": "Malware payload (Gafgyt)", "value": "301475c547ff7bac022f9e2c50d3510586b5262f7a78f15c6c402baccfc9b791eb0d437ba8eb68402bbc8a595075b442", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072017, "uuid": "791d67f9-6c7f-4550-921c-ee1921ea2e9a", "value": "T131E3871E7E21DF7EF559823047B38E30969836E636E18585F26CE6481E7138E241FBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072017, "uuid": "bc6b1a12-23ff-4905-a89e-cfe933efeb34", "value": "3072:B7ip4E6s1gSpuIgQiRxaQkCEAweIcqs8Ek32o4KqKf5hspYt:B7iV6s1gSpuIgQiRxaJOCZHBb7qi5h3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072017, "uuid": "cc57ea46-47fc-4620-a093-b305abeab23e", "value": 148064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072017, "uuid": "10e33554-e098-4020-8f13-f108117e2199", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072017, "uuid": "afd4d8a8-0655-4f0a-8ca4-2d00b2fa257c", "value": "FBI.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88504b2e-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105524, "uuid": "5f33a1e5-17b0-4453-bb2f-26c6f29987fe", "comment": "Malware payload (Mirai)", "value": "8a2fb5f190196c796c45eef18c9a39ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105524, "uuid": "f34882f0-165f-4bfd-994d-4ef49172f210", "comment": "Malware payload (Mirai)", "value": "cc60ba7d2564844a25558b27d9a26dc6724f5c89191514867bd99706b99be17d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105524, "uuid": "27b74474-a82d-4fe2-9e56-59d6069c5984", "comment": "Malware payload (Mirai)", "value": "83be39eef583a6dc60cc5189ae29e4377fd6f33a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105524, "uuid": "80e55068-4bd2-4a30-9ac4-61c925cf1589", "comment": "Malware payload (Mirai)", "value": "50159b6504220e2dc643707e6f5ad66f0a37a72274987caf4c904a20a69125c3784206165142b7f700dc4ae1e3093680", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105524, "uuid": "80aaeffa-752f-4a2f-8c42-f3b3913721b4", "value": "T1B663A44E6E719FBCFBAC863447B75F209248339666E1C684E15CEA011E7030E745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105524, "uuid": "edd491a1-c8a2-4243-a37e-87b8a1e3134e", "value": "1536:K85WSyKTetjtK3stWHpu0213RhLL1SJsZ1p3:hvhQJK3/4027hLL1SJIj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105524, "uuid": "053b7695-dd39-4dcb-915f-c1edfb6f06ba", "value": 68368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105524, "uuid": "0591a056-b2fb-4515-b916-327652a2a91e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105524, "uuid": "2bb69380-e7b0-4766-930d-f0e202590054", "value": "miraint.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f460e89-64a5-11f1-a769-42010a9c0008", "comment": "Malware payload (PhoenixStealer)", "timestamp": 1781079578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079578, "uuid": "e6d6a2a6-46c7-401d-8932-04fa3d8aeca5", "comment": "Malware payload (PhoenixStealer)", "value": "e99a613a831e8bfc91d0a29a17694da6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079578, "uuid": "e199d58c-e3c8-4a99-aa47-74c1de788ae2", "comment": "Malware payload (PhoenixStealer)", "value": "cc7c63019c4992e260ad50c5c2de278550560c6c75a76ed769ce0bae611f70d8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079578, "uuid": "eb9c276a-1870-4652-bd2d-c49f7d9b8fe0", "comment": "Malware payload (PhoenixStealer)", "value": "4db3326cfdef2bb16e8869a96aa01ad42b4d7211", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079578, "uuid": "68b82423-3b19-44ca-b63a-314d2c0e0be6", "comment": "Malware payload (PhoenixStealer)", "value": "c06bafd1f3ee3e5b9780b68e2825c80037caf25999cedc380a1a2abbb6c33845cb9c679a5ebbf14578023b8abc46c8fd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079578, "uuid": "b13c6745-f319-4fda-bf35-1f0ee2d2436a", "value": "T1FD05F63DCC18012EF136C91AC49A095FF8A2158B623CE94760C67B4BAE63593B7D739D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079578, "uuid": "c4ad6a68-f068-4a21-b01b-5b4a6180c98e", "value": "3072:5N5BnyoCq8JqXW/Db3lKg8EZXYWfh6M5t9AachWoHY/U5tzXCyaOHlSCAiuION+5:FBnyAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079578, "uuid": "4f275ab1-3969-4cc2-bbe7-ef69ca48f068", "value": 814804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079578, "uuid": "4130a861-8770-4b2e-9067-03b33a12e3ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079578, "uuid": "fb765f69-528a-4862-b559-3afa8f2c2d0f", "value": "ET23100053815_20260514034458.XLS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3552666-64dd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781103851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103851, "uuid": "fe758f88-6ad5-49b7-b703-e79809b75117", "comment": "Malware payload (Mirai)", "value": "857fa4a86c13f26db38514bb5a24dcf0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103851, "uuid": "946cb24c-4f18-403f-b5a2-f7f8f69abd3c", "comment": "Malware payload (Mirai)", "value": "ccd16612d9b915699c3e9c6c0f5f25e0e89b66277c28cdb42c785e21476096e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103851, "uuid": "c24b596d-202b-497a-ae59-ee85a6b52077", "comment": "Malware payload (Mirai)", "value": "21aff5b8de9ade7f64568cf818a10f6a37ecb8b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103851, "uuid": "67ae676d-cc41-450b-8650-16d97e00137f", "comment": "Malware payload (Mirai)", "value": "c8705ed28377abff0e68a2b686459e0c57d161990957275e8261797fa7c6df8a6e02e238e545018a083ae94d24cbb0ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781103851, "uuid": "18195e74-59b5-4ada-a0b2-8ff870a5f933", "value": "T1D8C31905B30C0943D1A33EF43A3F2BD1A7EFAAC121A4E640355FAA8991B2D375946DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781103851, "uuid": "c45d5ae7-b152-4c09-b565-c87e1e2983aa", "value": "1536:R8HfDR1EJnD/vxSOVD5GGmMWkKo2cwDWlkvAtLYSxMfIqcsKPpP6WWXA+07:O/DPiDnxLfKo2PDWDtNdf+07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781103851, "uuid": "9980d119-b4ad-4f66-8a6a-9722a04eec9f", "value": 119192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781103851, "uuid": "08d4e41c-f02e-4a36-a5e7-79d7547dba45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781103851, "uuid": "9423efe0-16ed-4fb9-b475-14702a6da408", "value": "CRY.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b005cda-6466-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781052727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781052727, "uuid": "4ed3163c-99fb-4401-af26-8f0f497d6bd9", "comment": "Malware payload (Mirai)", "value": "a1c4d416ea2d3cd80661b0f874aaaa85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781052727, "uuid": "1f7a7a3f-50a2-4735-89bd-3ea513a16b3e", "comment": "Malware payload (Mirai)", "value": "ccdc75ba6410ae85f38a9a6e86c534ac1081cfcf5a91524570e709f695f65fc0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781052727, "uuid": "1eaadf7c-cf47-4f87-9cd5-558429fb579c", "comment": "Malware payload (Mirai)", "value": "af29fad64f10cbbed56ae1103d829261716acbaa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781052727, "uuid": "d07c3f6a-739d-42c8-a78e-9f443a535515", "comment": "Malware payload (Mirai)", "value": "8ae67c841fc00c7c7f94e34d7fe14d2f02fa222a0097492a9dbd05c0ac3b3665c99deb1cb4811cceebd82b893aa72ffd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781052727, "uuid": "8c0cfb78-6c18-44e3-bf17-c65cf6cb52ff", "value": "T116E34A0774D080BDC8D9C6B48FEEE12ADE73F45E5138B11A27C46F262E5AE206F6D650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781052727, "uuid": "8a1083d2-9db6-4538-bfa2-4b06fc068412", "value": "3072:BKZ8N9Hj9hHdCrhszbUiX4dGYgAr1MVbbeGBTnJyA7x/sL:8Z8rbHIrhZVZ/qdwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781052727, "uuid": "dd8193c6-9368-495e-857a-e78d571daa6e", "value": 146104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781052727, "uuid": "ee4560fd-c012-486b-8ffa-5e56190197c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781052727, "uuid": "06fa8f00-073b-4b25-8c89-18a9a6e508db", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1859ab12-64cb-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781095887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781095887, "uuid": "510a9d13-c4ef-44ad-9799-73e6bca3da74", "comment": "Malware payload (RemcosRAT)", "value": "5d6005c8f3920a5f277a5165f4b87b24", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781095887, "uuid": "fb01e134-de90-4318-bdf9-eecdae7c6c84", "comment": "Malware payload (RemcosRAT)", "value": "ccedd40cf1b73dc7baa155b144a6619a0078c5c0bd4ad86e703c08b7a9762d17", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781095887, "uuid": "69db40e4-a060-4704-8c3b-20a5acb6fac7", "comment": "Malware payload (RemcosRAT)", "value": "fa0aaf196ea1dae564270a641b1ec3cbd0f69462", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781095887, "uuid": "81f3491a-bfeb-46c6-b9e4-21f1d4a70403", "comment": "Malware payload (RemcosRAT)", "value": "d02d1a693912010386b3bc690b9dc9b383642d65c7bd2851cac76841060571c5194ec8563a20ae7686cf452c50041e22", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781095887, "uuid": "c8b3e0b8-3870-4df7-be26-cd413b5ec8d5", "value": "T1B7746C5AF9F9058E3C5F219CD72D5929C6B24D061303A139B80E78E294CBB9EE7B1731", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781095887, "uuid": "ae982be7-c310-45a1-8279-0746bc5a2c7b", "value": "768:caOyjaOyjaOyjaOyjaOyjaOyjaOyjaOyjaOyjaOyjaOyjaOyjaOyjaOyjaOyjaOE:FfPhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781095887, "uuid": "d71e95c9-091b-4084-b116-87f9dce4bcf7", "value": 362456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781095887, "uuid": "452747f5-5988-40ad-8dee-0bc82970b6df", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781095887, "uuid": "b6c82845-f139-474f-b4ec-fb0850a90a5d", "value": "becomeperfecthistimeforbestproperthings.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d71221e0-6491-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781071296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071296, "uuid": "93d0c003-ef2e-4058-9eaa-14df96fd2efc", "comment": "Malware payload (Vidar)", "value": "5254680d2774ba495b57c9b3311cee9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071296, "uuid": "029771c6-5f8d-4e91-8fdb-0e355f95cb60", "comment": "Malware payload (Vidar)", "value": "ccef44fa24e122fbc0e810617b7e372b2a18ebeb07399e2b604e9e2b12765c0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071296, "uuid": "f9986a62-8f1b-4953-a85b-c2834000d0ee", "comment": "Malware payload (Vidar)", "value": "4e447b0d823446ac47056e524bd71a09a2b82f90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071296, "uuid": "9f9cab87-2c13-49cd-8cd3-3dad71047392", "comment": "Malware payload (Vidar)", "value": "8be8c1e956c2ce18452da1e7c82d7d543d885b6cbe7f0adc602a22c362d91625a5c5ab4e9195a4d3553181ca4484e664", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071296, "uuid": "e0d561f5-47f3-4a57-9684-5c2722c72c66", "value": "T1A542D8CA719BA2FCC4ECC238D56A05B7DB3930C6061A5DBF13ECD5A457C3601AAB8749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071296, "uuid": "4b7a226f-b121-4592-a7ea-b89b97ab5d43", "value": "17a4bd9c95f2898add97f309fc6f9bcd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071296, "uuid": "375d6393-7cb0-4f57-8e0e-19e23d609c38", "value": "192:uf4oGWEiQMbI1iTbtHz386c5w+ZWPN/h+t/gVg8DTLgqdyOKJdgdsT:ufx1Esjbdz3Hqpw/x7cqUBJdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781071296, "uuid": "c408bae1-2acb-4774-a856-6be1a3cc8298", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781071296, "uuid": "f3cd56b4-67da-4557-842b-56d581f019c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071296, "uuid": "6538cfd8-61dd-46ee-bed9-c837a261fec2", "value": "install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b13bd4-64a4-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781079392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079392, "uuid": "192dbff1-aa77-4062-8a28-9eeb5051b003", "comment": "Malware payload (AgentTesla)", "value": "d466cd3af18472c11eae5bfc9177d9ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079392, "uuid": "8c6fde90-d5b5-4a07-bc9a-189e1879ef7f", "comment": "Malware payload (AgentTesla)", "value": "ccf784ddb0876fc1cbb596ce28ca97845d06e2688b783178674c3c9c27a0d6ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079392, "uuid": "7db1ee73-7fb7-4754-9a4b-bd6076f0fae0", "comment": "Malware payload (AgentTesla)", "value": "11dfe6db086565cd987d84ac9e4ca34f68ccdb2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079392, "uuid": "7e7a9fc2-334c-4a4b-b2b8-ff3db71046b7", "comment": "Malware payload (AgentTesla)", "value": "a3de1b6f2173e9179967d6732aa39e94152209d08077e290f5364dc0ed25e07a5d2bfecb9b2ec22b777fe75a7d9d922d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079392, "uuid": "25c8fee1-8954-4de0-a637-b5c031e97451", "value": "T1717653700358D671C2589EE62AA97158240D4DCE99F9FB027A5F87F1037A932E3BB770", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079392, "uuid": "59424138-8251-4840-bdde-ff8961874012", "value": "98304:ueTC1viD5aC4ofk/uZpDl6TdNXNOcLlpCw5GyZ7RZvphEnQ/xKeCpqLVkjZMY0/i:ICZCdNDLlVGyVRjh0Q/EfpYkjZM1tq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079392, "uuid": "2faae273-8f81-4a23-8a0a-fbb9239faa25", "value": 7197030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079392, "uuid": "f44eaebe-2c68-4de3-99a6-42deac0d0805", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079392, "uuid": "286597b5-42dd-491b-8545-2829b02fe177", "value": "Purchase Order.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e85fca23-6476-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781059729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059729, "uuid": "796306ea-44f4-423e-8332-6e21e40f2697", "comment": "Malware payload", "value": "40696b5eebc07a24eaae18d9d0372034", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059729, "uuid": "181470cd-18aa-4abe-8f60-b0dfb84dc2bd", "comment": "Malware payload", "value": "cd634aa31cc9fb173fdc86229b35c1c2b555f1e07966992137c24dacb82d7906", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059729, "uuid": "598aa9e6-94b8-4b6b-a469-e64767134e62", "comment": "Malware payload", "value": "f53aed7e37ca01cff2fd203767e81e48535dbb35", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059729, "uuid": "e60341cc-9be6-4bf6-a33b-899998323316", "comment": "Malware payload", "value": "d4b8be5fa1e3a353ab2781eb0a15e2550be02f66723384e324198cedb19ff71705c063965599f348e34dc3fb3d059a1e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059729, "uuid": "e40dde9b-1a3d-439d-becc-a014bd60edbe", "value": "T145F6123BA18BA13EE46A1636F6729270443BEE21A5124C0796E4FC4DFB35070DD3E697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059729, "uuid": "afb1dc52-27c6-423a-a05a-b1a24fe44e44", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059729, "uuid": "8873677d-26d5-4c26-8aac-a214a7c63ff4", "value": "98304:U5/OyEj+GBmvQd2cT2W7zKJLZoF2DBjwPkUDiYPMMQI4v64ZAsvcbyVVEIkWqG:wWl6GBkQd2cBOnoESpPXQv6QAED1kTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781059729, "uuid": "d097e825-ac52-41a5-a463-7d69a728f135", "value": 16346325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781059729, "uuid": "0d830ffa-6a15-4bf7-be64-8196b39ccad0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059729, "uuid": "499daf6e-af08-48c8-b30c-b98a865027a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d2deb64-6476-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781059576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059576, "uuid": "17f34b5f-8eb0-4874-8543-9c60e05ee084", "comment": "Malware payload (Mirai)", "value": "bae60e851f3990d72b967fc2b851cac3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059576, "uuid": "bf45606f-3937-4d92-8ba8-6c730cfef07f", "comment": "Malware payload (Mirai)", "value": "cdac248ee281e88c0f8efd596b53fd40c16420259654c70da4f88568030183cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059576, "uuid": "bcd9b01f-5939-4482-9108-413169610f57", "comment": "Malware payload (Mirai)", "value": "08273529e5dc91dff0856d124c42a9db63b23167", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059576, "uuid": "1bfdb566-78c1-44c0-8f3a-8aee554828ff", "comment": "Malware payload (Mirai)", "value": "ef0fd035355901c6c81fdf991ab41560f679f2cc089b237dddf9e3ec9bd2fef4a385582fa100a93d2702bf91a6dfe744", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059576, "uuid": "116551e2-73e7-40ea-86e6-24c64f9cd4fa", "value": "T11F359D2AB2B2B6BCD057C03047DBC6A15532F0755A323D7F26C4CB353EA6DA51369B22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059576, "uuid": "c2ab3a0f-d2ee-4f7e-8612-a314080b4b59", "value": "24576:nQF+YN1NgqDCRN0xrb4+rkIVB8NLoNWMiG:nQEYN1NgRvErEskITmLoQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781059576, "uuid": "a459931c-20ad-400a-abd0-b7915ea64a25", "value": 1129400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781059576, "uuid": "7d131d54-e3ea-445c-9961-b8caf05c97a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059576, "uuid": "baeeaa1b-7335-4a58-8cdb-af926c0fac3b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e13270-64b0-11f1-a769-42010a9c0008", "comment": "Malware payload (Adware.Generic)", "timestamp": 1781084531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084531, "uuid": "fe8f32fd-972a-45e3-ab09-881d19dea341", "comment": "Malware payload (Adware.Generic)", "value": "745fcd9f3ac7595ab2499eb4e3f0d3c1", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084531, "uuid": "325dd1fa-31c9-42b0-a9a7-638e22dbca58", "comment": "Malware payload (Adware.Generic)", "value": "cde5da77e3bfbc70a898405932ab38eb4a65fca6f224e4c2c8c8ea423bbaae79", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084531, "uuid": "9383f155-759e-4adc-bdca-ffc95e5c4251", "comment": "Malware payload (Adware.Generic)", "value": "6f2eab8d5529e0e4267914b21af3bd1303655c74", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084531, "uuid": "8f8c162d-e21e-45d5-a8af-986fc60e2b27", "comment": "Malware payload (Adware.Generic)", "value": "5a856311958b870b54a873523836ecdd56bde75476189846c854b148cce3a23510c63df666ac77aa2f6aff4808d1aecd", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084531, "uuid": "e0bbf569-64ae-4fd4-bccd-f085ce417826", "value": "T1FA85CF3FB268653EC56E0B3146B3D360997BBB61B81B8C1E47F4080EDF664601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084531, "uuid": "8ac01b6e-667f-4c8e-b766-c4b2b67c7d2d", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084531, "uuid": "e410e161-c753-414e-9211-6ec3a9008db3", "value": "24576:V7FUDowAyrTVE3U5FO7TXc0cs+KPnGlc97hI8X6wHBkzNJaezHF72JOkvkNV:VBuZrEUuTM0cs+/lq7Sq6g6zSezlS/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781084531, "uuid": "51eca1ba-fc85-4877-a124-313837c0d030", "value": 1863448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781084531, "uuid": "c1a46253-c1cc-4fac-8293-682e507c14ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084531, "uuid": "352223ec-eca9-4e99-9a93-1345bbb26879", "value": "SecuriteInfo.com.FileRepMalware.71422576", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85434b36-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105519, "uuid": "90a00918-caf3-4e7c-8126-4d8ad371c401", "comment": "Malware payload (Mirai)", "value": "1299ead3e94298914af17a3e6be67954", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105519, "uuid": "7afeab4c-2c2f-4131-90fe-448efcf71261", "comment": "Malware payload (Mirai)", "value": "ce1943b472d597257a1221af46e66acee530cba99a68ad54d9c55a9a9a0980ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105519, "uuid": "f26c7d40-46f0-45c0-933e-e69634518a43", "comment": "Malware payload (Mirai)", "value": "2733b48ec56649fe7daf3df4147abf332a3a26c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105519, "uuid": "f21b8b6b-4a4e-40bf-8165-0e6a25f152c2", "comment": "Malware payload (Mirai)", "value": "428f0bc70f5322e1a4f808e9c9ddc5fcece7721bc5d31f9180da337d36bec2e216de9d1ef0d9e26947f72a6f1f23cca0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105519, "uuid": "3fc081c3-4ae4-4a8f-926c-d73207050482", "value": "T1BC238D67C429ADC4D2598278BD244A386F13E501A6933EF6B74785638043FECF91A3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105519, "uuid": "10abc9d1-1cbf-4300-8c4e-f25c992944d4", "value": "768:DVaj/jibOvjyt5AsyrwtgiP8G0rqJrKIf3sp58/9z+avCuolGm/CtDE:DVaj/cOmXEwtgZrWKOsp52J5vC5/Ct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105519, "uuid": "78113ea1-5377-4cdc-a536-a960932c2284", "value": 47640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105519, "uuid": "1507edaf-ba9c-480d-8b13-4b65cab45d98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105519, "uuid": "372fb554-a8c6-4d2d-b6d5-a8a8b9d2e14c", "value": "miraint.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc6ec54-6470-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781057057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057057, "uuid": "b132e61c-dfea-4dac-88a0-d01b2d58943d", "comment": "Malware payload", "value": "566ab93542fe69e60226f06f1633364c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057057, "uuid": "273c9e08-1720-4cde-90b3-9cf6e8a53515", "comment": "Malware payload", "value": "ce2e86e93608892ef2f30a844c4bacee3e11b1898c958cc10c82b6dcd3ad412b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057057, "uuid": "46fb9879-4acf-41e5-af26-18488e773016", "comment": "Malware payload", "value": "4fa24b276f3afe4e158a1a73193e23e755adba45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057057, "uuid": "bdc5fc1f-38d9-4df9-a39d-14c8f1d6d508", "comment": "Malware payload", "value": "9fa27b29dfd838dd6be9c4293c11841a375ec8248defcf8a0cc9101a4e4d5c9f8d679e7f516c8c2cbac5a79bece0054c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781057057, "uuid": "fb76b495-2b13-4c0a-bceb-82f0fa903ba6", "value": "T17514774A6E328F6EF668C73047B74A24E76D23D627E1D684E1ACC1141F2435E641FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781057057, "uuid": "8e0ae051-a18e-4cfb-aec9-e2bc7590ec4a", "value": "3072:W1hb647cRdh4OJGTIaMD5BysXSVdhO99oi2+rMWkaeOPUSsN:ghbeLN5KJKjrGtOMS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781057057, "uuid": "cad0ae9a-8f7a-4523-928e-43ecdb140b99", "value": 197856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781057057, "uuid": "deed53b5-9a2a-4f1c-8be6-fe6de3d4cb71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781057057, "uuid": "e2b912f1-88b3-469b-86c7-503336fc8d0e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53aa28e0-648f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781070217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781070217, "uuid": "d50ed1fb-6816-4642-b1a8-5b8b59ea905f", "comment": "Malware payload", "value": "542f399af129c5a74fdbc34a1d6e4d66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781070217, "uuid": "0720308a-8839-410a-a130-c1cc080edc40", "comment": "Malware payload", "value": "ce8a4b9b4439d1c8ae61519f02a6a1b940e658eeccbf82c4a0af598842c26db0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781070217, "uuid": "8a514e82-1787-4cb1-aa2f-6434c470938b", "comment": "Malware payload", "value": "f709438a3adb1319ebece03c7277976a09c2d7fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781070217, "uuid": "0ab5722e-a097-40b3-9df5-189cf9ec8ec6", "comment": "Malware payload", "value": "b9e62be10d91f49e418efc0181be206f7e01ef5ea88430ea50873a167dc2fd6a30e3eb57915090270ac3944fca354c84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781070217, "uuid": "67688ee5-305f-4ab5-abb8-33943f46f97c", "value": "T13D762947B8914952C4E43A37BCBE81C433631EBA9BC7165B6D05EE383EBE1990E39744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781070217, "uuid": "d5a49eb1-8fac-4f27-bb61-1e9653deb27b", "value": "49152:vh0mHVOhph/uyQ7o09vFvL8xou5MjgPiUFs/0Eq8Q6/yT5Eh:J0nph/uyQ7o09vFvsiUFsMEwEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781070217, "uuid": "68c97c6d-b771-42b7-8520-cfa65f769eb4", "value": 7405752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781070217, "uuid": "7a98ce64-7f8a-41c5-9432-dbe985d89f63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781070217, "uuid": "bc3b89ab-1707-4ed7-98fe-bd715f2a5f70", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0f50da-64cc-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1781096455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096455, "uuid": "cfa41c0b-a64c-4a5b-bfc1-c9710d0aa8a6", "comment": "Malware payload (BlackMatter)", "value": "b6b800dfb753bd97bac211420f8c12a9", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096455, "uuid": "87f534d9-e2c8-480d-9a34-ea387b932c9a", "comment": "Malware payload (BlackMatter)", "value": "ceed9b497256fd017f5073edd0bdcb9b1923b633ae5f9fdd95b46c634ebd747e", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096455, "uuid": "f7796a56-9b0b-4f79-86e9-f3e2c5486b38", "comment": "Malware payload (BlackMatter)", "value": "f10bd5a218d2dff778e9ce1a2c510da9b6f5acf8", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096455, "uuid": "ba47faa4-fd20-4726-8e8f-43b569bf80a1", "comment": "Malware payload (BlackMatter)", "value": "bc78eb19b29f579bccb2c311fd643a447fa0f2a30c3315fc5414645a64020b05e84282567c3fec9d16c06a7942217cbf", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096455, "uuid": "e6fbfb24-8ae1-4af3-9d3d-37f602e50500", "value": "T1C1E37E21F212D073C87718F12736B5B2F39E4E2C19A56857EAD80F99BCA48236F14997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096455, "uuid": "f7cdb974-fb6e-46fd-9786-3fa367206ffe", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096455, "uuid": "ea327b87-df1e-4888-9eb0-6172a86fce57", "value": "3072:I6glyuxE4GsUPnliByocWep/+I2Tqwr9B:I6gDBGpvEByocWe8I2Tqwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096455, "uuid": "7e696e8c-8bfb-4219-9b82-c62b61456b8c", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096455, "uuid": "4291cf64-aa94-411a-8827-42e4c64016ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096455, "uuid": "93f67c65-4dfd-4259-96b3-839212047b5a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b8dd50-64d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781099931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099931, "uuid": "00ea82ee-c3ec-4839-967a-5861939f4ebc", "comment": "Malware payload", "value": "649c1b1d793d94703903d2fbde9f9ae0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099931, "uuid": "ef262d89-7311-412e-81b2-1d82838de912", "comment": "Malware payload", "value": "cf00ec5f2c68c86558bd874e252b80f287bb20e4a3ec96b3fbcaf96fb743074f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099931, "uuid": "9ae0c97a-1839-42b5-9901-6196135e1521", "comment": "Malware payload", "value": "c0fd30fa47ab3a95c04c3671dcde1b88100e14a8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099931, "uuid": "75066933-3c47-4e71-986a-a17fe1fb0d9f", "comment": "Malware payload", "value": "442012f4e261c03ce02f2cc26ba294703b525454eb2c22114fd830d525b0323ea35cf777e957b549b62f925eb65742c8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099931, "uuid": "9d7a27c4-eb51-4fd9-980d-b71a2a7ee025", "value": "T14D016FDDC002EB604195E8AD32975290B820C3CB1A464BB87FDD043D9B69B58F055F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099931, "uuid": "5d096242-4599-45b3-843e-6c44ec86a295", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaFXIaNWmUFISYhvIpo0zEIucIOeV1auD:kXCKysE2hi0ziQvZohaFXnoFhC11EgT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781099931, "uuid": "8f3e1c69-e69b-4e56-b6bb-f32415bab370", "value": 834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781099931, "uuid": "df2156cb-71af-4c59-8d87-0755a1f52eb4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099931, "uuid": "f8ae6197-725e-4cbb-a938-d0ed1533f107", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "816b09a4-6493-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781072011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072011, "uuid": "6a52641c-d04d-4b51-9b9b-921f80fad3dc", "comment": "Malware payload (Gafgyt)", "value": "be0bf7622992651858ce3fdadda41272", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072011, "uuid": "0e3d037c-15e6-40a6-98cc-4799f9b91fe8", "comment": "Malware payload (Gafgyt)", "value": "cf9f4fcbdba8562546f7564151e179ee5d1249263d43809d45e5ddf924b8c212", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072011, "uuid": "46927d02-d3c4-4bbc-b691-ccb30096c63d", "comment": "Malware payload (Gafgyt)", "value": "fac05c02475be96088e47113760cf6de8eb25926", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072011, "uuid": "fa5282fe-9d99-4d9a-8991-b285e7cce566", "comment": "Malware payload (Gafgyt)", "value": "fc466136ec30002942f8a171f065106936951ff45a292ddc96ed3153db8edb0c6f92df1d1e1d8d8336a720b02b3640e7", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072011, "uuid": "23402958-b2bf-4a63-9817-25c4dae3a267", "value": "T1AEB32A17B9528B12C1C215B5FB4E564976136BFCE3EF3212C9249F603B874DB0E2AD51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072011, "uuid": "7ffa2da0-c451-452d-b36c-9822adcf39de", "value": "1536:KLnB+n44MiIGsY8jUQh5sl+aranNTffIpP1MfirfA6RJZPHjRS5SY45h0pQBAr:ItJYEr7GaNz6fA6RJZPHjwwN5h0pQCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072011, "uuid": "13ddfdab-483b-44c2-92af-7e11f72e799b", "value": 116124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072011, "uuid": "b884e6dc-8400-4359-926a-34ec8749ec14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072011, "uuid": "ef5d7796-c502-49fd-99d6-8eab61a5a1ac", "value": "FBI.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a0add6-6493-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781072013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072013, "uuid": "61634c65-f9a2-4f1b-8345-9f65f25098d8", "comment": "Malware payload (Gafgyt)", "value": "4ff0df8ae6c8019e9fcdfe84a23fa188", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072013, "uuid": "0c908cc5-0395-49a3-aa39-07a8ed51e160", "comment": "Malware payload (Gafgyt)", "value": "cfcb74ca46adb3b5f4d02f8aa793349562a09d8b08b1177a4c325cad69304ec3", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072013, "uuid": "8b81a226-52ba-4d9d-be1f-dcf1fbe71019", "comment": "Malware payload (Gafgyt)", "value": "d4c430a09ea4c5fe8782a7e114de1cb5b7b68625", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072013, "uuid": "94d372b7-65bb-4546-88df-c6b7851b5d66", "comment": "Malware payload (Gafgyt)", "value": "bed93b27d8dbd8952f757a92a1f6d4f9092c8b95ad56976ef788d79bce87a0dd599e6977bf601b578f61741f20522a77", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072013, "uuid": "f2e9228a-2f28-42d3-84db-b9f4d627e4d2", "value": "T1C8C33917F9419F41C1D325BAFB8EA24933136FF8E3EA7102D9209F60278699B0E76941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072013, "uuid": "8cb7a461-0cc2-4d2e-b109-bc6e2e67a696", "value": "3072:Yy19yVznJoEsaMD56iNwaQFgei/oCkRXY5hTpZ3n:YyDyVzneEsaM96iNwa8ggCkRI5hv3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072013, "uuid": "ded6e6c1-6b90-4fe8-ab17-a4d218cae6fe", "value": 129968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072013, "uuid": "2b6722ce-42ab-4951-a7e8-2e023c4a0958", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072013, "uuid": "fada7451-b920-4eee-a204-69ca1ba0d317", "value": "FBI.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6de0b40-6477-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781060048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781060048, "uuid": "d2550929-5a8a-41de-8aef-40229849ddde", "comment": "Malware payload", "value": "bb77081254503ccfe59f332c6c9b5a0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781060048, "uuid": "f75efcbb-145a-40fd-85f9-f81ed2b7ef9c", "comment": "Malware payload", "value": "d010336957782fa2362986fda9cc6d33583f5f483481c856a03b35cb553b261b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781060048, "uuid": "d4e0ad65-d917-41b7-9496-a365cfd114b1", "comment": "Malware payload", "value": "f8331feb4a4c776d620b122bbe3adaf807952822", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781060048, "uuid": "1a5fa579-d4e0-48cb-9ccc-5f59cdd0aac1", "comment": "Malware payload", "value": "75df6e737e3ea30fa9ae2614cdc1c197b5803bf1a8fcd10b360456751ba1b09c0ae56122241f28e4c57f6619517424d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781060048, "uuid": "ac8ebfce-9ed8-438f-b39d-a729715d20dc", "value": "T1CD14775A2E328F6EF668C73047B74A24E76D23D627D1D684E1ACC1142F2435E641FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781060048, "uuid": "46e5bb5e-26cb-4545-a879-6170bd4c726d", "value": "3072:O3BiuWOycBBTMIuUPo/lC/hTNtbLY1YIAfk/us6FVXJ+:GBiuWO5BpuNArbPIaG36bXJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781060048, "uuid": "cc869e19-e9dd-43c3-9357-b7b441572659", "value": 197860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781060048, "uuid": "01ad62ae-0381-4199-9131-671d0532cce0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781060048, "uuid": "153b3ba8-9e43-4de4-bfc7-4355545f4397", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d2ac905-6490-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781070770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781070770, "uuid": "3a978259-9efa-45c1-9204-5ce3e8254aaa", "comment": "Malware payload (Mirai)", "value": "3409d864915c8b0268ee001e6b65f0c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781070770, "uuid": "671ac0ac-91ad-4f99-bdcb-42010c04ec6e", "comment": "Malware payload (Mirai)", "value": "d105462b5cc1c60073a4115791a00cda308507185378009a203b9f1219af303e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781070770, "uuid": "ff9a12ae-4e51-4a1b-9c82-9f22ef4d9403", "comment": "Malware payload (Mirai)", "value": "35a9bdf9b4be42c40f282acdc2a147f265c2396d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781070770, "uuid": "4c45ff38-f1e4-4772-a9bb-7e664c2feaec", "comment": "Malware payload (Mirai)", "value": "ae57af30b32487fd0e13decaecb4fbae9659bb1150362d5d19f382b08e4087a2861825c3d322d2df7bc38ee4ec45b24f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781070770, "uuid": "65a70c04-4beb-4ae0-a5fc-ef509a892f08", "value": "T12DB30A45F8509B17C6C652B7FF4E428D7B2A1798D3EE320399256F70379B96B0E3A102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781070770, "uuid": "22e76ff8-51be-4f6a-b591-d09fce80c275", "value": "1536:H/yM5fXEAb8qAk6t4Vra6CT411W0EO7N5eMtdTlVPwyw3rMP5bnWlsFVudv7gx:fzZUC8qk447U1cYP3TKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781070770, "uuid": "31b0c00a-b899-40cf-93cc-bcbd3013e238", "value": 109184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781070770, "uuid": "d4479c33-2938-42ac-9aa8-b5e861569f41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781070770, "uuid": "eccafd81-0771-4a05-b9e8-7495700e777a", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa529dba-64b0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781084535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084535, "uuid": "66fbc7a8-105c-4cc4-91db-fe9dfb187896", "comment": "Malware payload (Formbook)", "value": "bb38405ab2f42da9d35b351057c2e0a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084535, "uuid": "1f14bc85-50d6-4fbc-a7cd-9d27688ba00c", "comment": "Malware payload (Formbook)", "value": "d1654ee1272baee707f1ac0f158be80be347af9a3a15927ad8ba51dcfc35e2d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084535, "uuid": "bd8f3a4c-36b0-41ed-b210-f25be382770e", "comment": "Malware payload (Formbook)", "value": "85ab994c08b194a672dc00856088416196c5dce9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084535, "uuid": "92b4ec82-f21e-4cfd-b8cf-71e0a66298fa", "comment": "Malware payload (Formbook)", "value": "5896f922a5b9f993cf799a68d761edc65140e9ab74e6af8cff3bd9b7f70fc7d85fd59cebc72e5721bf8d09831b4f532f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084535, "uuid": "3609d38f-02ca-4743-a681-87cda224fe14", "value": "T14E5423207D09E38BCCA265777E87F573E9515E3A09C8E687D34E3CC9CB66604A00A793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084535, "uuid": "7cbb28e5-0011-4abe-9fda-7479ebb20f68", "value": "6144:YhsYVByoD+uLTbwQzYVNfNHsdh1YQFZZKtkxsef:0yo9LTbwTNfyhSIZQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781084535, "uuid": "58c504fe-8344-4569-bf1b-9633f3515129", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781084535, "uuid": "dae9174a-9e6b-4136-86a7-11248ec5f2a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084535, "uuid": "3253a93d-154c-4eec-a4aa-b2a614c2b1a4", "value": "SecuriteInfo.com.Trojan.FbngENT.1.24657.7307", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd9d6e0-64e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781108617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108617, "uuid": "e4075e9c-bdd3-4c2f-a2b2-7989200783f4", "comment": "Malware payload", "value": "3397d63a0e9411408f98dd3be9b50ba8", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108617, "uuid": "0464a7a0-850b-4ef0-a34e-6f772b54dc39", "comment": "Malware payload", "value": "d1b7a4a62dfe635f88904f53c8d4537bdbde42dcfec2ddc3a2b27e15e747d8b5", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108617, "uuid": "cc2e8413-03cf-4750-bb2d-5fb567c9962e", "comment": "Malware payload", "value": "b6ed70893e60459795a11fbb28cb04b2a7f987ae", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108617, "uuid": "e1900eb5-2107-43a3-a205-d8eb7d0be397", "comment": "Malware payload", "value": "89c606bf7c7108f1a980ceeac7f2d888cea064f1c2d50aef1d5404f67a9b9a52f60a37c1c69d3942e022a5379e15082d", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108617, "uuid": "a7ca665a-1598-49ee-bd0e-efdbfed9677d", "value": "T1E9418B013FEE1724F3F69E7A94BA6366487AB896ED25CF1D0090468C1826B11D875F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108617, "uuid": "df2dc652-8847-45f1-bba7-b21e490a1ebc", "value": "24:8pfJtnyURef5+rAuuhsN4uvMLpJdd79ds5sq:8RAiAXhpkMDdJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108617, "uuid": "97d61bb2-5538-44aa-9c79-053a32b680ae", "value": 2104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108617, "uuid": "9daf34c7-5993-41f4-9ca2-fb726b2c5fa4", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108617, "uuid": "55c58cf5-9640-45fd-b973-9187668d7bfc", "value": "IT-Job-Interview-Preparation-Guide.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f49d32-6491-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1781071242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071242, "uuid": "9fdd0bdb-ff70-4674-9377-cd3a0b599592", "comment": "Malware payload (RemusStealer)", "value": "33fc10bcdd713ff1a5f2722b88c63782", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071242, "uuid": "69ee01f5-e37e-444d-bc43-529b5d6ff322", "comment": "Malware payload (RemusStealer)", "value": "d1fcd185dd9b18bd39082dd15414d70eec8324171d4583185634204c992a1ef1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071242, "uuid": "d035adc2-a78a-47c0-b949-1ee13e3bc7a3", "comment": "Malware payload (RemusStealer)", "value": "17b0695da2f22ef0e95391301a6e0fba56fa0491", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071242, "uuid": "8305d524-de17-432a-b68f-5688447c5900", "comment": "Malware payload (RemusStealer)", "value": "85b600834598286afa66e1e64f82d5e217ef43c3c125fd0478e3a54678dc5a9919559303f6554ad27c79d966df89942a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071242, "uuid": "cbf3f099-7105-40d4-99be-edd8838aa7ee", "value": "T10A538D43340C8971C9C50EF9B8B5952BBABE37524F7029D3116EA57E4BA43C2337D68A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071242, "uuid": "c4e1c24e-8a10-4a2e-924e-053f71e24dbc", "value": "83d558fa567b64c5d7c04f787b358144", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071242, "uuid": "076babc1-bdfa-42d9-b2da-ef57321e7cca", "value": "1536:xGy9INCqncnal6Kg98piPPKHWL1KqGqN6CFQQdzk7IBSKA67o6dRq7o6d2:xz9INCqncng638sPPKHWL1KqGqN6CFQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781071242, "uuid": "54bc394e-5d8a-4352-a789-d2358b5e506f", "value": 66432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781071242, "uuid": "f7053024-780e-43f6-907a-d58b08801f63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071242, "uuid": "8765bb26-1db4-42d8-96a1-216fc8a2d87d", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1985e0-646e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781056188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056188, "uuid": "cebbfc84-8b00-48ed-84fb-9e188e93b1db", "comment": "Malware payload (Mirai)", "value": "c3097f8ff137e38f1d76e0897003a82e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056188, "uuid": "5514a453-2dd7-458e-aae9-aea01fc6a646", "comment": "Malware payload (Mirai)", "value": "d20c137dcbeb308154464383b0feb6751a3733423f7fedb8372f1ab9bf6b89f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056188, "uuid": "8ed0a4cf-bce7-44a3-9edd-9a3216a09da6", "comment": "Malware payload (Mirai)", "value": "a4902e3ecb6d37e9bc3cc9189d1819cb383c52da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056188, "uuid": "954602d6-99e3-4354-9838-f1954cc02e1e", "comment": "Malware payload (Mirai)", "value": "7fdd2d28cd93f384b1b43c719eda82982d56e99a15b9d808c6725d0592fded8d079e62308011e51959e6330e2ac0d919", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056188, "uuid": "bd301692-bb59-4fd2-ace4-c70b4ffd3c5f", "value": "T195E3F756B9819F16D5C152BAFF0E528E33131B7CE2DE72039D246B247B8B86F0E3A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056188, "uuid": "48e561cf-29bf-4309-8eb1-ff6b26e0a5f9", "value": "3072:c+gdXkwub1v84lLXFLUfTxC2MVYBycaAVfR53:JKXkwM1v8MXtULxCVYBycamv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781056188, "uuid": "c7e2d58f-42ad-40c3-9f4e-2803bbd319d1", "value": 156976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781056188, "uuid": "3dc298e2-130e-4002-a680-ce04889463d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056188, "uuid": "0347fb6e-8373-41fb-b943-f237f458fa08", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ea8f42-64a5-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781079535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079535, "uuid": "bdcd64f7-3622-41ac-814d-cb19f6308430", "comment": "Malware payload (Formbook)", "value": "be55c2f3bd18d46856c9380df9d0616d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079535, "uuid": "f426b4f7-f725-4aa2-9a7d-0114dd9714be", "comment": "Malware payload (Formbook)", "value": "d2b037c58245ecd05b6e149b7d9e7f1be51e30c7707f3754472cedda71a7953c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079535, "uuid": "1445eaff-bc27-475b-9b4c-44ebe85a29fb", "comment": "Malware payload (Formbook)", "value": "15269c3d75a667bb96fb36a710299ae78565fc6c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079535, "uuid": "8d641548-1e5b-4b1d-b4c4-8e33b355f071", "comment": "Malware payload (Formbook)", "value": "7d9a5af047510c09f740890a771c00a3e60c3467eccfa1209c7c6144be22859efa3839f65f850a6a3a8c561dbf73dbf1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079535, "uuid": "f095eabd-2cf5-44db-be52-4f35cd1d84a5", "value": "T196E55C17D66F974D180D3B61106A5D9AFE89CAFCEF72ABC4E0CF90B614EA1100B851B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079535, "uuid": "ec2b03df-e704-49f6-a39e-ef4d9b9250ba", "value": "49152:wUqimtunkYwdjrEsVbQw0AIq306u4muSYuXecfy4P+88RYjZsgcAx2e:5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079535, "uuid": "582345c1-7cca-42d3-a0e0-84e4d46245f2", "value": 3105411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079535, "uuid": "250623fc-9ce7-4c3f-86c2-a6c9fddfb599", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079535, "uuid": "eb5dcb05-1e35-4c98-9519-b30649a3e2e0", "value": "UP93C-0620226.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef20cadb-64ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781083792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781083792, "uuid": "2d54c808-9863-4039-b8f0-736967d923c3", "comment": "Malware payload (Mirai)", "value": "c41f8f796b12fd48fe1772d206492471", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781083792, "uuid": "f5d5f099-c5c7-4fd7-a091-3f4a60b5884c", "comment": "Malware payload (Mirai)", "value": "d2fb416e631a8385cfee7a0769cd7aeaf84c0e175ce2a44509c60e9517779b39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781083792, "uuid": "1603b349-cf9d-48cd-9718-f88cbe8198db", "comment": "Malware payload (Mirai)", "value": "9e5517766342d5ae7c8d11c5396a8b8412554acb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781083792, "uuid": "8a5a435d-190f-42b2-95ab-7b142fffbcdf", "comment": "Malware payload (Mirai)", "value": "a10724e2cfbda1c2c82a2a33acb963a3757dd1356fdc052901c4c0e26f111a1c34077826deac82ee1d4f679f29c88ebe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781083792, "uuid": "7249c7ca-e348-4293-bbb0-0b2dd899d436", "value": "T1BDB3F945F8508B17C6C652B7FF8E42CD7B2A1758E3EE32039D156F24379B96A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781083792, "uuid": "732190c0-3deb-4a39-94ed-3abeb6b0f9a7", "value": "1536:+sF55InxCBf8cAJT44Vhq6qTbriAkmO/ChdXdGAvWlhVwywFlERA8+kR6sVgOEvY:huxCR8cZ4uPPrFrVkA07yNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781083792, "uuid": "e9888c15-79bf-481e-9168-e7c93a375021", "value": 113280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781083792, "uuid": "462f20e9-8f79-46e7-9d5a-e9cb50c82dde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781083792, "uuid": "4ad18f53-d968-45a7-b15e-e85d23948e13", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a66d5fd-6474-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781058524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058524, "uuid": "a3055b25-5b84-43ab-87fd-a1272f657086", "comment": "Malware payload", "value": "025f4469de0e161fcc25844d61cba2a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058524, "uuid": "f2260bd3-d209-4134-b52b-a3e4dfd72282", "comment": "Malware payload", "value": "d44a4add033aa60a4d55185eac6d4fba4c90c0de0a3859584e58879e0811225d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058524, "uuid": "b9c97760-f2df-4c01-ad7e-ae214a313d95", "comment": "Malware payload", "value": "75140388b5625c7f715becb2aec8b02c2cace7f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058524, "uuid": "6b0050da-2310-4a99-a2fc-1f405475f695", "comment": "Malware payload", "value": "4ae8a5469a6c5692dc651827526bd3b9f5b7e7b008c36194ef0d4401dcdbb72284154389b7f4ec6a9126446b76955216", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058524, "uuid": "a9deab5a-1744-428d-a0f6-e51d814858c9", "value": "T1DCE35B0774C090FEC8D9C6B48FDEE12A9A72B45E5138B11F27D46F266E5AF202F1D650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058524, "uuid": "82757b33-b43c-40b3-9680-db70e63071da", "value": "3072:JarKHe8adanFZSoXruRp5roY+I52OffuzvWrmRcagahx:sgaYnFr7QszA0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781058524, "uuid": "88913966-f9aa-417a-9bc1-c39b15516dc1", "value": 145816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781058524, "uuid": "f25da0fa-703c-4609-96a0-98cc761f6ec8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058524, "uuid": "e5273a1f-97c1-44d2-9103-e02d2f1c2f74", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8065d35-64e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781108610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108610, "uuid": "59131abc-bf84-4dcd-8e13-d5c71d18bd49", "comment": "Malware payload", "value": "57bf98ccbdb30cb7641c2a730698f0c4", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108610, "uuid": "ba933c11-8ae3-4f54-8860-04f7bbf8ee94", "comment": "Malware payload", "value": "d45882504e96c78f58a75a1bac18cb318fad63d7a144b9457b23bc026a37f8b5", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108610, "uuid": "e04c7b75-1a5a-4974-ac70-05747fb8ec9c", "comment": "Malware payload", "value": "0ea175012315de0b921bc1b6b13e2857445d93a5", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108610, "uuid": "32049c1c-c86c-4514-977c-162dc489fbdf", "comment": "Malware payload", "value": "9fe913521ce45e89933214c43e8566edf7fbd6b5eb3343ee2cd00a41984c9966ec745fd09b475179451d6474266e8924", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108610, "uuid": "8155e17f-6915-4917-8605-c26e12275a42", "value": "T177A37F92662A557AEA2171320B83446F5909398874727BEF106FF7CAF079FD03AF605C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108610, "uuid": "6c9a4bc2-6be1-4577-a94e-bdc1baa54fb8", "value": "1536:h3ZxuC7DHkygLlw7sFlBVWRxxe+fWXLjHbRHgH4sI8ANNi+9e/kHM90:hbDHkywlwWDsE+eXLjH9HZ78ANveMsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108610, "uuid": "86640e66-8f10-470a-8885-ade0990a4c64", "value": 101708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108610, "uuid": "96f36127-b528-475b-81b1-4340cd2e17b1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108610, "uuid": "0c92eb47-b056-4e80-a9c5-ac14818c55de", "value": "Copy of Chelsea_CieslinskiATR.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b4c25b-6476-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1781059505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059505, "uuid": "f3ff18fd-4a8a-4022-93f1-d06393dc1013", "comment": "Malware payload (NanoCore)", "value": "7db0201c2db2585c8ccd249d7a55cbe2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059505, "uuid": "7384ba38-c2cd-4ddd-a92e-0c9d7416c09b", "comment": "Malware payload (NanoCore)", "value": "d4820d268f30feb2cf0b3a965f67b7eb3b2a1e373fb7487f4a7b7d896ea4eaec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059505, "uuid": "42a575d9-a6cf-4047-978a-c9acaba256b8", "comment": "Malware payload (NanoCore)", "value": "b7b847d229ef2bc9b47abc5e3e1093f850b8fcbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059505, "uuid": "cbde1aa3-91d6-44b5-add2-283d4f6698f8", "comment": "Malware payload (NanoCore)", "value": "6c79df21c148160a3907c1f93f0826609d2f514647a7581a4d9b7ff24ab7e95a217035bf00e15a2ae7b7336f7a784bd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059505, "uuid": "6bfa21f4-1ae7-4d0b-a1fc-f38e6ba162f1", "value": "T1D214CF6677E9852FE2DE86BCA12211528379C2E3D9C3F3DE28D454B68F163E40A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059505, "uuid": "7171fa39-65b2-4e21-9218-653beb62137b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059505, "uuid": "9249f036-4b01-467b-be15-e65d87326460", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HID07DsFkHQaH4dryer617T5TYC:MLV6Bta6dtJmakIM5L7FHQaHuyqeVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781059505, "uuid": "7a0f8d15-ce9b-489f-bfe8-18f55c5f3e72", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781059505, "uuid": "2c3ccdc9-05d3-4ede-b881-e361c06b693f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059505, "uuid": "e3d34bc5-96ad-4fb3-ac60-db672cece160", "value": "djgizmo.nl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cba716c-649a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781074849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074849, "uuid": "9249a063-3ebf-4702-b05a-fac07b9df79f", "comment": "Malware payload (Mirai)", "value": "750d069eaa5a0d2e5148a857e8474139", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074849, "uuid": "2a010e05-54d4-4495-994e-732d725caf72", "comment": "Malware payload (Mirai)", "value": "d49ef778b2b9c07468c9ad55d251a1108d6c56f2e7a4de576f946466cf6c7118", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074849, "uuid": "f7c7dfcc-87c4-41cb-81e2-32cd0907cba2", "comment": "Malware payload (Mirai)", "value": "03f7665f0c2ea0c559c78327fb18ddd0358d292b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074849, "uuid": "2c2ea5ee-a1a6-431b-b943-e83e89f4a07a", "comment": "Malware payload (Mirai)", "value": "ef925b89eb0253dc36b311e5aa63a59a79138c6f11060bef2a4fa51d4c821d31d73f7537bc6f1aa93e94780ab237b375", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074849, "uuid": "8f1679d7-7476-49ab-8590-ba41162ac3ec", "value": "T124635B85EA83D4F2FD4B06F1907BDB228733D53A105AEA82D31EA835DC52851E71B36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074849, "uuid": "ed756615-e3b6-42a2-a809-400ce142a5c9", "value": "768:e4lvcP9q9ZBYGA3/MfhzJFvAnohEifg/q808MASkDJfSmqR7XzqieKMIur:e45cEi3/MfbVhDfgi84xAdSTDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781074849, "uuid": "95876888-cfb3-48de-a079-40e396c70d50", "value": 71912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781074849, "uuid": "f00b5e4d-1c31-4506-9097-9bfeb6b3f444", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074849, "uuid": "61937970-41b3-4c40-a9c6-d716c9dcc93d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54b427e9-64cc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781096418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096418, "uuid": "e9898d76-3b96-433a-815a-b67272f9a6d6", "comment": "Malware payload", "value": "eb978e292dcf60f5bd13b5a6f3ef722d", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096418, "uuid": "49039cce-e299-4117-8364-296cc03042db", "comment": "Malware payload", "value": "d4cb804fb59ae0d8eefc7999db90043c127f0b5e08b0a3b617853b9924c8476b", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096418, "uuid": "667fbf74-2e89-4682-b489-16e8574b14be", "comment": "Malware payload", "value": "9c50e32976692d42636ec8a0186dd69acc8fc821", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096418, "uuid": "45227a3d-de53-4ef2-b91d-8c0feae97d88", "comment": "Malware payload", "value": "f4968738fbf9cea4e8ad16271fcfa00b0fae5c18b2bab8fe5e505c681d5b983021c5f23b1bb06a9f2f67307f0e71f358", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096418, "uuid": "aaa4d992-3785-4a02-816c-313e2610dd86", "value": "T18741AA1217F61318E3F74F39A972B3115E32BD11DE12DF9E025092695871A24ECB5F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096418, "uuid": "2768fe3b-a300-40a9-b215-8a51c95c6538", "value": "48:86mqa++16QkxueHojzHRqA33C3HBcabP2q4:86Vuw9ZHovRf33C3hcQ2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096418, "uuid": "49d3b06d-93e5-497a-9b27-bf58c69c1349", "value": 2240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096418, "uuid": "45939e81-d2f0-4dfc-a6ab-fa3df9da1182", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096418, "uuid": "1f4629c1-166a-4e2d-86af-180f61960f64", "value": "Adobe_InstallerX64_11.5.2.exe.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20085718-64e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105778, "uuid": "c50006d7-ae85-426c-9a67-d8e0c14df5f3", "comment": "Malware payload (Mirai)", "value": "4f0367314f5af8a1c565ab2eada97b27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105778, "uuid": "f96cb2b8-f6e7-4b1c-a21f-8f3f5b75504d", "comment": "Malware payload (Mirai)", "value": "d4e4ec065e330eb5894a4ba39d2981cdfe9174d0260a772a49afc2a4b7031674", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105778, "uuid": "230fee4c-bcc0-463a-b258-47778e9781d4", "comment": "Malware payload (Mirai)", "value": "37e44d0fa4037257e8f8791c7325f472f31f7ecc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105778, "uuid": "6875f815-e593-4d0d-b829-3dcc4bba6e45", "comment": "Malware payload (Mirai)", "value": "a7026cb0df28c0dd77d18a804d6c3fa287c6197224b23f7abd3ee0da2ced8aecd553946d5a6110f73236c57803698cd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105778, "uuid": "30be9f10-17d4-4a4c-b545-49fb135b353c", "value": "T148630891B881A626C2D1537BFA6F008E372457D8E2DA33139D255FA0778AC1F0D57F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105778, "uuid": "6dd36a42-647a-47c8-af70-22b2e3bfbfbe", "value": "1536:pOTAiIYaMBktkIwn8U0yaPSmuUt8M8fhWtu5v36L:pOTAiLaMH+uUerpeu5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105778, "uuid": "561a69e1-b5fd-4fae-ba6c-d6789d8063aa", "value": 70856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105778, "uuid": "70c69511-1e82-4eef-a551-927acf26b387", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105778, "uuid": "491c3269-8c37-4b81-8e65-8612b40b057b", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c5b11d-64e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105833, "uuid": "60a1581f-d418-4fd7-ae33-9c19a9724ffd", "comment": "Malware payload (Mirai)", "value": "bfe87b6f2d9760596b626c5648d54354", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105833, "uuid": "d6be7c70-5f43-4d40-87f0-2d657ad55b68", "comment": "Malware payload (Mirai)", "value": "d58c8ba3cc2fc7fa0bce7ddbd8bfb14cc4c4b9a89bcd7e084f62324691b69141", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105833, "uuid": "7ab90f56-9312-4928-a7bb-e5c127ec0e24", "comment": "Malware payload (Mirai)", "value": "4da4d98ccd58ba45da35ad530ac70352b86dadd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105833, "uuid": "fd283193-41f2-48c6-8f67-8b454c94a82c", "comment": "Malware payload (Mirai)", "value": "cd116b853437699bcf6f6ae45df6b11afae303199b14163e1696da7e39d677fa8515348d360d3cdac7e87385ea72c45e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105833, "uuid": "1b281b94-3840-4038-8383-b0683f6d053f", "value": "T1F2F43955F8C09F62C5C4657AF65E82A83323477DC6E6F30689144B383BA78AE4B3B741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105833, "uuid": "2f26686b-fab7-4e93-941f-634ff7a0b614", "value": "12288:4uLa+BS0Xo6HskFEeSkaOnB7APGUXgHh2GBAeVrcxIT6puy4eKyv2qoELI1gxF:4uP06BSka2MIDBRcqAv2qDLI1gx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105833, "uuid": "26e2166a-b26f-4390-892f-689409bbe55c", "value": 792620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105833, "uuid": "5cb06f0a-9379-4f5d-8beb-73a81bdf920f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105833, "uuid": "c30286b6-a2b9-4418-832a-299bb6bda396", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250e18d0-64b2-11f1-a769-42010a9c0008", "comment": "Malware payload (LokiRAT)", "timestamp": 1781085171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085171, "uuid": "4aee7bf4-a63a-4891-854f-527106fe3c2f", "comment": "Malware payload (LokiRAT)", "value": "727c64594f5323e8a55592057176237c", "object_relation": "md5", "Tag": [ { "name": "LokiRAT", "colour": "#17B4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085171, "uuid": "178f44a1-65e0-483d-9a35-a5a0e72fa8ab", "comment": "Malware payload (LokiRAT)", "value": "d5d0a96a77f93ba4dc8dc468efee0fcd99a065f665307ecc750ef36258680b39", "object_relation": "sha256", "Tag": [ { "name": "LokiRAT", "colour": "#17B4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085171, "uuid": "954a774d-dff4-4d7e-b8a5-7a337723cbd2", "comment": "Malware payload (LokiRAT)", "value": "5f9c06a560605491d76e07dcb049d2031bf77ca2", "object_relation": "sha1", "Tag": [ { "name": "LokiRAT", "colour": "#17B4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085171, "uuid": "d5803aa7-22d7-4554-99c7-c2ae651a14ba", "comment": "Malware payload (LokiRAT)", "value": "97b74a5ae1cd58e80688cafd92a0f75ae0d6a1fcd44a8aa4011371af48a469684b61aac9469709320def83d27cf91e63", "object_relation": "sha3-384", "Tag": [ { "name": "LokiRAT", "colour": "#17B4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085171, "uuid": "3a7d72b7-5c21-4c6a-bb0e-fa410de9dead", "value": "T1F0B21909BBDC8606D47F4BBDA8F213840771BB165930DA4E0EFD50ADB930B449791B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085171, "uuid": "eca8b74d-c6bb-4dc3-bb23-78154a50d24e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085171, "uuid": "2e089e59-6823-4cc9-8a31-40007aa49760", "value": "384:5I4L3udk7LC+7B/05lhAaQDARXvd0XwjWac9fMKADOacyQNjXzKrAomOBsjhIvMJ:PtfmC8c2pPohWMTDdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781085171, "uuid": "3c7d5bf9-7e21-42a9-972d-c80a48120174", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781085171, "uuid": "9f9c52e2-1edc-4f0d-839e-d486b7723482", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085171, "uuid": "b1c8af2b-9b3d-46e1-9130-bdcc3175d2bd", "value": "2sn7bt.sa.com_273e0876_k_google-drive.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d391467-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1781108834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108834, "uuid": "81aa6488-99b2-4d6b-9049-bc1eec6cdb54", "comment": "Malware payload (PhantomStealer)", "value": "1a35c0e4caf24dc3ed38abeec919cd33", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108834, "uuid": "d92c5c71-4e07-431c-a65a-6fba0a9abe96", "comment": "Malware payload (PhantomStealer)", "value": "d5f064832a93f2a1d0850e3652698d3c9d6d7c2a51bff3a0b865dec84cbbb374", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108834, "uuid": "9cf1b289-ac00-4841-a3de-09516ccf9424", "comment": "Malware payload (PhantomStealer)", "value": "46344d05a8fbe4372b259fd53747e322a3b065aa", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108834, "uuid": "95a9ca8e-88c3-4ba2-b3e4-4e86e0292266", "comment": "Malware payload (PhantomStealer)", "value": "d98fd26fa04200dd9f0b3d19f30afff9fbc1476e23f0b86a0055f5c29a016ddedbaf3a53d41a84065538c33aac95d295", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108834, "uuid": "8907e313-c980-4648-8cea-2b0560733b0b", "value": "T1F8734E5E42EB8AE997E409104EEF04AE440A4790BC33349BE3172BADED765DB109DF34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108834, "uuid": "0be319c1-aec7-4ed1-ab7f-4ac0861ae2e2", "value": "384:1+cCByAnvgtyffSB5K+iQuek8HCHw89ExEaYbisMuBu095uH++DqndPEV8XKC6Pe:Y4qEDGFeHiog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108834, "uuid": "051ce4fd-a66c-467f-a734-cda852776377", "value": 75297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108834, "uuid": "a16415db-04c9-4958-bab5-cc21f7d467ba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108834, "uuid": "2afa5772-09e0-452e-ae54-64af4c52a2fa", "value": "2026 6 0000089.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd645507-64d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781100056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100056, "uuid": "9e7cef85-aaf3-416c-9aba-bef068c8513b", "comment": "Malware payload (Mirai)", "value": "a9c4655725bb0ce703678231897dd6c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100056, "uuid": "b1961feb-3c18-4261-b3a5-860f84457203", "comment": "Malware payload (Mirai)", "value": "d8d40c9213482971b1c2ba8993403e679a3d36453b59fee768a8656ab0305592", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100056, "uuid": "e7bb9d6f-b5d9-43ce-8e81-adfc65968e49", "comment": "Malware payload (Mirai)", "value": "fa3c2863a3c34e97986e8fa5cecc0079a2cde501", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100056, "uuid": "2a4a8824-6969-44dc-b3ca-441f3eec5d52", "comment": "Malware payload (Mirai)", "value": "5945fb0f4cf9209924b07f11615309bbbccdf8c31e9d61cf72f7a25c0ac90cb1aaef2d46c301ecc5fb0abdcdde63babf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100056, "uuid": "0956064c-6e1b-4528-92ae-c70203e5dddc", "value": "T19323F1B1C50B6D029C207E3599B34B42860E3BFBD161F4132459946E5FF388ABFB91A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100056, "uuid": "9da0faf9-4cd2-4295-851f-f6fa4ebc4863", "value": "768:eb9m31eJz1MT0klSgcwg4WCGHDwg+qCZ0yfs4c7Do99q3UELY:Oo3QJz1MTawgegrv1l7bLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781100056, "uuid": "18f445c9-0608-4293-9393-2818ae836aa8", "value": 46496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781100056, "uuid": "3949a4b8-03f7-44e0-8a35-c82223ca413e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100056, "uuid": "10cb1d57-4fcf-452c-856f-4476edfb242d", "value": "zero.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3242b6c0-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781108815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108815, "uuid": "5508e962-1afb-4361-bf9e-17a3468dc247", "comment": "Malware payload", "value": "d62c9151d2157ba55983ee70bd7fcbbb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108815, "uuid": "78e9ab40-9555-46ac-9d3e-300421b2804b", "comment": "Malware payload", "value": "d8f3c6929fc71e5888cad589cc05616c4ab72f45dfa31ec4e2e8246d4ee83a9e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108815, "uuid": "c931ddda-fc35-43e5-8217-23a8573fa13f", "comment": "Malware payload", "value": "5e97bbed34c86b0f879823d3bb24e027eeb0d3b9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108815, "uuid": "60d6edde-ebd8-41ed-9fa3-b11c46a20ad9", "comment": "Malware payload", "value": "410a8d4659c8a128258d357e528b4d554ad7aee43fec3d17d7363d10dac02cf657ca013ae6d54d5461bc1b9b750533db", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108815, "uuid": "3c440b59-d3f0-47ad-be6a-e7d620effcac", "value": "T1ABE1097782952B6A462F49DCB73880ED2214DB951723BF50275F8DAAFBD0934CD3A4C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108815, "uuid": "bf8ed30f-765c-4e48-a277-7aa4e7866fb5", "value": "192:6kDC04Pn01jUqxdBQEBWQN+DrgaO+ykY311wlIRJQ5fE:64CFqxIqJ6O18SG5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108815, "uuid": "9903ee1f-9216-4d61-8457-27fe990f859b", "value": 7246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108815, "uuid": "41e32dd1-ccde-4e07-b371-2a6b81f68b0f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108815, "uuid": "2796eff7-d7bc-4397-b79a-29aebcf8dfcf", "value": "zPXMs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab49d1ed-64b0-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1781084537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084537, "uuid": "d593ba41-0e8b-43a7-b8b1-fcec15f04653", "comment": "Malware payload (PureHVNC)", "value": "6872f1ef296dd0836c71a3b20afe503d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084537, "uuid": "23a50c11-7683-4930-825f-343378dfa038", "comment": "Malware payload (PureHVNC)", "value": "d99796073dfaed40d0dc92868d43a93e1ea0ea0cf81074b30b7d80c00cc3b15e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084537, "uuid": "953e3e35-4821-43f7-a1b4-1940657c3f9a", "comment": "Malware payload (PureHVNC)", "value": "be3f10fe6278e584a9b159e2a0502f4c68be85df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084537, "uuid": "ccffb7ff-db75-4243-8a40-6ad638bdd228", "comment": "Malware payload (PureHVNC)", "value": "08cc9125cd22fef16abd5fc25ecc3b1d4364e33ba27fcc33a6232d0f5227c0cd70339ef6cd0f02f2ff584b8c313dfc70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084537, "uuid": "306840a6-5954-44d2-8c1f-e669c1be2a7f", "value": "T132F4BE1B76A68E21D2C41236C1E7141197F49587BA37E70E798423DB29023FBEE4B397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084537, "uuid": "321e3dd8-f120-45c0-a505-7853ee2f5815", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084537, "uuid": "a34e45b7-616f-43fc-ab68-8e70d41e37f6", "value": "12288:juZ9WtH7w60GhlhJEr8NQNG7QQhqhDr7Od0Os9ZSN1wXGaQY+p:SHWBwHyhJErwIQkhDr+o9wMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781084537, "uuid": "69a9882f-9e43-469e-86c9-69ae911bd809", "value": 784384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781084537, "uuid": "7177e3ab-04eb-4767-931f-9adaee219ba9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084537, "uuid": "6ab94bb6-3758-4caa-86f3-d6995406704f", "value": "SecuriteInfo.com.Trojan.Mardom.IN.10.38167571", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253b036d-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1781108793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108793, "uuid": "97263d62-8b19-4454-aaf5-9d1fdc5384fb", "comment": "Malware payload (DarkCloud)", "value": "1fb867e6f1402cbeac72e7a970336e13", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108793, "uuid": "6ae4f7d8-1ec8-4233-bc53-b9bcfd1a35e1", "comment": "Malware payload (DarkCloud)", "value": "d9abe2d1ecceb3b1583f7c808404d7cb78ae98a6f4338a24a0ada5a77297fc5e", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108793, "uuid": "4542bbf2-225e-4c8b-8598-66727c6d4431", "comment": "Malware payload (DarkCloud)", "value": "a711c679beea1c939b00157eb9588657a27fb5cc", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108793, "uuid": "95e1e658-82ed-44a8-9d88-631e223f6442", "comment": "Malware payload (DarkCloud)", "value": "3da8e0f7db1ab34e9c8eb2bf4908b754a9c630d638ee237a74d426e558dd2f63240e9e2d4661d8c909f354bec975f9c6", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108793, "uuid": "8d94d6d0-dce1-44da-b2c3-5c179164b538", "value": "T1D2C54CEA86B144479FA553A046323C2DCC4A06A59563EE9E7F49908DDCE038F21FCE77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108793, "uuid": "f1075cec-678b-45af-8835-d98316f787d3", "value": "192:1k8k7k8k7k8k7k8k7k8k7k8k7k8k7k8k7k8k7k8k7k8k7k8k7k8k7k8k7k8k7k8G:mP3W6Me78QD4Dgxu9gKd8Ug52p5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108793, "uuid": "050943c0-1be2-423b-9a55-fdccadd7ea6b", "value": 2671992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108793, "uuid": "7f479f77-a5f3-4316-96a2-14bad8226840", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108793, "uuid": "c574c7b2-5372-482b-a12a-0a660db2c28e", "value": "Swift 11129120002918-11298-09-06-2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "197f6102-64a4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781079139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079139, "uuid": "162547f6-48ef-440b-a15a-724bbd919664", "comment": "Malware payload", "value": "09a64e98a5e5377f7a80cd7c721848ef", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079139, "uuid": "32528ec3-124a-4006-b87f-f8f8e1c513e8", "comment": "Malware payload", "value": "d9e81e2cdf506b91b4a77ab79bd1357f73a5148598c70d0980615dd286396d9b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079139, "uuid": "06996466-2f30-4b2c-aae4-907d75d8e4fe", "comment": "Malware payload", "value": "3eafff69da56a9dd43f9b1bfe8ed6acde89ce0ce", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079139, "uuid": "5d2a768a-5ebb-405b-be07-c6b1fb9aa5c9", "comment": "Malware payload", "value": "f680a95b9c63b51df39749c8abaa9d719f7d72f0cfc777df809a9171d1d0b121dbfab6c9baa9bb743ec0bff564207e06", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079139, "uuid": "ec9631fb-32a4-4502-bdd3-1ee716a05af6", "value": "T16EF4F73ECD14412EE472DA19C8AA056FF482069B222CE90750D72B9F6FB3542B7D735D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079139, "uuid": "cc58d69c-9124-4f7c-a29d-ffae2479ccd1", "value": "3072:FnwQhGw/2XytyNiPRm7sgrlLMKQ/oZC9RRcmY/zPJqEfjXz8Vfn10LQ6Tm+jruAz:3hoomogL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079139, "uuid": "1209d5dd-ee4b-4933-a2ea-201bfb0444fa", "value": 782338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079139, "uuid": "9232c66b-7ae8-4acc-87b5-7304a7de6f19", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079139, "uuid": "384c9ad7-950f-4b60-b212-1fd29c5f9bb1", "value": "confirmar cotizaci\u00f3n.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53c66ab-6491-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781071213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071213, "uuid": "44867ea8-6e64-4810-a969-eab427eb2362", "comment": "Malware payload", "value": "c52cc42e54ec9f57b896311820ac3bd2", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071213, "uuid": "ddcca6f7-1ad2-4053-9de0-1f97ef97649d", "comment": "Malware payload", "value": "da1e5edf066812fcfb40ca00a594d04f9499e33a1fcb6959b86f0e6871370302", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071213, "uuid": "90632d7b-db3c-46e7-b205-a2135842569c", "comment": "Malware payload", "value": "c47085409891d346f610fb9ceff14e3b30611c58", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071213, "uuid": "0e5ecdb0-811e-4cfb-ba3f-8c35184d4ea8", "comment": "Malware payload", "value": "e1ce6dc7696af2d00d12c92b1bdc0fb55e4f901d71e564746a7905bb658bcdcb68d70d2988f28f60d0df4ac473f127f5", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071213, "uuid": "9f6b7f2c-173e-4920-9c71-6fb23bcf98e3", "value": "T1A1450CA2DEB7DE3ECB798F314AE68205A7745C52C331CB07A5853139BAD9E20BD450C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071213, "uuid": "c3e252c5-dc8f-40e7-b95e-d745e9650a9f", "value": "12288:MDylH4wSo9A8EVZau7yLLw6OrB77DylH4wSo9A8EVZau7yTLw6OrB7/d:b+w/EcIdB7y+w3EcwdB7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781071213, "uuid": "b4d82ad8-f9ff-4d53-8c08-c46354a1ab9f", "value": 1179136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781071213, "uuid": "04b24bfe-f2e6-4f12-9240-6f0d4a729c74", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071213, "uuid": "7b57a93e-69fd-45e9-a757-a7a40a9613cf", "value": "MK FMHSRFQ20260608.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c13d9b-6498-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781074008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074008, "uuid": "89e041a2-4a65-4235-9968-b37c3dccc64c", "comment": "Malware payload (Mirai)", "value": "8146133116d8f12639402171ee7c53c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074008, "uuid": "21b95592-2857-4506-a382-0e9f8cb060ec", "comment": "Malware payload (Mirai)", "value": "da29aa0a57aa427e48e7b27e0b0e03b661b976de66a2952f075cf419a704248b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074008, "uuid": "d88747e5-78c4-4042-98f1-40c49a8a3fda", "comment": "Malware payload (Mirai)", "value": "d8f03e735110b2c10a56479c230c8b64ecff4829", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074008, "uuid": "337c2c03-cd1d-4ff0-9b5c-8d48d941c5ff", "comment": "Malware payload (Mirai)", "value": "c9da8cc2e9d3dd6e00c9e27a2b54072523d0dabaeb67e00a3b74606014dcfddbb04d83162784a37c896c10c1aa77175b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074008, "uuid": "c6da795f-5ed8-480c-8c00-1f26174ecf35", "value": "T1D4E31706FB408B17C4C61B79AA9F53423333DB64E3DB730A99285BB43E8775A4E62505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074008, "uuid": "06ac6554-fd9e-496b-b0a1-fc27151a3c86", "value": "3072:BAl5cb7bmSch70Kj4HxiDT4lRBpfumNUL/KZDyer:BM5o7bmXhwu4HxiDT8RnfuUUL/KBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781074008, "uuid": "807314f8-d524-45fa-9c72-ffe1f90460c2", "value": 156335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781074008, "uuid": "cee02a66-8002-4e6b-980e-4c2212c3b4b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074008, "uuid": "46e142c1-699a-489d-ab33-031e5b4f8016", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "182c3b3d-64cc-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1781096316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096316, "uuid": "4557cc8d-49cc-4e7c-bc78-de50b12a959b", "comment": "Malware payload (AsyncRAT)", "value": "9af6ecf1d2f04e0111d06d096c096c1a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096316, "uuid": "10b7d508-34cd-4f4c-8fe5-daaa4b766d27", "comment": "Malware payload (AsyncRAT)", "value": "da71d94b9dfacf295fec47bc365d5541b118f60c3f489274d51b3bedfb75d2a8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096316, "uuid": "c83ecfc0-6db1-4ef9-8315-23aa4abf4041", "comment": "Malware payload (AsyncRAT)", "value": "99f0c6082addf4c58235ba5f057515fbb71e8ece", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096316, "uuid": "6804eb1d-efb9-469b-9aa8-193a7c1a6c71", "comment": "Malware payload (AsyncRAT)", "value": "d835fadf8797c111a2d69101a0206584c6a3929a356a50c104a0d3a3b00797e76a4c64e1a7a3ca53a666685684995194", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096316, "uuid": "e82321fa-4aa6-4e4c-9dc5-d677f27794a0", "value": "T137858C80E761E06D1A9076A3583BE8EDDB3636F2093738073D76BB7A53D6746CB02191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096316, "uuid": "df5c31b3-940a-403e-b42b-ea5359340ef3", "value": "192:rfbbhU3w7Cog/wtB+y3C4B1vP06djS0gcYVPteNxC4sV5O/ukfC+XWvQ6+oiCQJX:rjdU3oozgoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096316, "uuid": "291249e4-1fda-488e-9003-3fbd45d03799", "value": 1839950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096316, "uuid": "09a56554-0a45-4b04-9dc8-ab8e5acccd7e", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096316, "uuid": "136dad89-9144-4b43-a6c1-06acf8594ee5", "value": "DEKONT.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07698fe0-650c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781123776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781123776, "uuid": "8645ec51-d1ea-49c3-988f-196b3246c873", "comment": "Malware payload (Mirai)", "value": "c02650e4cd3a3c0b0f9e950bdaef8350", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781123776, "uuid": "a94d5277-f29f-4f71-b0c2-60919cc5c5dc", "comment": "Malware payload (Mirai)", "value": "db31d33c4f89802ec63c8dcbb82a8251af7f68623c426e535ccc13a6778d056b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781123776, "uuid": "51a3d1d4-761c-411d-9127-90e9a5103667", "comment": "Malware payload (Mirai)", "value": "0404f731324667c5f58293ac42dd50e72f1c5e7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781123776, "uuid": "1ee72b2b-3322-41c4-b1b8-8b3e424cdfcf", "comment": "Malware payload (Mirai)", "value": "18725a94de213d3903b23329cafe9842b2ffaa2ec9a32e5b179f3869eea54497977c1269bb75bab00a80770e0bdd0b53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781123776, "uuid": "fefc3d95-e443-442a-884b-140128ce05ae", "value": "T1F4258D2EB2B2B1BCD007C03447DBCAB19531B47526322DBB26C5DA353D66DE12369B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781123776, "uuid": "c9b16fc6-61c8-4afd-a36e-584b6dd326d6", "value": "12288:U+KDypixNgIHPUxzbg2dfHku9OlS8ySjn7jzmZ1Czc0ba/poG1FyuJbayqbsDZHX:U+KD6ixNgHtbNQ7vgMzLspoG1FyuOsD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781123776, "uuid": "4f072ea6-23cb-43a7-a8a3-47aea82d33d0", "value": 994616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781123776, "uuid": "9a05778a-2e37-4e23-8e73-5cf301f08a96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781123776, "uuid": "4da612c3-8233-416f-8dd1-913a9848927f", "value": "bot_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf10abf-64e8-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1781108724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108724, "uuid": "c3b54be9-6602-4ba0-8b17-0e5e06a6efd0", "comment": "Malware payload (PhantomStealer)", "value": "c376926e1ed504dbae9a097303c6fc3f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108724, "uuid": "306ba3f1-ee51-4a56-8d10-5b1a930e919d", "comment": "Malware payload (PhantomStealer)", "value": "db42e0587dde8c3a650cc807e957210285a4c8b1cc4bb1e31e0db4855f0c9b12", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108724, "uuid": "bd7cb7dc-f4f2-4f2f-8476-ee1fd7a95bc5", "comment": "Malware payload (PhantomStealer)", "value": "9226496753f86cd656892c0ff2d46b324cbac916", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108724, "uuid": "568d5fbc-2c75-4b29-adb6-26265a8b61ce", "comment": "Malware payload (PhantomStealer)", "value": "c7eb7bee2430aa988dfabcc3760cb622046bbf2b46ebe4bdd338221e8b572a8f2d8bb99d3b6cc322ba689cb9d4091a22", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108724, "uuid": "d88c559b-e2a0-4522-94af-c22dfb5226f3", "value": "T16243D7C932C5B4514713B57F2D36B0E7F16A9C8573584028FAD9F8ACF9A4B18C8366B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108724, "uuid": "9b4f42e6-e6d1-4b7f-8b4b-4e27518c87ae", "value": "768:yirFnf3UX3QDVUk3/CNtX6pcrV7s0K/tpBwBY15cIPJ9DVq6+To5Jp3DS+89:zUHQzq6qVrK/tTwYbPbDVq6+TwJp3y9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108724, "uuid": "56cc4050-c8f5-4345-a423-b29832862134", "value": 55169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108724, "uuid": "d3be6daa-7e65-4895-a311-b141d80b9bf1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108724, "uuid": "09f5f693-1dba-436a-8919-c4a76bae48e7", "value": "SIP. MLM-7703-0108_110_A. T26B330192.xlsx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5864e68-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105653, "uuid": "c02acc21-d348-4c1e-815e-328b499ea6b3", "comment": "Malware payload (Mirai)", "value": "b7ca7f968676a84d86f515113d1badb9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105653, "uuid": "35b2e9b2-0e8b-432a-8af8-abe9dd24eb83", "comment": "Malware payload (Mirai)", "value": "db460d10be3306df9ec885fb5add1625139620e8233d1de6b35a5ef66b978404", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105653, "uuid": "ae1ddae2-1227-40cd-be4d-a71afa19203d", "comment": "Malware payload (Mirai)", "value": "7ed51c3350b81dd9dcb0c9e38504973792fd73fc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105653, "uuid": "5a1a28c4-ccda-44f3-9977-8b6dba3f66da", "comment": "Malware payload (Mirai)", "value": "be83a9479430cf7d0c3e5fc5563dd59f04102bc4ef780291251a4687afab8ffef14d652e1dcaf6dd5a914c78bf44b9be", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105653, "uuid": "b11c1f88-0063-49e7-9ec5-51f9737f7893", "value": "T1D22175CA135025E6092A8EAF7BA24DC8674D41F6FE5A0668DB84C81F516F22C3DA5A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105653, "uuid": "37938165-737d-4c8f-b16e-cbfda39a10ab", "value": "12:YmpeXp9UlNiplNNIhdhpsKLKX/Xpbsc/pcJoIpoEqKONipKONeZj/dpKi+prpZcB:AgwNIHKtyUWCqRHc4Kv9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105653, "uuid": "9c7aedc7-0a79-4c42-995d-c5a31df12e9d", "value": 1441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105653, "uuid": "d11f02d3-3e03-42ea-a686-f0a6854c2f3a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105653, "uuid": "ceca249d-a9d0-4ee2-a2fa-206650326434", "value": "manual.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35fab04e-64a4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781079186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079186, "uuid": "1bbc9788-6685-490a-837b-91a8fb029985", "comment": "Malware payload", "value": "abc7b1b8b150d745035f645f419e6a74", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079186, "uuid": "239625ff-fc5c-4e50-91ad-810758e06d12", "comment": "Malware payload", "value": "db9ad46ce17e53064b5efc56d89ee5842ed5b188b70060f5e2981fc6b81dc828", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079186, "uuid": "c95345a5-3aad-4ed9-a003-1949c6a98b0a", "comment": "Malware payload", "value": "8854e84cae780073b830129845c2187cd2a793a2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079186, "uuid": "49e2ac2a-0878-458b-b9a8-05f68be5838d", "comment": "Malware payload", "value": "337c63f23fd14f6ad873b3db806f6631922b045034328729ad316ec118705bcf3558c67a696c15650774eaa4db5c5030", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079186, "uuid": "cd5b9aaa-9481-412e-a8bf-dfa08696670e", "value": "T197752DE76FB802F5E9C205125B1AA6C1EB227369B5A3918E7647E08324134BDF307D7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079186, "uuid": "deae7dee-a81b-40b4-a0c6-6d434faedee5", "value": "96:Zy3n7n5px2BU2+on1n2eDNXd79omACzkNXebmACbO6Gpl4XvpmACLcpaFglpl4g0:Z93I8uKErHSfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079186, "uuid": "5ee126d6-8cf9-406b-a13d-9b137d597d52", "value": 1607831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079186, "uuid": "a7913061-1652-4ec7-92d2-bb98d8b355c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079186, "uuid": "a04d3497-c01a-451e-990a-7e00250990c7", "value": "Approved Plans and Drawings.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa491592-64a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781080375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080375, "uuid": "0b228dd9-45c0-4d18-9581-e72223e5ca65", "comment": "Malware payload (Formbook)", "value": "2f45cb855b84a42dfe7346453ef59681", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080375, "uuid": "939f17fe-e942-49df-9a84-c74a86296e7d", "comment": "Malware payload (Formbook)", "value": "dbbce171d3da70edae2d9ff83a837f8703effcbcbe172bc8c205d9e9cdeb3c74", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080375, "uuid": "b1cd6f42-6919-4e91-b127-5838967114e3", "comment": "Malware payload (Formbook)", "value": "33368e773d8bc6f1d1343b3d58a2f0aa0e651a1f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080375, "uuid": "6a6f55fe-0f82-4052-9f08-e9372b28fd05", "comment": "Malware payload (Formbook)", "value": "b42bcafb198fbc6300b7802f37cf358e7aeb5f17d0c58d8559e31d796d882ee8d42b5297d9fbd4190ed769658bca87aa", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080375, "uuid": "92f60cdb-ed2b-49e0-9359-36228a5cd32a", "value": "T18AA5375303851BBDF68D0EC9C94B255B20F2D4677D251298EBB36EEBBC3B9849430636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080375, "uuid": "92b7242b-4504-4ad1-8b3a-d775c483f5a3", "value": "1536:oOAcZjOO1K5puEVvw8t97WINGo8wq/PJ5jCzXn5B3hhcTJYJvggP7QwNScHfBwrI:+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781080375, "uuid": "c87a0654-f24c-4539-ac13-8fa1318db0de", "value": 2161636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781080375, "uuid": "d8b65181-7513-4211-8eb2-19bc8babdc3c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080375, "uuid": "e5b82751-ef21-4b74-b76f-a8f2af8d381f", "value": "RFQ;KC&GC L.L.C-100626.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f8d9c7b-64c4-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1781092973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781092973, "uuid": "9dda3308-fee1-49b7-aece-b74fc6d829b4", "comment": "Malware payload (ValleyRAT)", "value": "268abe31fcc654dfd6ea157d08bdf713", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781092973, "uuid": "46c7ee78-4fea-470a-b055-c2993e29e013", "comment": "Malware payload (ValleyRAT)", "value": "dbf418de2f91dd227f9bb4fc7ffb8bb882729037ecb101518f87fd622f227268", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781092973, "uuid": "275395e6-6630-4b6f-a5c3-f4076d6d7eda", "comment": "Malware payload (ValleyRAT)", "value": "330295e5fcac1641a9de63c8606944de6020504a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781092973, "uuid": "025d93eb-384f-4703-a015-4df3bf8506eb", "comment": "Malware payload (ValleyRAT)", "value": "53e38bcf3973f4d66f09d23839a925768fac2a80d176a5d82dd16c74cc93f70291f4cf854dd97f3318bdece189885748", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781092973, "uuid": "4f9a976b-e899-419b-8fa9-72089de54769", "value": "T12EF73321BAB0C0B0FF7679B000A6CF13E978B551932895D357D849B12E3E2E97E7CA54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781092973, "uuid": "e5cb03a1-cbc7-42f1-81ec-850e0e4ce6bd", "value": "4e7ce0c2d4e287e33f0a421844d1f889", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781092973, "uuid": "f3cad26f-2614-435c-835c-16c420aaecad", "value": "1572864:s12t5TxeuCm6s066s0g1FZ5R8ffZea2Ujcz1Oj2:s12t5TxEbH6FZ5RueUjcz1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781092973, "uuid": "80967c4d-0117-4e8f-8d35-386cc2713b7e", "value": 72014145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781092973, "uuid": "e6205427-9fd4-43bd-900f-9ebf22d7b5c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781092973, "uuid": "b71234bd-2925-448b-92ac-c4cf563780c9", "value": "TencentMeeting_x86_64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0002d442-64b4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781085968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085968, "uuid": "70ae3378-c236-44e2-88cb-f48fda83e862", "comment": "Malware payload", "value": "d669a9360bc861a575f9248ab9d25c22", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085968, "uuid": "4cdbf90c-9125-447f-8573-df0fc94d3491", "comment": "Malware payload", "value": "dc45c5cf8f0d9fad63c6569f2a5b8acc1032283bbd8c1137bada8b026ebbe395", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085968, "uuid": "466fa76a-58ad-4d88-a989-7094e6e8466c", "comment": "Malware payload", "value": "60ef52923f17f3b16e5c48a78c7143579119bc5d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085968, "uuid": "ce7caff3-d9ab-4c62-9830-9ac5b3e5ef40", "comment": "Malware payload", "value": "03d33ed81c89f4b1df579a8a88ef1e6fe5b79e7d4401e1f02a707abd2e84deef0ce7af0a9af0c910e969f502656c5075", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085968, "uuid": "e94cfa16-89e4-4da5-8f5f-1a66c63b77fe", "value": "T13ED302C51D63AB41F966577091B34E30474EAFA189E3F359965CEC920FB018F40AAFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085968, "uuid": "a51a9e8b-7dd3-4f6b-869e-4a959033cd08", "value": "3072:Ri1XA0nbb7Swxrjk1RMJsFN0wA6V9RbOF8k2JoRj+OW3nPH74KR3c:RUXTnpeMSFmz6VXFV7zPHTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781085968, "uuid": "ae1d5f1b-99fd-486c-a5e6-417c62fb172d", "value": 138500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781085968, "uuid": "e4ad44ce-b30d-4130-85b8-73886f26edc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085968, "uuid": "eb0ef54e-d021-4495-a567-c75adecfdc6a", "value": "kworkerd-netns", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9baa2643-6505-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781121018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121018, "uuid": "185bbbd4-5d94-48d1-ba72-bb91edfad21b", "comment": "Malware payload", "value": "4a5d0b5e9692a11ed04afc2cc8a810e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121018, "uuid": "a78ef468-730c-40c0-b131-68c33f7e57de", "comment": "Malware payload", "value": "dce8bdb8e65cbc5ba20c974fa2ba09257f4c5a0124a1a0a9766ba963ebafc332", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121018, "uuid": "7db73a25-7cd0-4ff1-aa07-9e68d7b6440a", "comment": "Malware payload", "value": "50633b8e2033601a8504acbf342b25bc32a219b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121018, "uuid": "dfd0ad91-7db7-4f7b-9931-e9d7a7c44669", "comment": "Malware payload", "value": "a15d747e4f32e940eeb711e4b9523530890cb7d0fe0e6f6d763fdc7b47df2f98d112b978ee82c86e2155875d79d86113", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781121018, "uuid": "2a5a7dc7-2dfb-45f0-b418-b8339acffdb5", "value": "T1C414744E6E328F6DF668C73047B74A25976D23DA26E1D684D1ACC1002F2439E645FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781121018, "uuid": "fa7c076c-ea9e-474c-a296-49c23e738907", "value": "3072:DiCjIwpEsq1HK3ayIfr9rVJxs2LUiPmkOucHxq/bm:uCjIwdv38mmLPkXHM/bm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781121018, "uuid": "af2e1417-8861-4fd4-96cc-5f98b965c049", "value": 202632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781121018, "uuid": "ff974ee5-58d2-4dc1-85f2-587d4ee4b636", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781121018, "uuid": "8a24b884-6704-4f71-8b0f-9b832b8446a3", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "198ab7f6-6474-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781058523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058523, "uuid": "a5a452a6-d285-4de4-8a86-1e5ff9544cb9", "comment": "Malware payload (Mirai)", "value": "d301ebd68a1c5f8df661fbb606a32b45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058523, "uuid": "a22160ee-4a87-4078-851b-ab06d8d717b2", "comment": "Malware payload (Mirai)", "value": "dd6aaedc20ab70fbc526ec70d9255a3af55d361dbcb3f200b938680736ec2330", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058523, "uuid": "8ded3726-359d-4756-9c84-6f9ccc2d525d", "comment": "Malware payload (Mirai)", "value": "61aa1e17fa9753b3d6d33409172cdfc4667f7f09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058523, "uuid": "976863f8-2735-4e7b-a46b-5d93692467a6", "comment": "Malware payload (Mirai)", "value": "4400ff9df3a30c6ba840fd981dbdcce143fb67c415e2933047f0361ec5a29402c729f2fdaea62feaa92166666052bb9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058523, "uuid": "bdefd9a9-08fb-4508-a03e-99cd03627806", "value": "T1D643F1DB43BA6F70D7E9763C03AC08989B72B40A77135FF7099925B41BB510A25847F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058523, "uuid": "602e17f2-fce7-4289-83fd-13e32bfc7d84", "value": "768:GA1gWPNgDowwtBHz+vUuUbeCCbQlQxr6VPh6G5hXoi5JYJbv1OVTihhb+O6:7PNgsivUpJlQ9WYehXoiIq+nt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781058523, "uuid": "33106ed9-f6ff-4b38-8536-9bec3401325e", "value": 59556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781058523, "uuid": "9ca43d8d-4bfe-42db-b467-babe6fba17bf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058523, "uuid": "fd7a48fd-a850-4efd-a92a-f41469e3a56c", "value": "wife.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc9ad740-64fb-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1781116805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781116805, "uuid": "36495ce2-f394-4820-b31d-f355a3de8ec0", "comment": "Malware payload (njrat)", "value": "2caef0f5e7bfe02d0cb4fe06a8aa83ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781116805, "uuid": "f788e557-5dfe-43bf-ba98-461381c6ef30", "comment": "Malware payload (njrat)", "value": "dd93fbccfaf0441c1bfb0c43cdae16b4b594fdcb20e23e683f04cd238753bcbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781116805, "uuid": "3e65f22f-6419-4e6f-b188-f5baa87d670d", "comment": "Malware payload (njrat)", "value": "5cf30b2adad31e5d05fd85cc82777f059aac7cc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781116805, "uuid": "f96fd22b-7d1d-4048-975d-43dda022bd14", "comment": "Malware payload (njrat)", "value": "cea3a756f9827671d1d01cb8b616a1b6fd1f197e903074ed9fe49e1ecf46421d9da6baa624bd639af08788ec928671f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781116805, "uuid": "2c571db2-6851-4009-9ee2-9e9377347cac", "value": "T1AD733B4877F54A12D1BF0DB5897292221B36FC036926F76D09D174AA5FB36C08A09FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781116805, "uuid": "3b0649b7-2152-4a8d-9ebf-1371385d420a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781116805, "uuid": "f784f76b-9f7a-458f-a832-f481e19b9fe8", "value": "1536:bRT+tGL5UbDp72S5wpOk3JCK6pFooDs6fOpd/9nEh9TGMJUR:rU12QwpOk5CK6RO/9ESMJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781116805, "uuid": "446a720f-e2b0-474e-a3e2-481674f4fab4", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781116805, "uuid": "542e3b54-9181-4c32-a438-78eabc89f83b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781116805, "uuid": "9a256316-e0cc-4da8-af13-390a294abe86", "value": "DestraVisualsRefferal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecea7f44-6511-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781126308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126308, "uuid": "ad839f58-f4d6-4694-b8ef-a78bec61e462", "comment": "Malware payload (Mirai)", "value": "c788d902c1df7babe05c66d2e57e51a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126308, "uuid": "a70049aa-25d2-4998-9307-54321a5205da", "comment": "Malware payload (Mirai)", "value": "ddcb296536820a17f7303abb266a7c88a64cf75968afcdb9511868ccf384a780", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126308, "uuid": "4bff60c3-f737-4cf3-9fd1-a6e96f8fe4f5", "comment": "Malware payload (Mirai)", "value": "6089e0b59ba1fa03a8272385966119e178001312", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126308, "uuid": "bd712439-c44e-492b-ab0b-284431d9481c", "comment": "Malware payload (Mirai)", "value": "617db9db71b90e59e4a3569cef5dac7bd8203f6d12c08fb58757f8ad59cff6e96202e536a6d0c6addf86f4a74dd77f4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126308, "uuid": "4f5a3baa-4fa0-400f-9791-68f014f83d99", "value": "T106433CD5F801AD3DF957EAFE44624A0DBA21721150A30B2BA36BFDC37C332A44E16D91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126308, "uuid": "3c28f31c-ad17-4227-9729-de623e639204", "value": "1536:bFyTOn7IOlZFM2x+qEbYbKup7X6Y3fG8ce:bFwT2xJEM/gYPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781126308, "uuid": "3c7915d1-66b5-417c-97d5-219f0a0695c0", "value": 57244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781126308, "uuid": "b0ce84d1-ede0-4a1c-89c7-303e53769eb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126308, "uuid": "c087b428-8dd9-4d8a-8355-c8ce5360cef0", "value": "kwari.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "146ead29-6494-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781072258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072258, "uuid": "3cb16e1e-8896-4ffe-bb25-4a133da2b66d", "comment": "Malware payload (ConnectWise)", "value": "f2dc82f79345db0581fbb29ce7501c63", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072258, "uuid": "af6f7770-9894-43f0-aaf5-49ba67954fdf", "comment": "Malware payload (ConnectWise)", "value": "de03e28b257b0010830be884f5a13952031bed2cdda2f211ac5326050d7634d0", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072258, "uuid": "94ac549a-c7e0-4b87-94e0-297d88e451f9", "comment": "Malware payload (ConnectWise)", "value": "3517f004f71f7c47de6b81b670d5b93841d55d08", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072258, "uuid": "bd251667-7f39-4f1c-9eca-ff849de5abc9", "comment": "Malware payload (ConnectWise)", "value": "54fdd758389a2fc53884fad84617a04d3fee6adbca82ad8eace91570caba454390bf0998beadf5003bc95e18d92d9090", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072258, "uuid": "f046f3ea-2193-423b-953f-97629a382628", "value": "T1F446E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072258, "uuid": "e4300631-47e0-43d6-b0e4-877fef1484d0", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072258, "uuid": "a1e8d94b-73ca-4322-b929-9424b92a96da", "value": "98304:hzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:hhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072258, "uuid": "13f4486d-9b15-41de-bd04-a5e39aa578b8", "value": 5643272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072258, "uuid": "6f2dc6e8-19cc-49a4-8108-adf1b46b3401", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072258, "uuid": "f6109b48-79fd-4576-89ad-139d2b7025c1", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2fd86a6-64b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781084550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084550, "uuid": "b9472d11-61c3-4015-ae39-d2366512c73b", "comment": "Malware payload", "value": "e7551479b66dec2ff5237335d9aa9bbb", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084550, "uuid": "1839bf27-6c79-4c63-a186-194e9a2441b0", "comment": "Malware payload", "value": "dec8dc49fc34fe5898e452a1dd98b98d6a8704d55458982b3b7af05bf52016ca", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084550, "uuid": "b55bf77d-91e0-4401-8792-61a0e6ebd198", "comment": "Malware payload", "value": "cbdb9b57d166666ef2b0e25be47f576aa3c98f70", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781084550, "uuid": "b04a5908-794f-4996-a231-f992f1c6bd8d", "comment": "Malware payload", "value": "befb651c0939054f29629bda9c6ab6b67b49fa9b2a342b5dd7c9af1c38d5790003358baa5fe9e61d0d3b51c66be627ce", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084550, "uuid": "a69d210a-96c8-4ecc-8bc4-dc00e3fb5e5b", "value": "T1A271A74676AD0766D071B73CACC5BE7057D97C0210AB8A362464DD8D3CD7190B864B3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084550, "uuid": "fb98987f-7fc1-4262-a037-fc24e7985863", "value": "96:8VgoUt/8mrSJ3Ebe11i3L7EoLTtE+6uVpUtIv:8aSJUW1if6+6uVpU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781084550, "uuid": "456357e2-3447-47c8-a3be-9fe4c17a4198", "value": 3487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781084550, "uuid": "244a3da2-dbe4-48b2-aace-5d90497e4c10", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781084550, "uuid": "1b6109d3-895d-4f59-8ad2-72a763363cd0", "value": "masterpdf.com_cv_nguyen_van_thinh.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "257a5f91-64a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781080018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080018, "uuid": "77c949e7-e33e-46e5-ac71-976acdcbe449", "comment": "Malware payload (Formbook)", "value": "afe3f5ca54cdddef877c63e08f9a9b1f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080018, "uuid": "c5284086-d5ea-4217-a4de-825fb4ae9e2a", "comment": "Malware payload (Formbook)", "value": "dece042526daa8eabbffdfc46effc6bbf6fbd1dd6c93aaba5bb4bf308c3c6e97", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080018, "uuid": "d9596616-8d34-4b82-a8fc-63fe6e40cf32", "comment": "Malware payload (Formbook)", "value": "96e3f8893f5364e5225551ab62553b98b2d52912", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080018, "uuid": "39c45d3a-5419-4cd6-baf1-3f041c1353c1", "comment": "Malware payload (Formbook)", "value": "3f89fab1b46a266283a09571dee8bb9f37d5d64ab2f69f3809eaf0305c7bd372dd4298f16897b5240d0d57731d40f1dc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080018, "uuid": "bd5ecab7-b418-46ef-a099-b0ed21218c83", "value": "T16494BC3CEDFA402AB173EE198AD47597E95FBA63371E981910D203864713942FDD223E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080018, "uuid": "99deb46d-2cb9-47cf-8c37-32f1aeef998d", "value": "12288:stXfQLvjQQZT90nQzbq+jzSHQ2qvdMQoc9E:zhPK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781080018, "uuid": "9f47e610-d288-4a0a-92ff-40071cbf1d8c", "value": 409264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781080018, "uuid": "8b9aa0f2-570a-4300-87ef-b7a688db57a5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080018, "uuid": "83d5b0aa-3563-4655-8e5f-f5127dcde6c7", "value": "INVOICE-PAYMENT ADVICE.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1bc9142-64f9-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781115874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781115874, "uuid": "5213d382-4b42-40e6-8edc-05e3bdf690e2", "comment": "Malware payload (CoinMiner)", "value": "c06b75a0a9c8db87802a01332b7aff77", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781115874, "uuid": "059af75a-8424-4f37-a6ff-fe0e9d0f029a", "comment": "Malware payload (CoinMiner)", "value": "defadd2c760d72241fd031116864d2aa0a3d9318e815db8a5b925769383b46fd", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781115874, "uuid": "6b01c6fa-2642-4f86-a1f1-6fe43e182589", "comment": "Malware payload (CoinMiner)", "value": "209fc17e45c65bfbfb54884dee537470ad5a2720", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781115874, "uuid": "d0ef5b35-0085-478a-ae8d-563b332288f5", "comment": "Malware payload (CoinMiner)", "value": "53677d0444b00c5d38c1b947728383e66bbe8f13f4e788028c9a4c8afffd4eea555ea4be84131d7908352868cf500c8d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781115874, "uuid": "c0583367-4348-4f48-994e-6dfdce0e6f53", "value": "T1D2322A1D7E450332E3A089F81879824F517C6223E797E3EFF7339A4A5A963458840DAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781115874, "uuid": "35db595e-e055-4b83-bb77-638a735ef121", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781115874, "uuid": "b7956f29-384b-445e-917a-8374396077c4", "value": "192:x94so2WX9TBjx+ezysVQPFJxTEZmFhS2cVRpE:xRot9FwOSPFwZfpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781115874, "uuid": "dea45a9b-0dbc-4f96-97b4-becd7ef6579d", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781115874, "uuid": "b989109a-a09b-4a5d-ac1a-7222c0d08e5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781115874, "uuid": "e559c359-b313-4b81-a7b2-e15c25848b75", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde06f68-64b3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781085964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085964, "uuid": "fa080aa1-2a6b-4ef5-8307-121a9e81b1c2", "comment": "Malware payload (Gafgyt)", "value": "2486255c8b858bd0ff80b6e63278a346", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085964, "uuid": "b905ef23-44e2-43e3-8f65-6888c3eae97a", "comment": "Malware payload (Gafgyt)", "value": "df35ef64e2597eac8ca496beea82ceb595474ce5fcd02613efbf607607132328", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085964, "uuid": "5518df33-788c-4893-8e8c-17477fd73991", "comment": "Malware payload (Gafgyt)", "value": "a66c990e2acaad39c6a7eb797345f7b75819be94", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085964, "uuid": "539c736d-8fcf-4198-ba30-2e84e8423a30", "comment": "Malware payload (Gafgyt)", "value": "f1919af46cec52f00c28a50e0f867db212ec0bc1a778cc3a463673d4e964f083353844cd123a1dc32d29700532b25c36", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085964, "uuid": "af67cf59-3d2e-459f-8d92-2215b5dbf6d2", "value": "T145543C036580D5FAC087D0B6CBDFA2274A61783D593A724B27A07F663E5ADF05B19B03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085964, "uuid": "1cb0bd8e-dc16-4117-833e-c3c8d4c6889c", "value": "6144:vEJlRe7/YxDLBvkbPc2WoKAUMNNOXH6NgY:8J/e7w5SbPc2WPZMN5NgY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781085964, "uuid": "52590364-2c45-4fb6-bccf-18dc40b411c6", "value": 292968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781085964, "uuid": "7ee66493-fb42-40ce-afdb-58079dc704e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085964, "uuid": "4c205d4a-5fe0-4ec6-b720-6e7db38db275", "value": "kworkerd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e7b6a8-646c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781055059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781055059, "uuid": "b7e89753-74c0-4f67-a299-748904f3bac7", "comment": "Malware payload", "value": "667354076e52221be1f3e58e42b39324", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781055059, "uuid": "ff5fbf01-a7c3-40ce-8cc2-e773231ceeda", "comment": "Malware payload", "value": "df46713c459edb811814c12babe940b480e945a9a0ab4906d165301bcf70c6cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781055059, "uuid": "a5b5e205-f030-43e6-a7a2-ffe8227e2246", "comment": "Malware payload", "value": "8c4127088079e3689cc3c58b6f053bdd8c77f86f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781055059, "uuid": "6b90a138-013b-405e-aa87-ad03e7bf96b8", "comment": "Malware payload", "value": "9fad2412afa8c2c8450bc3d518a77d05a5541dc235fea5bf648c715be944628dbd9503d7786cdefad1248d253b53f9ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781055059, "uuid": "c60dd5b5-50ec-438c-90d0-827582389215", "value": "T1EC57CF7792067CEDE9B94DB4C41015816DA878874778E3C7BAC8B0E666EB6D08D3E730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781055059, "uuid": "9a53fed7-66b1-45e9-9830-26d50569c352", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQu:cqYUQuVDt0TZEAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781055059, "uuid": "8a13386f-11a1-4337-b38e-9dfea049becb", "value": 29491200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781055059, "uuid": "dc378836-eca6-4ee7-856a-1e88a91c25aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781055059, "uuid": "845b9874-eeb9-4996-b3b9-bb2f224987eb", "value": "df46713c459edb811814c12babe940b480e945a9a0ab4906d165301bcf70c6cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f23de6-6468-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781053331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781053331, "uuid": "a33e33b6-f4e6-4e92-8314-3d529b748450", "comment": "Malware payload", "value": "3f23e6b16120e717d485d3f4932cb495", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781053331, "uuid": "3422d93a-cb5f-43dd-9abf-d14098e7dc28", "comment": "Malware payload", "value": "dfcc7e51de3679d12f6d16464cd4e1d73734957f67fce02abe8d8ce1ff332b87", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781053331, "uuid": "a3a66ee5-a251-4344-a1d1-b720ed9b3460", "comment": "Malware payload", "value": "399b7886486f6c14baa4f5d5c42a43f6801ace9e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781053331, "uuid": "b540c1c9-36f7-40dc-bdb6-e623bd6f1a54", "comment": "Malware payload", "value": "443a619e8579c579f0ca87b09e5201ebb3f4aa4248ae2d74d6f36ff70fd6c504e1dca9e918ddc7868762f56ba3b91a81", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781053331, "uuid": "c8874bca-b1a7-49ce-b58d-8ae6e855ed43", "value": "T14801CEDAC113CB604189E89E63DB21807421C3CB66464FFC7F9C443EBBAC6587026F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781053331, "uuid": "512f37bc-6a65-4c17-bcd4-9c6935e04238", "value": "24:kXCKysE2hi0ziQvZohaeymVSNo4N+FztkDL7:e9Qp+Mseymj4szGL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781053331, "uuid": "aea3dcfd-d8d4-42c8-874f-308ad5c11521", "value": 834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781053331, "uuid": "ecc58c13-352d-45ca-b4c7-6cbacc7d098e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781053331, "uuid": "713a9105-a978-4aed-8032-f54f1b1101a0", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d35269d8-650f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781125406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781125406, "uuid": "487e0748-0923-46eb-9310-0f653c9b882f", "comment": "Malware payload", "value": "30781388da0f7d794f192d537c9ce465", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781125406, "uuid": "9ddbd61b-11bb-4303-9491-7da16c1b08a3", "comment": "Malware payload", "value": "e00e62d6c018a22e338151525a5dd34ea2d34949834b594df1c9ddfe08cd6b05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781125406, "uuid": "b87d1175-e779-462e-9107-9e81a1d8b1f1", "comment": "Malware payload", "value": "3701aace1a7f9db0c4768bc9f23e514f85a6c924", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781125406, "uuid": "9ae02f25-c1ff-485b-af0c-979766def9ff", "comment": "Malware payload", "value": "28fee27fe50537ae9de80f796bc3677db01fdbbfd48ffb9c78463a1199fc1d863f26d764ee36fd99700dd7be64e83c17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781125406, "uuid": "8c8b4365-90b4-4049-95be-293efac44fda", "value": "T1E6220704BBE98331E8BE8B78487393151677FA069923CB9D9CCC118E5C737509C82BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781125406, "uuid": "5c9ed100-b4f4-4a4b-af4e-fd070f608921", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781125406, "uuid": "127d851d-090c-4451-9229-47deefecefaf", "value": "192:LmPlT5a/6Rt3SzwMEk2LYZw6AaOaC9AHOnuy2K1:kw6Dic3k2sZwfaOaC9AGuyv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781125406, "uuid": "ff3a4022-9643-41b9-9d99-2973583eb90d", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781125406, "uuid": "34515c8b-c067-40ff-9262-6f27808d1065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781125406, "uuid": "0d9371b4-979d-419b-8b33-a6b62990d8d8", "value": "rMarinaLauraAl__ciaRocha.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "188bab40-64d5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781100182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100182, "uuid": "e51791bb-0485-49e9-8497-37216f09aed8", "comment": "Malware payload (Mirai)", "value": "86ba60a31e81fea09c5214012b435424", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100182, "uuid": "e62bc64e-28f5-4180-a427-6c6e9dd8c93a", "comment": "Malware payload (Mirai)", "value": "e0484798209e9e9e68b7ee9a22bce6b17d7d7d00cc1aa55b9f4402f4c11bc2e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100182, "uuid": "22dc025f-1062-4a39-aa6a-6e95b9cf0726", "comment": "Malware payload (Mirai)", "value": "f7b0c9644804e99890c0ba5a627f2a0d06f0ebab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100182, "uuid": "444a1d16-71b5-41ee-843d-fbf92140799b", "comment": "Malware payload (Mirai)", "value": "13456fab4bcbb0f71d93db8f38de5f58897b217889fb469426abc16f5505a7ecede11cf60d57ff295e2895de82bbbaa4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100182, "uuid": "1f471159-5110-4d08-a787-c9487b9af05e", "value": "T17C934D47FD819A12D6C4177BFB2E428D372653A8D2EA3203DE299F2173C791A0E7B451", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100182, "uuid": "6ede72f1-56a8-4774-addc-66156bafe2cb", "value": "1536:NI0bUn2hNV4f33+CPZVI0UvfFjWV8ZZT74eInvIphl:NI0Phr4fH+AVlefFjLZ9e+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781100182, "uuid": "dd47c78c-fece-42a0-a2c3-ab06b4fbacde", "value": 91272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781100182, "uuid": "7e0de7bb-a8e1-48ca-8748-6e85700f9a36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100182, "uuid": "bb9ecff6-68e3-4d21-8302-1a73d010b100", "value": "simjxtksv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e07886-6475-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781059329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059329, "uuid": "45e9a791-713a-403d-a74c-21fd3783dab1", "comment": "Malware payload", "value": "d29dcfbc5fcaeeb61b66042c45b23f85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059329, "uuid": "259ea4c9-bdf0-4f1c-81d9-65ada3e3e238", "comment": "Malware payload", "value": "e0d483a2430af210d28251708e3fa7cdae92ae9c73161ddb321452e7b70a55d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059329, "uuid": "d39f333b-99a7-4ef5-a477-d752312314a8", "comment": "Malware payload", "value": "a1704d7fc5b3eaa48f0ace4ac81a1319fb9a59d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059329, "uuid": "61159670-0e6b-4ff9-a12d-78eb98f93616", "comment": "Malware payload", "value": "46c54cae9cbca33fc13bbc3c26428cf4677140cf2936a684ddc76a6d1884c18d7a21dae9853e5f4cf59ce722a0d62b8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059329, "uuid": "b0a3be26-1e45-4830-a9c8-d42240562109", "value": "T16F14B70AAF510EFBDC6FDD3706A9070239CCA45722A53B753678D528B54AD0F89E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059329, "uuid": "0c4580b7-19b3-421f-bb94-2120a7e2d5e7", "value": "1536:rGnTctHnbptKNoJpGXy6whJCkEtNxbDs3F4IDS57Q4RcIdbxj8ZxapZeziQcJ4FD:rsAFnb3KEfEWVz76ezHFTbDCGJKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781059329, "uuid": "3324e73c-4f79-448f-b9b6-0f88d502969e", "value": 201956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781059329, "uuid": "363ea903-e63c-43c9-b4c0-91c7cb81ce78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059329, "uuid": "20cac083-47c8-4fc8-b417-242d1ec1e8fa", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414bac64-64a4-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1781079205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079205, "uuid": "41b697f9-08b3-4737-9900-63a90ac806ce", "comment": "Malware payload (GuLoader)", "value": "93fc57beb0f509897200ba615598b135", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079205, "uuid": "0ad75892-56b3-47bc-b977-8349e6cc53b0", "comment": "Malware payload (GuLoader)", "value": "e10c0cb276ef50967311cce82419109b4cdf80733d36d4744b7c69eaad99cd65", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079205, "uuid": "6a361518-c363-4bd7-ad3a-415c18f114fe", "comment": "Malware payload (GuLoader)", "value": "350bbaf01f3007dd8d7d0230b1ac176bcd91f130", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079205, "uuid": "c6bab48a-d5fa-4c82-8f6e-06f8de88128a", "comment": "Malware payload (GuLoader)", "value": "a9c60e90256c1556a5911dab11497532f9ef32d54f8a54edb3cab2d77e71c5fa0c4e5836606130be9ed309bddad4a7e0", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079205, "uuid": "7c52c845-72d6-443f-b377-d7844c4016a4", "value": "T14EE30764C95101764F92BB4DBCAA0A20CAAEC319857755B0F7CE871DD0099FCF3B927A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079205, "uuid": "f32287d4-4c48-45b0-9763-be337c4a2623", "value": "3072:Fo9dT+5HOxFh7n+/DXJfjJ/pkFOs5eEztJfdYfj4ccpaIc5Uu0HpP1MtHS:+ikRbYd/6Dz/OUc4aIAUu0HpCtS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079205, "uuid": "96e2d35e-449b-4b9d-a7f7-3cfe0324438d", "value": 149350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079205, "uuid": "b3f9fcee-1d6c-45ca-9816-103de7842f71", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079205, "uuid": "94b7e16c-4f31-4847-9dfc-330fa1933e40", "value": "document_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb12d63-64a6-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781080115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080115, "uuid": "21c1bfff-2fb5-4e07-ad2c-90f2bae20c4c", "comment": "Malware payload (RemcosRAT)", "value": "c7f5f80b18d583897b7aa3203d1bc35c", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080115, "uuid": "3b429200-8ede-431a-91a6-e1961c06d1bb", "comment": "Malware payload (RemcosRAT)", "value": "e11a0f09c359c909dc2467c3c4e24d59a2b506188357bfdc3a5dd991a326cb1a", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080115, "uuid": "1762ae08-e6ef-4cec-95ec-3340d4623400", "comment": "Malware payload (RemcosRAT)", "value": "770fec6a3feab6c38fd05e95380229db8802772f", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080115, "uuid": "8cd3ae44-ed2c-4acc-aa7e-39ad31a58109", "comment": "Malware payload (RemcosRAT)", "value": "9ef2b3ad5453d7cb7fb80890ff85547953bcd248f8a4af8cafc8ecaafb8efe2e643f26b6c00cec92bc4b3f89c410150d", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080115, "uuid": "ed10d7d7-926f-40c8-8daf-21289d8bece7", "value": "T1C8A23E659F8A0792F947277EFC803A586BA8EFE0413185C4F9A47714E10E4787F29D8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080115, "uuid": "290c18e0-2626-4ca3-8cd7-e15fabc2d889", "value": "384:cR2pUzC2j0Ht9tAL3v6Xp4JXqkG4rpJ5+HwYO/:cY8B0E5dqP4rAwP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781080115, "uuid": "29caffc5-d05a-4039-83f1-4b0797ae4080", "value": 21324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781080115, "uuid": "a43a7215-095c-4dd9-bfca-fc75188fd31e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080115, "uuid": "02905f58-622b-4156-8f39-f423c30a4b92", "value": "PO # 0222PO-DPS2V_TONG HONG.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3622d324-6474-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781058571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058571, "uuid": "bef7ecff-683e-495f-a92b-aeb783199037", "comment": "Malware payload (Mirai)", "value": "9fc7451875d37a429df657ccaf6beacb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058571, "uuid": "d4bbbf62-3071-495b-adaa-fe6936472ddc", "comment": "Malware payload (Mirai)", "value": "e20066ad12275c6255a1c94bbe1f7160e3afdf6fa60ca5dc24c2c07854549557", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058571, "uuid": "f69e3b8b-5215-4f21-bc6b-1b30da6a7259", "comment": "Malware payload (Mirai)", "value": "5344cc971bb94939fbbb9ef548d7b36c207ca5a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058571, "uuid": "477b8db9-beeb-4d36-b6d0-cc7682f57587", "comment": "Malware payload (Mirai)", "value": "c800df35e87f40b0ad7992811fdefa03b74c08d863addcc3e728b38475a42d6cdfdf489cb327865c4d598e506c889a24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058571, "uuid": "dbb1f0bd-960d-415b-b94e-94bcbdb8170f", "value": "T120C33A06B26280FDC59BC5B0C79B9272FA35BC4613117EAF27D56B702E32F3527096A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058571, "uuid": "2d0c5935-79ba-4101-8d66-ea51bbc00030", "value": "1536:K+AcuTLZ7g58WHaU4a8bPRsjFy5g5g2nE7zQMwxIf3bKr/UDNku0norL:d60589a+WhSsE7MXI/b3NVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781058571, "uuid": "8419f5fc-7c84-4c14-b11a-8d4e90fac112", "value": 121440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781058571, "uuid": "1d8cacae-03d9-4586-8e0b-c35a4f9bc05e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058571, "uuid": "d2fb03ec-3491-4d45-98a6-1b63b6af7ee3", "value": "wife.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3cd773d-64b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Jigsaw)", "timestamp": 1781085088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085088, "uuid": "a80c8b89-c604-41aa-8f75-60b99992edbd", "comment": "Malware payload (Jigsaw)", "value": "410583caef03ef8736d2eb526a75b0e4", "object_relation": "md5", "Tag": [ { "name": "Jigsaw", "colour": "#348701", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085088, "uuid": "e2e5587e-2287-4330-aed9-2c08fdf37274", "comment": "Malware payload (Jigsaw)", "value": "e2e85ffb029036a3449da8f65275ccfb9e77832a6085c5c26d6726dfda47a048", "object_relation": "sha256", "Tag": [ { "name": "Jigsaw", "colour": "#348701", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085088, "uuid": "d4a7d4d6-0391-4fab-8ec5-8ab6538d72ff", "comment": "Malware payload (Jigsaw)", "value": "8f5713b358efb9daeb77a97cfbc19fcdb49aea0b", "object_relation": "sha1", "Tag": [ { "name": "Jigsaw", "colour": "#348701", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085088, "uuid": "21df0a91-ee8a-485a-a565-6f767425e891", "comment": "Malware payload (Jigsaw)", "value": "e70326f2c167a713cd8a461e8985718ff9ac6a8e385cfcda652dc19edf1fbc3d21297c5acc0ed400e859bc1008c9f9e3", "object_relation": "sha3-384", "Tag": [ { "name": "Jigsaw", "colour": "#348701", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085088, "uuid": "9e39df48-32c2-45f7-9ff3-6d6603f8fa65", "value": "T187533928B7F80B16E7FB4FB829B5909407757967FC36D7AC0985108E48DAB408A70F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085088, "uuid": "6900df1b-2ca1-418d-811c-71df92b3e446", "value": "1536:SBKlnHyaHYpPAnIZUY1sIzYi7D10Py7dl:6KlnHcpPAIZUYxYID6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781085088, "uuid": "c0a7cf21-fc6d-4cd7-8497-d690c041e23a", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781085088, "uuid": "b7a04377-a7df-42ce-89e9-f27186de7b55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085088, "uuid": "ebdbcc7f-7dc0-48c4-b5ab-bd4b91821dfc", "value": "2sn7bt.sa.com_12305544_r_firefox-setup.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18aeb4f9-6474-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781058521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058521, "uuid": "c93a59b0-0cbf-4ffb-b523-5e695f69847e", "comment": "Malware payload (Mirai)", "value": "3f10444573cbec9660cb667c8719ee57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058521, "uuid": "7852723e-94ff-4f12-85df-364212472070", "comment": "Malware payload (Mirai)", "value": "e2fcf24df287656df92a8814652e573cba1da89211b017603557ee9e01ec858b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058521, "uuid": "58c0f11a-88df-414e-b1e4-c4aad60e0bc0", "comment": "Malware payload (Mirai)", "value": "181a793570d3628615df9f2a9d15694d4737e223", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781058521, "uuid": "409633d8-22d6-4ef1-af0c-b5987a38280c", "comment": "Malware payload (Mirai)", "value": "1b3359a68a612063449d44b7b118cc8416d2b682c3eafe5694d6a1fed002c0a575eada84f0f7910d7c8300542f84d61d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058521, "uuid": "9cabfd0b-60a0-4033-aa5a-1cb115048e25", "value": "T1B373022E7405EC36C466B530064C97613FAA8BA4DD818C072BA9FDC78C2A53F7DCA5C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058521, "uuid": "7df4a54b-c082-4c6b-958b-79c125f87a07", "value": "1536:h+Pu5aS2xdTaABs0PrHZfPgvFV3NTqLVe+3cq1V8j:cPZSGPHPDZfYTkEtsVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781058521, "uuid": "1e60dc54-2d9b-436a-8ede-d7441324f81b", "value": 76960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781058521, "uuid": "8747d436-023b-4032-9410-4fcd618163fd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781058521, "uuid": "ae5dfd8a-63e5-4977-9145-3f0fccf99716", "value": "wife.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef311706-6511-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781126312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126312, "uuid": "66f8aa4f-b2ec-42f8-a6f5-824d0d66478b", "comment": "Malware payload (Mirai)", "value": "81855f5a6cf56087030ca42966f1a035", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126312, "uuid": "d17eb05e-7a07-4e62-9f6a-eef0f0e4e2b0", "comment": "Malware payload (Mirai)", "value": "e2fd0927ebfb811830610c4cc26bd08066fa94427ed8c3838fc7a5d70724588b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126312, "uuid": "404ae148-4277-4c94-a93e-f2a536529594", "comment": "Malware payload (Mirai)", "value": "be7c0865b43665392c30c6e22184182f718cb678", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126312, "uuid": "a4b21181-4161-40a3-8376-aae9e2ac0239", "comment": "Malware payload (Mirai)", "value": "3b4ad608473ea53394b0a14ddc8dcb18b09895ad6ff4d327cfa8a30fab4a71ff8eece99c892a0064a5d4ccda887f434f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126312, "uuid": "7c011c6d-5b45-4a73-9a74-ce38b28b83ea", "value": "T1D0431845BCD19A12CAE4237AF92E41CD372523E9D1EF7217CC112F10778A82F1EA7A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126312, "uuid": "dc7e4a10-c124-4cb5-a8d9-65612801a149", "value": "1536:D9PcRxxfdqcicMnroYVbJiYOg1DIwwh+1gAL2i0Zec1aRQFO6:DhcRxxHwwEr2itTQFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781126312, "uuid": "00ee4441-4a1f-4ea5-a469-145e09abf45e", "value": 58432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781126312, "uuid": "064b0a95-df77-4848-8df6-963320da98e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126312, "uuid": "0bb5c416-ea35-40e4-a80c-6fbe7b2fa0c4", "value": "kwari.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8708446e-6493-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781072021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072021, "uuid": "4a91c8f4-f3d9-4e60-be46-903504b3c615", "comment": "Malware payload (Gafgyt)", "value": "427af6bbb25f82cb8ce8ba17869b7095", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072021, "uuid": "f930c38a-be45-4155-b089-1864ed3fe3d6", "comment": "Malware payload (Gafgyt)", "value": "e319264473b4f553836dbf243d59251d704d97dd355b5a307c376f0f1ea85dc7", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072021, "uuid": "8ea57380-bad1-4a43-9515-9149f534cf97", "comment": "Malware payload (Gafgyt)", "value": "3d3b86d59237156a6ebb6660300c545e60949143", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072021, "uuid": "5de984aa-6c8f-46db-b6f9-53e4e817802a", "comment": "Malware payload (Gafgyt)", "value": "bed21b4651b8a3cd39514d0578ca4add6c122f9ccaa67d29e42a91809d4013660d258aea08a9c7e6bdf3bded32d60806", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072021, "uuid": "5fc906fd-b39f-41f7-b151-a637d1945b83", "value": "T163A35B03B6D18DFAC08BD1F047DF6A259D32F4FE166371A76394AD902E1CDD12A19E90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072021, "uuid": "0dc32af1-6064-49c0-9ad7-68a7041ebfeb", "value": "3072:9DOntsEyGiQw2g2BkhP9HJkVX/9jJ3vQteQZCV:9DO/XfW2BkTpmBJ3vQtefV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072021, "uuid": "babcfaf1-c865-4428-98a6-f5be14d65e6e", "value": 100216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072021, "uuid": "498aea7a-9e91-42dc-95f6-84d6dc3e33cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072021, "uuid": "b9cac175-5605-45a7-80ab-3aca29538999", "value": "FBI.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3800e198-64d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781099376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099376, "uuid": "e18efaaf-ef8b-4fae-8145-2e586f4e741c", "comment": "Malware payload (Mirai)", "value": "d9be8d396f53317679d8a761c8cec935", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099376, "uuid": "02370c7e-cf65-4924-b794-cb8484722031", "comment": "Malware payload (Mirai)", "value": "e3664bf5aad2fd0a410b5a7be02f246daf66562c92c45ef08deb718f7cc17d67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099376, "uuid": "65a91f1f-5f5d-4c6a-9379-3509e10fabce", "comment": "Malware payload (Mirai)", "value": "1e76c2a99eb274386b028190b5163d1a061d25e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781099376, "uuid": "5a42d348-1c32-45d3-8101-f6ee18a32776", "comment": "Malware payload (Mirai)", "value": "89fd255de20228a4a7e9a70a2e2fcd7d27f4736b49216a2857ffd25ad9795fb2e9d1c97c8b4f31a7a03041d06b97da21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099376, "uuid": "dbdcfe17-97f8-4635-9f58-8ca50fbea3c2", "value": "T16CD33A46E7814B17C0D21779BADF42563333AB94A3DB73069528BBF43F8279A4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099376, "uuid": "bd0659fd-4157-4fd3-abb5-12b2c2fb8951", "value": "3072:SCq5gfvaOEk/HEa1WaRaB+44/Y3uM/9aMl/Vw:4AvaOEk/Hb14BJ4/YeM/9aQtw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781099376, "uuid": "1b96e5ea-6f18-48b5-b941-7670078f76ab", "value": 132631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781099376, "uuid": "f8ca3ed4-ca38-4429-922c-ede638965544", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781099376, "uuid": "78a78572-2e0c-40a5-9ca6-91b723894b20", "value": "CRY.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35b228d-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105677, "uuid": "f0d6007a-2b56-4ef8-8ca9-bba19e3eb86d", "comment": "Malware payload (Mirai)", "value": "a9a6b68a460f8616532cd11536ebed48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105677, "uuid": "6532195a-ce7e-4261-b65e-5a19ba61d91c", "comment": "Malware payload (Mirai)", "value": "e36f12d6d7ff15a7a44b247a295ca6b0fe6255df881f33ab3b82700cc928fbae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105677, "uuid": "aa00ecde-0439-4b1f-83f0-a32eaf199195", "comment": "Malware payload (Mirai)", "value": "7be3de3f8ea54545264772383b78384bb5c5cd19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105677, "uuid": "6b474c47-bdce-4867-983b-4a83f2815142", "comment": "Malware payload (Mirai)", "value": "762d6c5ff5ee5c122f9ab2cf74cd4ca6b714dafb65bc36753da321e57a664f4576be8ac74191548612f2d23d2557f349", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105677, "uuid": "e1f558ad-48fa-42a6-88f5-37ff2b3092f5", "value": "T1A8B2D050814F54F4CD61A031F6ADC88797EE52FCA2F93B23125655B43B9540E3A7C2DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105677, "uuid": "75519790-9932-42e4-b499-c0f5197e5d4d", "value": "384:IoBE5aNSS75BOI+ypZ5vTlYIwcvsdTf5MF1iO+M6bMLn7d2LDAHrvByvV6a+XRO4:4aNSq5sOHpTqncvsdDePi1MDUDAH9kUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105677, "uuid": "3c2c63e8-5fdc-4ba3-92f7-c98f0d08c4bd", "value": 23720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105677, "uuid": "c068f49a-27ce-4580-84d2-a7a9dd37a89a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105677, "uuid": "1a807ecd-0778-4ff9-af66-aa93e5476428", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf27274a-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105643, "uuid": "2452a88a-001d-47b2-b4c4-7dff19f84e8c", "comment": "Malware payload (Mirai)", "value": "b84484d35b20db9183328a9b76d4c9cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105643, "uuid": "ddab2233-99e5-4662-98a9-d310b098a6e4", "comment": "Malware payload (Mirai)", "value": "e3d031806f40f650bf1c24cbfeb0eecdfec572bc4eb7a0b72c7e13723110e175", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105643, "uuid": "4068d3db-c41d-491e-98f0-f7736ea76130", "comment": "Malware payload (Mirai)", "value": "e43abda76c689e29b9fbbb866500150513b0f674", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105643, "uuid": "568194f2-73c0-4d2d-b499-44944c1f8552", "comment": "Malware payload (Mirai)", "value": "991009601b0492f45fe9cfab979771eef66eea710749279e4ca26a28cf1e6bde90239873d828a8821246ae14cd072a97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105643, "uuid": "2dca3af6-1926-41f8-8439-3e67dc014133", "value": "T10B932894B8419B17C6C612BBFA6E428E372623E8E2EB3217D9215F2037CB55F0D77941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105643, "uuid": "844ef145-5742-473f-93b5-f853dd7ca713", "value": "1536:AGvMOjmOItNB8ny3D5wxroRiDkHonyZT3Bf4TD5v0uGupZJKvvs2w:AGUJtkyYEETn0T32TDBf0nsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105643, "uuid": "56369d46-c5ee-49e4-86cc-57ce0dd116ee", "value": 95764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105643, "uuid": "1355c898-216b-419e-baff-ed386a610407", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105643, "uuid": "3ddc7d7a-721d-46b4-87dc-a322e296d0dd", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99818e86-64e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105982, "uuid": "3d550834-a124-4473-91ae-bddf340e9451", "comment": "Malware payload (Mirai)", "value": "9427a5f1c76081a0e1a4968f9232e30c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105982, "uuid": "b403c10d-9a04-4ae8-8f7b-a7f84b2be6d0", "comment": "Malware payload (Mirai)", "value": "e45f684a8c48ead1f29056c95fb8bbc9d02a2b1e0eaad23f874728d3b9d26803", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105982, "uuid": "c324a041-5de5-4728-a313-357a53f01d99", "comment": "Malware payload (Mirai)", "value": "14ff29b665e24791a88bf3f99e40f596018a54ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105982, "uuid": "cf8554b0-7117-46f8-b833-38f99f48ee4c", "comment": "Malware payload (Mirai)", "value": "596612f20f929260be1fc5bc9a53f34d5a6ba98545afda6052b6e9570fcb219ba9f60df87e77b8bd873cc65d8ad91061", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105982, "uuid": "52dc9176-47c7-499b-af3b-34c5814025ac", "value": "T1F1732A26B97A1E26C0D4B57E60FB8B11F6E1278E26B4C50A7D720E5EEF147006502AF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105982, "uuid": "754027bd-5601-419f-9a8a-6fcd79eddded", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXpSKV6v3G78nN9WN:927jqCt8v3GI/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105982, "uuid": "a5982db9-6c1a-483a-8740-ba5ec2293b86", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105982, "uuid": "a1e02e5e-db74-417c-8e59-6d1d71c6742d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105982, "uuid": "ed2f8ba2-d287-465e-8994-449a7eff591d", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c92e5b-64e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105976, "uuid": "10a847bd-5f52-4bc5-87e7-9555b4f363df", "comment": "Malware payload (Mirai)", "value": "c97eaab48441fc8ef35b836b779b07b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105976, "uuid": "5142bf2e-4b19-43d0-9a2b-8c82cc17fbd3", "comment": "Malware payload (Mirai)", "value": "e4e74eb4dec2259446e8c334d51e46ddaab05719818d38f40e003093f51952e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105976, "uuid": "db73ec12-32b8-4a5e-83a7-aa96c970ff0a", "comment": "Malware payload (Mirai)", "value": "969dc28d946d111ec072d72fbdff71a4271fb237", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105976, "uuid": "b3918716-5f62-4426-b724-e05051eb9414", "comment": "Malware payload (Mirai)", "value": "e9f69ea2bfb20f6a8b3b05f43cc860c6f4421787e47cb375686790597b038a262cd0073b20815ebcd4ff77c3323326c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105976, "uuid": "6e2e20c0-bbc1-41dc-92b1-c317987f956c", "value": "T15D630891B881A626C2D1137BFA6F008E372457D8E2DB33139D255FA0778A81F0D57F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105976, "uuid": "ea9cda69-ae3b-416d-bc7d-e4efa16d1f35", "value": "1536:eOTgWIYeMlktkUwnEU0+m7FcWS2RM8fhWtu5zPeH:eOTgWLeMDcJS2Rrpeu5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105976, "uuid": "9791d3d7-f022-4c10-94e3-c50921cd6857", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105976, "uuid": "d8f03479-da38-40d3-a19f-48d852d7949a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105976, "uuid": "b61aece5-749f-4d25-aee9-cb5a51794500", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cacb5fd-647d-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1781062501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781062501, "uuid": "0e361f42-42c2-48f3-b104-850d7980f241", "comment": "Malware payload (XWorm)", "value": "f38d6bb8d2ec1bbe2da72a57e98fb1d4", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781062501, "uuid": "cd676af5-ec6c-4da4-9664-dcd491cd5767", "comment": "Malware payload (XWorm)", "value": "e604cfd97cb0ebf3eae2ab57aca9547d37a4745e1ff72a41ca43b9bd80adf7d4", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781062501, "uuid": "bede7e89-67dc-4623-8a6f-0d68940ef9ff", "comment": "Malware payload (XWorm)", "value": "7456a8a80cfb19ccd984fb15a787848b8435d8e3", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781062501, "uuid": "3a080ec1-e1dc-4bc1-8c84-7b9b755183c4", "comment": "Malware payload (XWorm)", "value": "42d4a8e7ca15d7b7ec43807ab4331012545f131baa6009b0ab734e5890576b92de2f5929767947933819058c8092b8ae", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781062501, "uuid": "d4b9d9a4-ee6a-4fe0-8de0-dd1ffea58e31", "value": "T19AF2F21D3C25784717DE2AE407B2DFCA1642CA3DDBFF2188157CC966EF826949A8D4E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781062501, "uuid": "ada55dfb-a1ec-4543-90b5-c97fa876ab99", "value": "768:MHym+fKTTFX8nF/zXryYpcuzTCo2b0vbqqHMGO431B7shBPJt9k3pcjJegnRq9:zcTRX8B0H0vmqCkb88ejJegRq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781062501, "uuid": "b43a6d03-d743-49e5-8f51-38b4ded888a8", "value": 36638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781062501, "uuid": "833aa8c1-af4b-44e2-8613-2c47a0f87047", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781062501, "uuid": "774dea12-7b08-4227-aa29-04aaf6741194", "value": "cotizaci\u00f3n 240145.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f52993e1-6495-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781073065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073065, "uuid": "c4057274-61f5-4174-bd02-5cabe27896cb", "comment": "Malware payload", "value": "eb98377f4ed5410f94448ca9f659962c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073065, "uuid": "00847535-3ab7-4610-a7c8-751d9c30b5a2", "comment": "Malware payload", "value": "e61edd7f363467fb2b3c81627805fc40fc814f2d35c97a56d680586ef7914788", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073065, "uuid": "48731a0b-d168-4a78-bde2-579f0c9d0781", "comment": "Malware payload", "value": "89a40819afcf23489ff9d15831869841d4f087db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781073065, "uuid": "74605c26-2673-4e34-af48-3cf4823d742b", "comment": "Malware payload", "value": "424f6fbea58333a9827b28133366823a4c62aff28027e6c288767f5ebe0f129da45f4050a670a35d77037c12be511fbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781073065, "uuid": "d569c4d9-65f5-431f-878d-f336b29e9f2e", "value": "T18C767C81F788A136DA4A0A3248770B70B3A11D42C2F5896F5709F72F59B26F7994FED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781073065, "uuid": "b3f686d7-20c9-42fc-83d4-ea3cefb9db26", "value": "98304:7Z6SU9x57u2vOEjQ8up5L98PZ0YqznUjEs:EdxhuuOEjQD5L92benvs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781073065, "uuid": "4953b662-108f-4efa-8041-a9854975ee3e", "value": 7340216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781073065, "uuid": "8cf0f198-555a-4ac3-b42b-c571e29cead8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781073065, "uuid": "5828ba2d-5685-4f52-9b93-f76e622b9577", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910cdfc8-64cd-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1781096948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096948, "uuid": "626c3ecf-e033-4eb5-9b3a-d74de6b4cdad", "comment": "Malware payload (BlackMatter)", "value": "5bf0cb2ef6940d7453bc77775be3dc1f", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096948, "uuid": "4090403e-e418-442d-b074-68ee8b7043de", "comment": "Malware payload (BlackMatter)", "value": "e791ff4d28779b72bf7720b13bdb91a9be678c4b9f5a34e04d63d7a4b6f3777a", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096948, "uuid": "cba370be-77d1-446d-ab71-cdc01e503c25", "comment": "Malware payload (BlackMatter)", "value": "8e21140a20bb5470f36cc1a3a533584eab3da187", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096948, "uuid": "a6a19c04-c6e2-475e-8604-ab3d895a78b7", "comment": "Malware payload (BlackMatter)", "value": "09cd2c7fcb778fa19896b19049364452589ad34d638303823eb1c57afa81c8f11e596db4aea6851db7f04c9038b89aa0", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096948, "uuid": "2774fa24-08d7-44b1-a423-658385f32570", "value": "T130E36D21F212D0B3C83718F13736B5B2F39E8E6C19996807EAD80F59BC658236F45997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096948, "uuid": "883bdd23-0aae-498e-8a39-8e01c5eae085", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096948, "uuid": "d6a0b4a2-4fc7-4707-bbe8-8ab139ae914a", "value": "3072:U6glyuxE4GsUPnliByocWepCyISCIb1p0Oq:U6gDBGpvEByocWepDIOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096948, "uuid": "3464f32a-34f4-47bc-95a4-634e87e03ca6", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096948, "uuid": "46fefddc-3572-430f-9aff-f1e5c6cee135", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096948, "uuid": "26751a48-6def-4b8e-8949-eaec32cf971b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfdd55b6-6491-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1781071284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071284, "uuid": "e5bd9657-1160-468d-b746-e474e76360f8", "comment": "Malware payload (RemusStealer)", "value": "702443cc7855f4d0deaa2b322ab0ec49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071284, "uuid": "9468c957-301c-4a17-8cf6-02013ee12c91", "comment": "Malware payload (RemusStealer)", "value": "e7b4603170acc4bf93f058df2e6239513638b2928561d07ece0246e57f7def5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071284, "uuid": "bcfd655b-00f2-443c-af91-e3afc6dbedbe", "comment": "Malware payload (RemusStealer)", "value": "3cd4fe842b1d67b911d5437d597e66a87ef9b646", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071284, "uuid": "2d224f0d-6a1b-4fc9-b643-5bec78c1f2ad", "comment": "Malware payload (RemusStealer)", "value": "39aa55eaf6d9b7118e26b110357380358065c9a6afbb8b9e8deb83fd1f64b81256a66700aa3c37ea5df90a953afc4ec8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071284, "uuid": "127cb299-1f4d-48d7-9349-86e91067c1c5", "value": "T11616337305466CA6E6486EF44272E62B0BAB32856FF141F350798D1F57437FA113AB83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071284, "uuid": "801e0d83-0f13-48b5-8347-b64588bba540", "value": "670ea5e294ae6f45e41be0acf392dcc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071284, "uuid": "6b0279e2-ece4-41e3-ade3-e69858040ce5", "value": "98304:0BZ7YCb6spmyjuR3yraLIUSargcA8j/1Mdvxxe25/:0BZ7XbxURwySarE8DGtb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781071284, "uuid": "99483cac-d94c-44c0-8ee2-01a03057027d", "value": 4275072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781071284, "uuid": "7fc4f378-a6c0-4b87-b02f-0447e2a0cfc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071284, "uuid": "2fedb049-60ee-47d8-beaf-bc7d7e7682d6", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d5e3497-64dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781103197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103197, "uuid": "f3f3ad06-1a62-4304-b879-2ac2243abc8c", "comment": "Malware payload (Mirai)", "value": "d81bdb694bfd77ab9fb73e833ed37d7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103197, "uuid": "a8096352-c5d7-40f4-838f-154389bc7ba6", "comment": "Malware payload (Mirai)", "value": "e91cb0e5673f54d9c6341e50f4e04952bb32dce846907e72d01e8f0ae3e8b416", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103197, "uuid": "3672777a-754a-43a4-b3d3-a5de70fa42d6", "comment": "Malware payload (Mirai)", "value": "101ebae0c66b50f7286e02722ca9e28f3cccdef2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103197, "uuid": "9bc2ab8f-6896-43b0-b993-f57568d4cc86", "comment": "Malware payload (Mirai)", "value": "8c7c4e2fada0f649937d76167a13339d9cbd03478e1bbfd7839334341cb663e3802252ab5b542c1c25f0287b29d916f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781103197, "uuid": "d9df17b2-4523-4f4e-8798-d33d52590b3f", "value": "T1E9C3AEEBB74714A2C8214BF043C78FCD6E2762229E0FA8E72C5D663B55761DB181A7C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781103197, "uuid": "65bd7f2a-6bd3-4737-a91a-a603ef762a5b", "value": "1536:yPV4/D/BrCs+40NNLGrQosw62WEXzAEx6kogMYsL/LWs:yEBENNicM627zAHgN8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781103197, "uuid": "4e19a285-2680-4fd1-93e6-5eb65b693476", "value": 124056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781103197, "uuid": "256f4862-aa84-4827-9e64-63de1e6bf719", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781103197, "uuid": "5bb107f6-e7a6-40e4-913e-ee35466a4774", "value": "dtjogcysu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a43619b-64b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781087891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087891, "uuid": "67be4a4f-f365-4bfa-9857-c759bf1a4c75", "comment": "Malware payload", "value": "b50cc94d86908254485328f80b755483", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087891, "uuid": "745652bc-348c-4ed5-a5fb-a072825c37b9", "comment": "Malware payload", "value": "e96dc227d4e82d1c261eff41081e1ec8de4bbcbb7e26f989f4ab10c955b93312", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087891, "uuid": "8b944af1-0e8a-4c45-8077-800b385d7ffa", "comment": "Malware payload", "value": "fcabdbe37197fdccc1c3dbf36f1af56110deca53", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781087891, "uuid": "8415893c-118f-4f68-aa0c-4fe9dd41f41e", "comment": "Malware payload", "value": "8058f3251b5a32a30e7b67cb7ed2c12762d00656a26426135e352d4c49bb418669ca9f7e6745b45f7f8b0784122809c7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087891, "uuid": "e563cc4e-cd0d-44eb-ba8b-28431be0c685", "value": "T13AA3B600732D9A87CEBD81F48E325251DBF9545B3952DAC83CCE14CA5BF2B280769DA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087891, "uuid": "ed7d6796-668e-4fc4-9bd7-877024bb4f98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087891, "uuid": "66ff2b1e-522a-4828-8c37-86607c4537be", "value": "3072:aAz/u3sGaRLgPd+MrasRVU6x068xqpBD4WaxeJOI2sw0:aAz/u3sGaRLgPd+MrasRVU6x068xuBDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781087891, "uuid": "12a70f44-0d54-4be9-9860-cb214619c442", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781087891, "uuid": "c473a958-9595-457e-b9ce-6fd38656532f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781087891, "uuid": "b414fa86-6f58-459f-babc-417da6a5b83b", "value": "hitclub.nagoya_019e257a_c_acrobat-reader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc0c0fb-64b4-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781086071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781086071, "uuid": "2a01d9a1-ecd2-48db-8ef7-2fc55fd55d73", "comment": "Malware payload (Gafgyt)", "value": "da8916e3e1fc4f8f23bdc0a02a76c356", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781086071, "uuid": "c776af8a-d060-40f2-990b-5499217b4935", "comment": "Malware payload (Gafgyt)", "value": "e9ce4a059cbb619aa07380aec63ea8b06bd2fd256f6b6f0a09b9135d7072d227", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781086071, "uuid": "ad5fa681-fccd-422d-8ed5-ae86bd1d1d45", "comment": "Malware payload (Gafgyt)", "value": "7e521ba5b862afe525d7682160f67cc10acf1e8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781086071, "uuid": "b5bf82b6-26af-4a52-a740-1976e64f9f5e", "comment": "Malware payload (Gafgyt)", "value": "ee92475cdee39ee94cf5b23ab5829a879a24d1db86819dbea237c6ac0a743c4eb8bcb43545081a42a8fe369a2ea5a75f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781086071, "uuid": "31828a05-4c0a-4ec3-9c05-93d23ada93ed", "value": "T1BD542B02BF0C0E43E1172FF0263B97F197DFA9A128B4B6506D4EBAC94273D71A545AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781086071, "uuid": "4e9f2934-6580-4b15-b58a-91964257ff06", "value": "6144:8M6/UpwfTpttVHKP2JdMVGdyTxEFQOBnmtJVq9BOm:8jUm3/e2JdcKFvItGBOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781086071, "uuid": "6034380f-2f5f-4e99-8ad2-044b84718380", "value": 295244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781086071, "uuid": "17858cdd-2efd-40d4-ae9e-c9d18fa0ec32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781086071, "uuid": "6855a657-be9d-4008-9895-30755a3eb269", "value": "kworkerd-writeback", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689fc570-64dc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781103323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103323, "uuid": "aee7ea4d-65a9-4f02-955a-03e7b0bd7d01", "comment": "Malware payload", "value": "7f5c2aa28b083ebe0de8a64afaa7b166", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103323, "uuid": "cb8fc1a9-6b24-4258-b7dc-3b44786e781d", "comment": "Malware payload", "value": "ea12a603f6f09b6163043aa356c1ec01193ea6f44c6669df5493ab3ffb503472", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103323, "uuid": "a24dd661-e9e7-4f5a-9404-790944268587", "comment": "Malware payload", "value": "d95e96ac27a9cf063b26a6d241e546fe1cd768b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781103323, "uuid": "a4e336c2-678e-40a9-b549-b2d5cb12ade1", "comment": "Malware payload", "value": "88bff7d98bb184721bc5de7e8de98c25c36aa476f06fadb7fc33f55d8050d0fa1f948de9459f66feb536172dc5341b1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781103323, "uuid": "8296c2ed-95a5-464c-8430-db8a90735a3e", "value": "T14F934A73CC262FA8D229D1B4B1B08FB92B53A95581475FBE5477C2748043D8EF64A3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781103323, "uuid": "43f40957-9ea3-45ea-ada1-bbe47434029c", "value": "1536:lRv4iXGTE6lCNTMTuZWycEnFKGiHDyGxOR+S2vN:nyblOMKZWZEMGjqOr2vN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781103323, "uuid": "7cd200d4-905d-4cee-ac90-b6062511cb45", "value": 95372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781103323, "uuid": "7919f9ae-8662-43c8-b319-42a5e2a62bda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781103323, "uuid": "041257ab-f3cf-4db4-90a2-8c27d501d6ae", "value": "zero.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f9fa791-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1781108784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108784, "uuid": "b61a4393-50aa-4fad-b3cc-043159ff9db5", "comment": "Malware payload (MassLogger)", "value": "1a7dc9e83833e0fc72d818b4b80c1879", "object_relation": "md5", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108784, "uuid": "c06524a4-32ff-4964-a2d7-bcaa8041df4e", "comment": "Malware payload (MassLogger)", "value": "ea3e8c3eb86640176f6ce63394d49aaa7c172bb1894aa4e73c3009eec29a212f", "object_relation": "sha256", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108784, "uuid": "410cc64e-efeb-4287-911f-1a5cdc99e41b", "comment": "Malware payload (MassLogger)", "value": "47aca8b1ab9ab97d348f1d814e62dc629a5853c4", "object_relation": "sha1", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108784, "uuid": "9254cea6-abb2-4758-a871-a59646ab2b4f", "comment": "Malware payload (MassLogger)", "value": "4ffa706d20ba104724e7bacfd6fb2044122cf4d1ade6184463d2fb0f7ec6afd57543e7ec3cc7bcf80db6f938f9e224b9", "object_relation": "sha3-384", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108784, "uuid": "2dc5cb84-fa28-4f06-b9b4-09570ffb8ad7", "value": "T15005C43ECE14412FE972C518C499855FF89269D7222CE94B90CA3F5F6E73982B3C225D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108784, "uuid": "89318f41-606a-469b-9d9b-ffe89c5695ea", "value": "3072:nwzx1eYu+A7Xm1dUsPjqJDoLkt/vxyLzzry6o4acOtlLrOxk7Hhfm3SXz2eTt4LR:WUsPjqJDoLkOKS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108784, "uuid": "a68424f2-4bf7-4b86-b1f2-adf101ba3661", "value": 797488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108784, "uuid": "4269ca10-ac72-4742-85e9-7452fdd36d6c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108784, "uuid": "55cd2793-7d39-4ed1-b0f2-5df3d5522b71", "value": "BBVA.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f38dbc2-64a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781077618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077618, "uuid": "b4f50403-9648-45b2-99a4-7d154473cdcc", "comment": "Malware payload", "value": "8b742676a04b29232b7ed0d9fdd8c681", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077618, "uuid": "0a6af583-f2a0-49df-9933-8dc5c5715197", "comment": "Malware payload", "value": "ea5d64d4cf8081b8b06b9a9a5f5ec74adea432f73088627876ae84c5065ca3c5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077618, "uuid": "47ffd687-2a4c-4163-8a1f-2b0fc676a33c", "comment": "Malware payload", "value": "3d699f76a03e2046fce9412de120e2f9a4d73ee4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077618, "uuid": "cc1a728b-2c31-4ac9-8751-94deee5ad02e", "comment": "Malware payload", "value": "7ff5d25e644888de853ecc9021f0b4346ab1dc9d2c6d5550d5b428deaf4b4fe525a516ba9e117caba79d9199ec607dd4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077618, "uuid": "be9fe254-660c-47fe-9bdc-376a803d56c2", "value": "T17421B73256C1BC943D5129D348E9EC4D04FE350536180C4C1B2C8BCB6904E5D3A7EF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077618, "uuid": "90d94a01-635f-4bcd-be4d-44b82b5eb7fd", "value": "24:iNWFUvMhpqJ6lsSZCp6nlvP73DfFU4vwvY/SdpkiKlGiS6Qqo:iN2XZ88L3DfFjwvY/SDXKlGiSyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781077618, "uuid": "4b569c76-2b51-41e7-8cf5-96b5011a3f94", "value": 1189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781077618, "uuid": "80cdbe89-e452-4811-b441-a5018ee6254e", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077618, "uuid": "41d11db0-8c07-4cc8-b0a5-1f8a4b6995b7", "value": "46.250.244.254_1781077615426936_hello.world_ADd_allow_url_include_3d1_ADd_auto_prepend_file_3dphp_input.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da545efe-64c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781091917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781091917, "uuid": "60d6728b-8a78-47ba-98ae-641d5ade2649", "comment": "Malware payload", "value": "b4bcc96c8e76157558245cd16b86e16f", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781091917, "uuid": "77457e64-72ac-4326-94b0-82e98f0fd196", "comment": "Malware payload", "value": "ea708e6d0afcd94ee5739d0be36e790b3d2874f3982d61db7c87d31bbe1f2005", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781091917, "uuid": "6151078d-f1ef-48bc-9799-a2825a7c524d", "comment": "Malware payload", "value": "45afc01cea6cccf956a6ba8c606213c737da90d9", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781091917, "uuid": "bf45d908-19ef-4910-9c19-1d9e81c862a0", "comment": "Malware payload", "value": "60064ccff5177749979164d529d523efa9f3af8701ac2b48d791a271885e2f4c1950d4a5764d1a59575a47a2d461ae4a", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781091917, "uuid": "67629650-63ed-4de9-baf7-c0e1deae7ffb", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781091917, "uuid": "af89fb8e-a7c3-4666-96e5-dd0ab073489d", "value": "3:E1IxB7n:EaxB7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781091917, "uuid": "8d947289-2eaa-4b2a-a636-5581a26930cb", "value": 28, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781091917, "uuid": "8bff8432-2d27-4b9b-ac3f-fd03dc31103f", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781091917, "uuid": "73e08fc7-1fde-42f6-a9c1-38545114a962", "value": "ss.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e6a0a2-64a5-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781079532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079532, "uuid": "646d7d8f-70dc-4d2a-8f26-8216bba27ecf", "comment": "Malware payload (AgentTesla)", "value": "ee2f3a4d3e4e54a3bdf3564c293e7942", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079532, "uuid": "0f7edac0-4480-4ef2-a631-764be351a182", "comment": "Malware payload (AgentTesla)", "value": "ec791b5c5a90c643066852a5b824612409f4645e8f39912528480b3a3d8f1496", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079532, "uuid": "3c1efbee-270e-4a61-b1de-eddc56d15a87", "comment": "Malware payload (AgentTesla)", "value": "eb6a79039293f586ec472cb2143ffdb80bc7290f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079532, "uuid": "5a4b6923-77a6-41e4-886e-f7ee04a3a648", "comment": "Malware payload (AgentTesla)", "value": "b12f4bde4773929f00eb035ee22371fe030dc7a7f492674bd4ad740b3f9e6777b4d5de511774c2d46906d8b87104b00c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079532, "uuid": "8829be99-53f1-4340-bd38-ef1360901146", "value": "T1B24684059A515136AB0AD7EF673A9850B42DD3B225CDEFBE301EC5207A38D1F63D12B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079532, "uuid": "3bb02311-8fae-4796-8ef1-2ce3af7c6115", "value": "98304:tV5BIVMqxZFUBlF1NS1fTKTN2e336jTEb02/52vzhw/PUJR9vL+IO9qi10YjY:/IaqxQB/10tTKTNX36kb0QmzeUpzkIYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079532, "uuid": "8b3333d8-3e45-400c-893f-7616d94b9df2", "value": 5838889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079532, "uuid": "cc54e180-3a31-4793-9321-437e9a6b231a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079532, "uuid": "08c6c8cf-c6f2-4fd6-8f64-de75e7354039", "value": "\u51fa\u8377\u306b\u3064\u3044\u3066 - JAP-\u6771\u4eac\uff1aMRS \u30e1\u30a4\u30fb\u30bf\u30ca\u30ab\u69d8\u306e\u304a\u5f15\u8d8a\u3057.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28cc9278-6494-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781072292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072292, "uuid": "621d6ee8-3b9e-4f80-944b-9fe42b3eb38c", "comment": "Malware payload (Mirai)", "value": "5b45117184c517c8a77e0573ac09a811", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072292, "uuid": "07c335c0-9d61-4c08-b99e-7723a19aaa56", "comment": "Malware payload (Mirai)", "value": "ecc29ed02f43f5a1084671ce75ecfce8cb57aeccac8024ee9eb465bdca81c7f4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072292, "uuid": "3d0bb433-a06e-44aa-8199-7a565a81709f", "comment": "Malware payload (Mirai)", "value": "eb9bf1dd35859abf0f263f5990eb8533414a174c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072292, "uuid": "0879f8e6-acce-496a-bb79-3aa9ae505f8a", "comment": "Malware payload (Mirai)", "value": "bdc294e18047556f010026be571d013bdde96bcea712dae5aaed3c361a1d9a0d3cfadb4c2aa17bf02b1e0cbe9ba7bbcd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072292, "uuid": "77639aed-1bdb-4d6f-a5a2-cd21783da9ff", "value": "T179144B07B5C080FDC4CAC1748BDAB53AAD33B4B91228F16B2BD5AA225E4DE714F1DE45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072292, "uuid": "d0482feb-90df-4121-b397-ffbdf02c7d63", "value": "3072:ytz+wjM8wtuq0YPjBZ3YG4obbZQ1bsAzAARMjCAKZ:g+wjMCq0YPjBZ3uPDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072292, "uuid": "57d39799-b129-495a-9103-fb9f204e5f7e", "value": 191928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072292, "uuid": "e50548b9-4232-41b2-a808-30c46ecae2c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072292, "uuid": "e49b9f9a-cb7d-4835-8917-b184373ae8cc", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21b2c1b7-6507-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781121672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121672, "uuid": "5f63239e-e33a-4443-9b44-9bb13b37d5b7", "comment": "Malware payload (Mirai)", "value": "7d83f7051c5b3f1d420f39e63890f487", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121672, "uuid": "b0ce1603-385f-468c-8b02-a0c856243a48", "comment": "Malware payload (Mirai)", "value": "ececc197db9cc1fae909153fc441f6f5eecdc579e35432dc26be40ba159f6d82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121672, "uuid": "4260b994-ff20-4c5f-be0a-20f1202e3e88", "comment": "Malware payload (Mirai)", "value": "75c7f182e85d7d7fa99899d125e6995c386383f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121672, "uuid": "f06a71d5-475b-4e03-a57a-94b3967ac7fb", "comment": "Malware payload (Mirai)", "value": "7848155ba5e0e71b8059a7cefdb1440229f4b68d5e80b4ed6d6d4557c807f274b32fe49030d284412f0f5a9c94ca99af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781121672, "uuid": "9900a746-b52c-4a19-ba8d-76ec5a3a704b", "value": "T19AF3084AFB418A17C4C61779BAEF53023333DB64A7DB330A991C5BB43E8776A4E62405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781121672, "uuid": "42c649c4-30fb-49e3-bbb8-8855c6089188", "value": "3072:dRT3QhA1ayum3QHVIDvWZxPixInDB5uZKWAL/KKH/:dp3+A1ayd3Q10sxPixInF5yK3L/KM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781121672, "uuid": "1cf6038a-cefb-4b5b-be85-858bfad5e5b5", "value": 161682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781121672, "uuid": "9c2837a0-4005-44fb-81fe-f85991959d0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781121672, "uuid": "901c9e1c-0ccb-454c-a458-e18f5d0d9714", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e43bcd1-64a5-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781079549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079549, "uuid": "1129fce8-3b32-407f-b800-da0948ccf038", "comment": "Malware payload (AgentTesla)", "value": "6cec0bed47c107b5205d1e15a89978f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079549, "uuid": "7bb8be38-19e3-475b-b3c7-fc1e336a9c98", "comment": "Malware payload (AgentTesla)", "value": "ed1bf6aab37131ab229855c711762f76966929aa29d1d291f1b6a06e83500dc0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079549, "uuid": "d605bc66-37a4-41ab-85fc-b5091f37469d", "comment": "Malware payload (AgentTesla)", "value": "faadc26cb089496281392800a597630d83dc022b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079549, "uuid": "16f94b0a-cad2-4dfc-95bc-06a1023cf4bb", "comment": "Malware payload (AgentTesla)", "value": "c39e983d3562179163ab7df8ef64e814ff95ae5a831f47e72d4af822ab71804f88d8b0066a95d3cf37b05b4c216273f2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079549, "uuid": "9e681ef9-17b6-4cf9-add6-5395c2c663ca", "value": "T1DD469601D756602AB71297EE62379C50A40D93F278DDCF3AB00DDA2C7698D6B72D13B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079549, "uuid": "4dd7bb6a-5b2f-4a57-9c3b-2ff21f2b6596", "value": "98304:hUBqbARPHac6dWFu0IE5vDujTFOdZulC2yClR5LWBOfPG8RjhMu+MtL9n2oRosWf:8q2p6dFurujpoZuc23lTLNX5B+Mtx2oe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079549, "uuid": "4d206c92-408e-4a67-978e-21f8be786753", "value": 5840705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079549, "uuid": "5f3699f4-9a3f-4d92-bc51-62f49fee237a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079549, "uuid": "87033007-115a-4674-87a6-0883a3e9260e", "value": "Overdue invoice payment.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1143f89b-6470-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781056791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056791, "uuid": "101abb89-6f82-4bae-9206-fb92c294d253", "comment": "Malware payload (Mirai)", "value": "9c113c62ed7c2cda43b97ce6ef1889d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056791, "uuid": "3802300e-06f8-4e81-87d6-6b3351b9ab8e", "comment": "Malware payload (Mirai)", "value": "ed2bc52ee93c26c698e08759f1334d2f39325df8956b0136d38f06cd5be238f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056791, "uuid": "b3d2785a-cf8d-486d-b3fb-2d4315ac4dde", "comment": "Malware payload (Mirai)", "value": "3b88c39324f08e6930dbe65458fb5d1ec161361a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056791, "uuid": "c403dbbc-2b6c-489f-bbc9-39f36b075f3d", "comment": "Malware payload (Mirai)", "value": "d349baca5d434a4370edbe23b6e6561214c318e1cf4e0d06b86e7240c907de2cfb1af776ad1ecca05ea4b4ac9c82a236", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056791, "uuid": "dbab24f9-97ac-4ce1-ad59-c20dc5a5ef10", "value": "T1D1C34972C8356FA9CA64E4B8B0718B792B53596181871FAE14B7C3B88087DCDF5093B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056791, "uuid": "62e25bd3-24e4-49d0-af57-42353a5537eb", "value": "1536:5qvdOu6SHSaw1MUg3MMCCkX3Ts5W9tIuKVBQ1sLT9gHK7q:5qHSd2l3K93o5WnIBV6HKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781056791, "uuid": "a16c93f2-4fd9-46c4-861f-33deae0ebc94", "value": 126804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781056791, "uuid": "961d9b99-1742-48b4-a32c-2a305819a77b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056791, "uuid": "42d6c164-fabb-492d-a002-720d740552b4", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "950125e9-649f-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1781077198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077198, "uuid": "ec767708-59c5-4976-9701-2aa228670cd6", "comment": "Malware payload (ACRStealer)", "value": "b0aa0fd9f9f0d6277da32d62bd825c73", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077198, "uuid": "152c9975-150f-4be1-876a-851b6b629fea", "comment": "Malware payload (ACRStealer)", "value": "ed7b43af39b111ebcfd376a6cd5690bfe6523f053c5e96c136fb8df887f8f21c", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077198, "uuid": "f22cb2cc-e888-46a4-b17e-01f4f30609ae", "comment": "Malware payload (ACRStealer)", "value": "c92afcb56f203bdd26f556fdfc0f8b1fe336ec04", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781077198, "uuid": "77dbaa6d-3024-414d-bd6f-699c701d2a7a", "comment": "Malware payload (ACRStealer)", "value": "b30753504bc1d668b5485744cd2546ec1ff2a8a9425cfca29706cfa70cf1e9b156eec6c98548ebb43595a5185506276d", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077198, "uuid": "a1e7453f-e052-487d-98e8-7c7cf9f54d12", "value": "T1CA05E7C8D98F59F5DF124C3FA22B6A7FAB9431182D2CCA81C6F12E45C5E2D51C2158EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077198, "uuid": "651bf814-bb96-4e45-a881-6f2129c1005b", "value": "12288:rpgEriWONvAvmm0dzFK9klDMnl8wtWxrma+VmQ4wcpy:OEriWWvAvmm0dzFSsDMnl8wtWpmZkQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781077198, "uuid": "937f63af-05e6-4eb1-86bb-d0098314e31a", "value": 820736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781077198, "uuid": "b7c48b4c-7f6e-40b1-a301-1bff6cb44d1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781077198, "uuid": "28c26395-04de-48f8-a411-8eadf9038130", "value": "SecuriteInfo.com.Variant.Tedy.981483.57777413", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a062a00-6512-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781126465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126465, "uuid": "705c8e19-2d87-46e4-a100-cab956b58588", "comment": "Malware payload (Mirai)", "value": "2fb492d9250f0d3f5265fd84b5610cc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126465, "uuid": "e916785a-b1b3-4fca-bbe3-59b52ac3db26", "comment": "Malware payload (Mirai)", "value": "ed8d8a8419bc8c2d2f49205226d2661bafba4f0dc441ad2fd588202a48c3e4fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126465, "uuid": "7fd83cdc-5024-4380-b1f0-f4f3b55d98f1", "comment": "Malware payload (Mirai)", "value": "69add5cfafe0dbc7769da0b86913a27106be8c03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126465, "uuid": "93331ea1-8b47-4fd8-9802-7ed972fd7d36", "comment": "Malware payload (Mirai)", "value": "c396d1ffbaeacf50963177a67cd1c03e1beccc29b8600edd4a61583c2255144ac8cec4dbe27c30b7feac7228bf0719e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126465, "uuid": "27d364f7-79ed-434c-b75e-e1eb1bd0eb76", "value": "T190F3F756B8819F16D5C152BAFF0E534A33131B78E2DE7203AD246B347B8B86F0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126465, "uuid": "2e5f8010-e98e-4c13-9055-af9e18bedea8", "value": "3072:rNq4ANZG2kVARG0bYDjbsXwUrqjwy0IqgTRHa7HfOZ2f:h5WZG2kCG0bYDcX9ejwcnTRHa7E2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781126465, "uuid": "ee894e85-53d8-4ade-8326-6485f8121496", "value": 162288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781126465, "uuid": "6d805691-e6ab-44cf-81ad-49ade81cca0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126465, "uuid": "92a6d445-55d5-4613-8a84-349ba89d774b", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1761d56-6491-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781071233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071233, "uuid": "6dd1c541-8b5d-4e7e-ba95-fccf01a6e444", "comment": "Malware payload", "value": "35e23db7eb805cd45401fa58874131d8", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071233, "uuid": "42da0c74-fd3f-41b7-9d93-fbe87e14caa9", "comment": "Malware payload", "value": "ee4a3b493c690bd1fcc2ad6a3b7ab7032a4e1420774aa3d3a7a0d0a05f030337", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071233, "uuid": "d933142b-23cf-4710-8136-bf255e51ca5f", "comment": "Malware payload", "value": "36b3b1e1e543b7ac108533213352f9a6c840cb00", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071233, "uuid": "7f49d521-55db-4558-a492-e5f312d12fc2", "comment": "Malware payload", "value": "aae127831453e79affc88e9503df2e0d7504394ea2a6b924d4cd098fda07cc93b3a544c7ff72d966830ed6016a4f1d26", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071233, "uuid": "544cd5ce-0771-4983-a797-b98b172da1f7", "value": "T11B450CA2DEB7DE3ECB798F314AE68205A7745C52C331CB07A5853139BAD9E20BD450C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071233, "uuid": "f0e6db57-d8f0-41c7-86e2-99eb4428b8ea", "value": "12288:sDylH4wSo1A8EVZau7yLLw6OrB77DylH4wSo1A8EVZau7yLLw6OrB7:7+wrEcIdB7y+wrEcIdB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781071233, "uuid": "f02732ca-ecf7-41a0-aad6-5fe60260b9f0", "value": 1177600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781071233, "uuid": "92b49a2e-af18-48c8-8372-81c0bd0a7264", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071233, "uuid": "2ec31dfd-244e-4fb9-9215-d17d0252db31", "value": "PO26722026010000081007066).xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de8998a0-6512-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781126714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126714, "uuid": "6b1d137b-0900-4224-a0ad-677e1ea916ab", "comment": "Malware payload", "value": "d1ed6b713dcfa3e836dce83b6f2a6403", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126714, "uuid": "cba69c34-c1c9-45bf-8e83-b669aed187cf", "comment": "Malware payload", "value": "eebb15c20e17ffb93afdcae1f579486f00a5fe69774d3939ba41f35dc6cf4a04", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126714, "uuid": "0be03f41-68fe-4a40-bb76-c914b62f8b42", "comment": "Malware payload", "value": "43d0f24dae878bd346abd3acfaa1838ef25a8d80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126714, "uuid": "7727b1b2-950f-4a6c-a842-6da7648e080e", "comment": "Malware payload", "value": "15a639b35ed139a9310629a4627265a210209fb3030ff9baa88b2b86af2dd293f0d3a1a5b277b068ad524fac40d3fe93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126714, "uuid": "f9011273-fc89-4584-b50a-73690e6145f4", "value": "T156E31A05B71D0983E2673EF0373B27D1D3EF9A8131A8F640295FAA8991B2D321585DDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126714, "uuid": "ff4cda13-7888-42c1-9be4-5f327371d11d", "value": "1536:RaTLKRR4/gPBo7otnicdiB8NYzMfl8x/aZOP0P5CeZivARa7udaaW5OgQFqWUG8z:1MTyiDB8NTyxd8P5TRnun9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781126714, "uuid": "1e85e735-dfd3-4a0e-b772-e37a104113b9", "value": 149400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781126714, "uuid": "7b12594b-2c74-4a4e-bf37-3b676de9802b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126714, "uuid": "f52e8423-e9c9-4ac6-874e-d1f91905a187", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "185a1d79-64cb-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781095887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781095887, "uuid": "417c85cc-943c-4348-9a3b-25762adf2579", "comment": "Malware payload (AgentTesla)", "value": "bc1f2013de8247f8766fc9e760e9acca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781095887, "uuid": "6cfe1942-23b4-4145-902e-7d363d35502c", "comment": "Malware payload (AgentTesla)", "value": "ef013d902ac3621b21285d8a9cfd2239baddc5f1f4c5fe6b2f06e30ff3cfc0a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781095887, "uuid": "6d8f7026-fa67-4312-92c2-988d3e7137cf", "comment": "Malware payload (AgentTesla)", "value": "c925cbecb4c96ad7ff0972dbf8fd2b718d34b6f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781095887, "uuid": "f4f0b653-d341-4740-ab70-26b4d9ca4295", "comment": "Malware payload (AgentTesla)", "value": "afdbc12b7424ffedfd4ce368250e3cde9ac97cd4eb17bd016e5f60c3e47a876c2207dadc0a56b1a5324cd5a28a2c5d61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781095887, "uuid": "b320304d-a38c-4059-ab42-15c7e4ccd6fa", "value": "T11B05D83DC959422ED172D728C49E085FF8822A0B563CD84B65CA375F6F639427BC236D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781095887, "uuid": "2a9badc7-4940-4341-9df3-b6be6874cae9", "value": "3072:yBzCU4cUK6mMHjHhAEmTEkZnBSvkToUEtUEzsj8l0HflVr+zwx3aCHfO6XpixKJW:fyXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781095887, "uuid": "301684ee-be5d-4452-8afc-611ceda562c3", "value": 815352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781095887, "uuid": "9db3a816-6426-4b19-bbeb-2d9511125874", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781095887, "uuid": "76663a30-ae86-4efc-a78f-d5327c1214ba", "value": "PO BOQ.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "211844a4-6494-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781072279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072279, "uuid": "4ad6658c-6014-4fb0-9af7-d3906ba3fc6a", "comment": "Malware payload (ConnectWise)", "value": "f9d39dabb93d5d82680bc8ce7e07c467", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072279, "uuid": "f5d6f5b6-f320-4662-b8ea-5db959e155b0", "comment": "Malware payload (ConnectWise)", "value": "ef3f4cc7ebd8425ae65fa70e31ffb4cffc726290ce6ad785cc47bf91166aa6fc", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072279, "uuid": "5ab6379f-86f6-435a-9eac-d279f0a3eb81", "comment": "Malware payload (ConnectWise)", "value": "b0fd73b5f38072452f473c99bdc2322a45a02fcc", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072279, "uuid": "1c325383-3ed8-4122-a9a9-c2bb2188143c", "comment": "Malware payload (ConnectWise)", "value": "d63f24ab05369127533cbdf51ff80520497848dbfba80abd2387820eda39fa801d47f8996394de646a57ce6e4776b588", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072279, "uuid": "65bc452b-920c-4012-ab89-e648fd386496", "value": "T17E46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072279, "uuid": "2a7e67ca-e377-4d97-ab89-38f07682a7d5", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072279, "uuid": "adb50d58-9b03-47f4-bd10-c51742d8b3ce", "value": "98304:5zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:5hfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072279, "uuid": "2b6b9443-b8c2-43d8-9fa1-a9f8467e9bfe", "value": 5643264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072279, "uuid": "eb7f2c61-0161-4957-a2c9-664e4a877b90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072279, "uuid": "ef0d0aef-c61e-473c-9e83-ed382a7c379c", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4288586-64a2-11f1-a769-42010a9c0008", "comment": "Malware payload (CobaltStrike)", "timestamp": 1781078620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781078620, "uuid": "f981467b-0fa0-4f4c-961a-1cd344d23675", "comment": "Malware payload (CobaltStrike)", "value": "49949db8fb6a69dac318bfc6320720fa", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PPMIX0.file", "colour": "#91D417", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781078620, "uuid": "fb592477-f554-4994-ad83-713ec79f0771", "comment": "Malware payload (CobaltStrike)", "value": "ef901fac3c9bdf1f15df02d8457d78b9d4c20afc558f5aadcd5205d3d3a6bb05", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PPMIX0.file", "colour": "#91D417", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781078620, "uuid": "b0ce0c18-cc8d-4dea-83af-1e0047c2d431", "comment": "Malware payload (CobaltStrike)", "value": "392c14b87ed5a5ab0cffec768f5ac55f8bfa5bbf", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PPMIX0.file", "colour": "#91D417", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781078620, "uuid": "b9241ce1-4762-4d87-8e25-b1205bbffbc7", "comment": "Malware payload (CobaltStrike)", "value": "e1f86648775462c0f9cc202c19742ec71e30e5476a3f8816587f334330570722cfab5bead61014685b87f02354d3ad54", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PPMIX0.file", "colour": "#91D417", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781078620, "uuid": "bcdf5e35-7e92-4ca4-98f2-a4b68a4a64fd", "value": "T110F44B9A6E9401F6D11EE13881A73329D73B743D27A68FCF919D6E212F336D8193A701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781078620, "uuid": "c26a4636-f6f4-4f50-bf7e-91f78ae045e7", "value": "02f3da6463a067bed38f0ff3fb26c23a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781078620, "uuid": "a31a6c10-1a26-4dfd-b080-e56c5ef2a1ff", "value": "12288:Xe6exij8DHEZkoKYKy33OyTkkg3UorgsKq:Xe6aY8DokoKYKK3OyTJg3rDKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781078620, "uuid": "463f9cb1-2fb7-4747-b102-f48582f0b4f9", "value": 775168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781078620, "uuid": "4afaf467-dc00-4c25-96c0-5a613e81da51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781078620, "uuid": "175e766d-d3f9-47c1-97ef-8734c88046e5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf8ee6e9-6498-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1781074290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074290, "uuid": "332586e6-f3b2-4613-89a5-ea3bc396c5c5", "comment": "Malware payload (XWorm)", "value": "b23d25dc160942959e577f7d4e0de155", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074290, "uuid": "78c2e10f-a9b7-4357-809b-552d20575eaf", "comment": "Malware payload (XWorm)", "value": "f020d4dffe41a1f7665a784edd5bcc4f5ea2db9e67d35d70ddb3bf6814ceec03", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074290, "uuid": "264f9679-3815-49d6-9826-d754c5c47f1a", "comment": "Malware payload (XWorm)", "value": "cadd4b873a9cec163fb38cb8861841a37df86461", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074290, "uuid": "db2e31c5-1592-4b8b-b894-33433f48aef5", "comment": "Malware payload (XWorm)", "value": "19095203fa41528fdcda05b08109620abec43843cca8d773517bedb39cf81ebeb3fc72b006607ef9979bfb53167e63fa", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074290, "uuid": "814de4e0-78d9-476e-90ac-6bf9c6e3015b", "value": "T125E5FBADFDD332CAD13102EAE4D88B308CA73B54381E14FA5D5259CDC6A769F496872C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074290, "uuid": "3f50b389-5275-4655-9071-7c4b114da50d", "value": "384:qAbCbBAz9CFbFubj1D29tgbV7Fl5SRVsAWP959KlO2MyO7h3Z+kvDMgRzbqd5wk6:9oDvqEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781074290, "uuid": "e9855366-d858-4580-8fd0-6c05c3ce6e08", "value": 3093213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781074290, "uuid": "362e0044-7301-4231-a5fb-f56059cae1cb", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074290, "uuid": "a1baf053-2c2d-4230-adc1-ee18a243785f", "value": "cotizaci\u00f3n 240145.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec97f911-64cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1781097102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781097102, "uuid": "f0f84c9c-494a-4582-8dca-f123ea5fe66d", "comment": "Malware payload (Phorpiex)", "value": "50c73701c44e31354019c2644e4be1b8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781097102, "uuid": "3e28a2dd-8da6-47f6-95d0-11fdeceeffbc", "comment": "Malware payload (Phorpiex)", "value": "f0481225e203b25e910d6febd5b93f2a3003bbe0d757a449b9bf73517243465c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781097102, "uuid": "ecb48ee9-d08d-4fc1-90a5-d01ffc9ef586", "comment": "Malware payload (Phorpiex)", "value": "d5886070d235d08ab19de5ecfe4d4c180c2ef6e2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781097102, "uuid": "d0c2f7a6-8bc4-4b93-96d4-ae953f1e9892", "comment": "Malware payload (Phorpiex)", "value": "c563cbed9bdbf9c02bdb0f14c1dd518984d0a462aa066e88170c05423361d3dac7489dcb52f54e095b8fc3120cdfcbf4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781097102, "uuid": "9590de79-2b43-47d7-bbf8-36ac696dd282", "value": "T19DB38D1030C1C432E567217588BAC7B58A6DFC710F756ADBBFC406AE4F266D29A36387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781097102, "uuid": "fa41d97d-ce46-452c-a388-3008821be247", "value": "c6cbbdd643acf2dc6daa2bfb97e98d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781097102, "uuid": "556d98fc-c90f-4073-a438-ca10b90ced50", "value": "1536:MvQFS6jum8d78qt2xjmEGur+GLpmc8K/THUBZT/3d5Fb26E8Jr:wQFSAumAg3GuqGLQc0XT/3d5Fbuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781097102, "uuid": "ec2623d9-4efa-4e18-af98-c02966d2a737", "value": 113664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781097102, "uuid": "907adaae-ead7-495f-841b-35689c27317a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781097102, "uuid": "802e6f9e-8164-47ca-a2f7-af7c37413cf2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c83c56-64ef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781111720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781111720, "uuid": "9b48407a-0fd8-4ae4-9144-7b16403eb6af", "comment": "Malware payload", "value": "8b76197bb4b7867198c933efe10f6709", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781111720, "uuid": "0a8acf31-128b-4ac4-bb09-dc5fdb219221", "comment": "Malware payload", "value": "f129a44924a038d0f4312d9cdd1315a7044a6b72a998ab033e93003fba28877d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781111720, "uuid": "08481f6d-9bc0-4516-9cdb-365429d0be06", "comment": "Malware payload", "value": "fc844bd369a8f9fc35b7c3c024e43b3e0bfaeb16", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781111720, "uuid": "cf7b7375-daec-4c36-aa5e-01d17fb4ae81", "comment": "Malware payload", "value": "9daa6718b9763b041eaa06b0931035d19dd825f96d997c90ccb43f447fbe1da4466f44eaff51d4675a90b68b5170b81b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781111720, "uuid": "95ced577-0076-4a23-afff-843e0858e7dd", "value": "T15601CCDAC008D6A081CAD89C32971085B410C3CB65458FF8BEAC547ECB75E247016FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781111720, "uuid": "878214d9-6b55-4954-a4ff-0f2e292ef676", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaVIWtOZIg+x13Ijc8IOxqxnbI1cX:kXCKysE2hi0ziQvZohaVkl+x8/EbgcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781111720, "uuid": "c7bbd94c-1500-4c7c-b430-efeda0e51ee5", "value": 843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781111720, "uuid": "a85b9f47-fad8-4992-b08d-c837ef9ff75c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781111720, "uuid": "34ceee3c-b557-42fe-9408-bd28e1a4e5be", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a648ba1e-64bf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781090971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781090971, "uuid": "fa855805-42d6-4c1f-8bd4-ebf8f1f37d75", "comment": "Malware payload", "value": "e5a05d4f738bd8a98689fb9fd847ce37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781090971, "uuid": "28f419bc-259d-4be4-9976-6dfd2c80303d", "comment": "Malware payload", "value": "f172d154f601af56ada841bef80e738f3e528cd5a5fc5f4b84260160d46a1ceb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781090971, "uuid": "983dbcda-222b-4073-9d03-1debabae05d3", "comment": "Malware payload", "value": "3f5f1e0646737983cfc193dc48ca835aa38f26cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781090971, "uuid": "cf439355-460f-4611-b764-d5955aa6cb71", "comment": "Malware payload", "value": "8d15a7e92b76132485b0f7fe0a2f068682da706fc3a0d96ddc36acabc14884997ef6b37930ffa5b3782dda131b4486c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781090971, "uuid": "45ae9a8e-59c0-47fa-b52c-b123cac602ee", "value": "T118E7334877808CE8FE54433657219F4C6E68F40DA6E9484FA7FC65392E4F28E8EBD650", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781090971, "uuid": "d2c9549f-bf70-456c-9928-38f97545650e", "value": "72c4e339b7af8ab1ed2eb3821c98713a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781090971, "uuid": "0ac2dabc-ba2d-4505-8970-92405490f0df", "value": "1572864:TEWfWe0izXUb9jETHPQmMpnx9luHY7otnq/2Z5kCiIfoe0:TEWfCjcvPOn36nW4we0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781090971, "uuid": "7362b761-a094-4e1a-a897-73d4532ac6b7", "value": 67199705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781090971, "uuid": "d0220292-a411-4a9e-9566-9864fcfafdd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781090971, "uuid": "111e5c2c-0026-48f6-a350-5938aaccd1bc", "value": "ova.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5574db7f-64ed-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1781110592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781110592, "uuid": "70c8d9fd-6ad0-47ac-9e78-a8a2dd59e0d5", "comment": "Malware payload (SalatStealer)", "value": "be1255228945d4cea336036eb887e7b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781110592, "uuid": "2d484f00-e85d-446d-a1de-12279835b3f0", "comment": "Malware payload (SalatStealer)", "value": "f19ba38ca35db5f36cd5d73d04040abb16718c1003c0fce072df90ce3cf5eead", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781110592, "uuid": "3a21b0d9-eb58-4817-b267-d6a35953fca3", "comment": "Malware payload (SalatStealer)", "value": "ce53a54a214a140ae7a27faf9fce33fc21b4990c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781110592, "uuid": "88e1b5df-9946-473a-a2af-f543d08a639a", "comment": "Malware payload (SalatStealer)", "value": "7fb5eee2edc7adaacdaadc4d30fb5056a2a3904f6b19317e09f254b20659ae52bbd73f0fd470a8f51a4f1e59a1c4e090", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781110592, "uuid": "ea27d5f8-4886-45aa-8a6e-be441aaf16f7", "value": "T1BBC7339AFB56A8F2C5F7B27880234455EAB6BA451320D39F335EA13C3D0A3B558BD341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781110592, "uuid": "07e40d49-e59c-493a-9372-2d577e952b82", "value": "b1c5b1beabd90d9fdabd1df0779ea832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781110592, "uuid": "5beed3e4-034e-49d3-be62-1aa929a507a5", "value": "1572864:xzg/CRT3QKE9Dus6Z6BXpU7mkPTjSYtuip1lIWu9BczPN:x8/CyTB+mkiY4ip1l+2DN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781110592, "uuid": "53e147c4-15a1-4708-a3b5-2e048f990eb7", "value": 57888931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781110592, "uuid": "30fd5e67-a5a9-485d-a7bc-041da2f73441", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781110592, "uuid": "76b04ba3-5f21-4c38-ad89-0806577888dd", "value": "bzdcheats-desktop-setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "950431be-64e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105975, "uuid": "c5e08703-c5c3-49ab-930d-e734cd876eae", "comment": "Malware payload (Mirai)", "value": "d5f95034ca72361969782bc569205c3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105975, "uuid": "27826847-dd04-475a-ba0c-dd92a257c7bf", "comment": "Malware payload (Mirai)", "value": "f2033e86d31ff347ae33de2cd1df5ecc256cb4a0e48c52caf4444e74b29f3ac3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105975, "uuid": "e49c1895-db47-40c8-b582-5aed3045e98b", "comment": "Malware payload (Mirai)", "value": "46df542a47f1ee0cbf8a5595b76c5ce6a143306a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105975, "uuid": "5b3c2dfe-f35c-4054-be24-307b195d7436", "comment": "Malware payload (Mirai)", "value": "3c8a3cf55e2fa96f8858f830d111ec0226a4532f8dd81135ba35d82fcda5af3e2ee018ed62aa239edb8811293ce580da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105975, "uuid": "52ab8f30-b252-4fb5-bc52-4fc471790598", "value": "T1B8538D75D12DAEA8C0424AB4A9598E704F13A0C046733EF7DA9587A69443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105975, "uuid": "82895f9e-9e4b-4547-a2a7-365c48eaf435", "value": "1536:zag/Vdf5F1LwtkbaOoQ3veifs3guba/qzCEZaCw:zJzf5TLcQfPf+gehCEZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105975, "uuid": "96caeed3-570c-4514-b976-83e930352930", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105975, "uuid": "1e636ac1-8555-47fc-bee3-33262a04570f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105975, "uuid": "7378c072-ff52-4c78-8341-86a940abce82", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404a380b-6476-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781059447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059447, "uuid": "410ac371-f205-4a33-9812-5895f192b24f", "comment": "Malware payload (Mirai)", "value": "f00cb8d024d0a6a0a23602c4f134b4a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059447, "uuid": "954879c7-50ef-47ae-8cf0-bdd7826c0e16", "comment": "Malware payload (Mirai)", "value": "f216797f6cc2a7b99b5b56ac4575dc11c07d6dc36ab429e3ff58ce0592f00247", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059447, "uuid": "43d3adb1-8e91-4cbc-95b1-2e7a80903941", "comment": "Malware payload (Mirai)", "value": "da881ae9f51e50a95247a10f506ab6f73d6e2889", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781059447, "uuid": "1cd9a059-952d-48bf-b8b4-20991c236b56", "comment": "Malware payload (Mirai)", "value": "e892ddfcf1e0629399536bb2fe2079d086e37a0d1a6b4d8524771e05a61597b344995f6d602153d562af57158dd37c2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059447, "uuid": "d1da6a3e-e7ae-4bce-9b90-dd2c6f881f76", "value": "T1B5434D92E1945833D4C1C13C4468E2395320DEEE3341F787ECAEB6BE5F83DA87912A61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059447, "uuid": "fee6113d-e4b6-43e2-8a6d-b80eb9cfbb61", "value": "768:UKUWT6tC9SqiMHWmaO/Xz4CTU8N0RVEp65Zj/fCwxJSAB/l3rN:zJGUoM2maO/Xz4Ze0RVEp678ABR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781059447, "uuid": "a1f0215b-b28a-404c-9e7d-9c2c98ad0450", "value": 59000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781059447, "uuid": "a5ff0cf1-4a10-4420-a3b7-fdd816e99bac", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781059447, "uuid": "0e60722d-da1a-4b5c-9c9c-9beaa20233b6", "value": "wife.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb2c710-646e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781055951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781055951, "uuid": "2b19b496-1bfd-4941-97bb-fa6122f6b61b", "comment": "Malware payload", "value": "3c167b6cebc19c8ee7ecb7c9d722effb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781055951, "uuid": "6aaf7dc2-ef37-44e4-8dc4-d1102e53b2fe", "comment": "Malware payload", "value": "f2e0c0e0c1b9c6d4a9d180dc71b4d48320cc8a47a3455103d3b7e9fbfe16dd1e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781055951, "uuid": "f135c398-e55d-468f-b5f6-cff046e19ba2", "comment": "Malware payload", "value": "c08a2359bb5059e95fba25a8686abd1fcb7bf7f5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781055951, "uuid": "655f34b4-79fe-4949-9c94-ca45b6684d8f", "comment": "Malware payload", "value": "0ed7603f431040981a4e9d59fda9badbb2c0cb8934002f84b1f5290322f6e06207c81ddee1e16c2df8a97a6afe301d61", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781055951, "uuid": "a3d3e5c5-96a6-4231-b481-8196d53f0d25", "value": "T19C01AFCDC0078B6050C6F4AD32E76554B820C3CB26858FA5FE6C543E8BA57487069F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781055951, "uuid": "9c149a52-9be7-432d-8ffb-9e4c37582bc5", "value": "24:kXCKysE2hi0ziQvZohakxeiP/4z8R8BrX:e9Qp+Msk8i4zdJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781055951, "uuid": "d263b668-aaa3-419f-a0d8-92d6964d664b", "value": 847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781055951, "uuid": "7bfdad16-37af-47f3-a568-517fd62b06f3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781055951, "uuid": "e7add83a-73de-4620-ae29-fc5d543400c4", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01087d77-64b4-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781085969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085969, "uuid": "ed4cc89a-0d3b-453e-a471-332c1f327d00", "comment": "Malware payload (Gafgyt)", "value": "23c7b157199176ce45f8e448b4904dcc", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085969, "uuid": "fea403d4-9898-474e-851a-2d748209f540", "comment": "Malware payload (Gafgyt)", "value": "f37ed79668941787e69fb196e04e7925a305b337c2f898c1673895b55f5e5747", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085969, "uuid": "61b0ab33-9d74-4444-855f-adced0a4f0b0", "comment": "Malware payload (Gafgyt)", "value": "d7ad4f7d8119231ca5c95c4b662790709aa67d3e", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085969, "uuid": "697673d1-399a-4223-bad4-2a5d0203db31", "comment": "Malware payload (Gafgyt)", "value": "2d90d2e9532349cf947fd2d39c03a5121ace6de1d5e89b2bd226479050b12d8ad24c9a0bc0315789729de3756e63a442", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085969, "uuid": "6bde57f4-9ed0-4569-a9b2-fae056db086d", "value": "T1F9A31258341CD798E6EF5DDCAC14BFB3D7E503016301AAD083A1AADA69B1B3D1F94A09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085969, "uuid": "67f34b25-95a9-4eed-8052-b5b6368c474f", "value": "3072:52I4cQY7tZJVOx8zg7x3ew17ldLLxfRAf4u+qgwz:kW7tZJVOx8zkT17lJLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781085969, "uuid": "007819c9-0199-47e3-824e-39ade317efa3", "value": 107096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781085969, "uuid": "c246d5eb-a7b9-4f74-b657-c9cc444539b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085969, "uuid": "0730827f-a542-4a3b-ba8c-727a16d492a3", "value": "kworkerd-writeback", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd188b0d-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105666, "uuid": "7f3212bc-9288-42b2-86f4-85f9c8ed5a69", "comment": "Malware payload (Mirai)", "value": "e197b4199e3e14da3a5b49c2432355f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105666, "uuid": "191fa2e9-49fa-4e64-8ff5-7a525a3cc1e5", "comment": "Malware payload (Mirai)", "value": "f38731ade8b3ea20b90ef20c452a14aa63e1fd0e4ce4ff0f3785a95049f035ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105666, "uuid": "ff84a256-8e30-47a1-b844-c1b8de65eebc", "comment": "Malware payload (Mirai)", "value": "9d9bdb6bf62ad673165e729a52e1449471cc1888", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105666, "uuid": "5e82a7d3-2745-42b4-8af8-14d6d8ad50a5", "comment": "Malware payload (Mirai)", "value": "9d85368f930ba9d181353f0911740324dc0b918ed9627d0eb881de454bcae82f718b10a8aa19a899937d9cd8a1222a46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105666, "uuid": "126b50a2-9a24-4179-9ec8-8da75b8ea323", "value": "T145C2E03649FE2DB8D271B4BCA930C6D713E34AB1B2B1E52037005B94DE6214B66790BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105666, "uuid": "4be96721-eb7f-4029-95ce-29ecf96b8050", "value": "384:eXNSIfjdxuZ1DUofVOyPqMEQwjLU2AupC5uMu9j6h3JHF5XlT1tUANNphymdGUoR:6jKX9EQWUP5up9uh5HjlTIANNps3Uozl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105666, "uuid": "1615f183-1f97-47e4-ac89-44eb8f489015", "value": 27336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105666, "uuid": "40ebf927-a8aa-436b-8d20-1a82c1a54ade", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105666, "uuid": "430ea08d-b89d-41f0-8db6-61fa4f9e2264", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b4ee03b-64eb-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781109609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109609, "uuid": "58ff9f6a-dd10-43a6-a501-899db437ef47", "comment": "Malware payload (RemcosRAT)", "value": "a88aa83598eb6daeabac1157c6e286f3", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109609, "uuid": "cbef9427-38d7-4ba9-88d1-fa3b4b9f360e", "comment": "Malware payload (RemcosRAT)", "value": "f38f3dfb9fd8272bf10ec883a8f2d552c1380f3b2330530dc4f94b5c060a6145", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109609, "uuid": "02500bca-a3a7-4846-9122-cd5d8c560e76", "comment": "Malware payload (RemcosRAT)", "value": "9b756c141db8e3886cf9ccd7eb3fa754010b7546", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109609, "uuid": "4b9b88a8-d2b4-4494-957d-cc94cd491530", "comment": "Malware payload (RemcosRAT)", "value": "2179595735f4d0cb3e9b05bc3ce0666f5c6ea6ed8af665e802744730ed90a584697b1c5b539a23cbb2ee60b2a4824c76", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109609, "uuid": "03ab8ba5-264c-4775-ae03-056d14dee6a2", "value": "T15706BFCAD56E44D29C053FC9A8142BC78B2547328AB40028366FBD499F774FEC15EEE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109609, "uuid": "f2a46326-cd8e-4d8b-b41c-ecf2cc9fb806", "value": "24576:uwFh98k1m8HOSrYg7qqFu4uGDNqcJHyPJ97vIC608RS6eUGvtThQ5b5HlN9pZBWV:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781109609, "uuid": "ae37698f-0bd7-413f-a22b-2b6ec9d5ee47", "value": 3699707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781109609, "uuid": "960c1594-653c-44d0-a8d2-b89c225de886", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109609, "uuid": "de0b1a59-b08b-46eb-b9cc-09432ee5ad9c", "value": "stub.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32cd004f-6506-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781121272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121272, "uuid": "b2118bed-9bef-4627-a5d5-a3c6e1c8ce50", "comment": "Malware payload", "value": "d3233764ce04f6ee5e44910173f1bcb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121272, "uuid": "3ac7a34c-181f-4972-ab72-505b4f9855ec", "comment": "Malware payload", "value": "f3a3acfb5acdfbc0faf221472aa12a0c37e4d7fdd81379f442233fa72e0a43c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121272, "uuid": "6ad9a5ff-4165-4978-a13d-14eb403d6417", "comment": "Malware payload", "value": "67a1748c1b70e82f038d5ee4243f4810b92782f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781121272, "uuid": "acec9cda-21fa-4aa1-a53e-22ac87c1a000", "comment": "Malware payload", "value": "7eb570e6c1cbcdc3dd83b629101483994e0819db1ef8b9cb6dfce3815658850e81ae291f50c011190dc46c21980d8f7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781121272, "uuid": "d9f875fa-b084-4e19-844e-a54be8c48410", "value": "T10A63E6657BBA0A1BC5D4F47A62F75222F2B1C78A10B8C6173EA10E4DAFE558031137F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781121272, "uuid": "6a98b18c-f908-46f3-bcea-d437bce638ae", "value": "1536:DaUINdG4zLcN7ML4FeP8pCP/3qnEeQJigwdGnw+KA:FCc4zws8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781121272, "uuid": "cf489858-cd1a-451a-9c14-fe1bca7f2f65", "value": 68664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781121272, "uuid": "b47849cb-845d-4c40-9815-dbf76c0d1c22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781121272, "uuid": "36168798-84e8-4bc2-8240-12b03f885186", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2742d569-64b4-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781086034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781086034, "uuid": "a3f7b63e-53bc-4ee7-9deb-84d9556887cf", "comment": "Malware payload (Gafgyt)", "value": "123875156216213a6f4b9995151926d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781086034, "uuid": "b1c4c6c3-7d8a-4d98-9e76-3d621b186a57", "comment": "Malware payload (Gafgyt)", "value": "f4397ea797284d4d4b3c846efa344a523261ca3476064887bfe53160bf5ad70f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781086034, "uuid": "ce32fcc8-c825-4894-84cf-27abd0935f93", "comment": "Malware payload (Gafgyt)", "value": "b3322a61421fb04119b4fee61a3ec25c3d68177d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781086034, "uuid": "3726f3d8-615b-48ef-8ab2-a53a7711fd96", "comment": "Malware payload (Gafgyt)", "value": "74f5a64a1c9e7c04f91f06f7deb7c7ef63de0bb036e6d2b9f70817cd1cff80e107843c145413c60d830e8c3597823e77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781086034, "uuid": "21aedbff-8c42-4996-b1bc-a6e647331b89", "value": "T1B8540856BE419F17C5D216F7FBAD4288371A7BA8C6EE3113D8146F90379A48F0E3A241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781086034, "uuid": "d3913bd1-0f86-492d-83c5-8e103c2c6fb4", "value": "6144:PgK7DB48YxQscf/J2Z0+UrPJ7aqyAKaYN4rpmJpJKCAi9tD1rGl:P/DB48Nswq3UrPcIYN4F8AIRGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781086034, "uuid": "05fddc53-157a-4424-947a-48fda15c20d4", "value": 291268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781086034, "uuid": "4cd72141-472f-408b-a0a6-304b27779c29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781086034, "uuid": "f90ccc80-eb06-47ca-a727-737f589dfe33", "value": "kworkerd-irq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd43cac-6494-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781072271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072271, "uuid": "93f2cf93-5116-41b4-a741-91011d823fe9", "comment": "Malware payload (ConnectWise)", "value": "1943d0d922a5e5451f98cb137347c379", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072271, "uuid": "e318c9bf-ecea-4608-b906-57cf9d49b9c3", "comment": "Malware payload (ConnectWise)", "value": "f44e17694a0684a1e44dc42e6ffc91bc6a8104ed1d3d6bc638b42b0e8d4cbd62", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072271, "uuid": "16032fae-9910-4031-96eb-58bf6dd27113", "comment": "Malware payload (ConnectWise)", "value": "174cdf8a37c6faea60d9e68ebfa804e37d45664f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781072271, "uuid": "b466f0a6-80f9-450d-99e8-8c9dc2ef143d", "comment": "Malware payload (ConnectWise)", "value": "e3c73a0b470fc023b01acfacd3a07e907813918816063ebb1310c0d0c632df7644355ad513349cad163823a3da30d20d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072271, "uuid": "625dfa51-d3d7-460d-ab35-98fc1bd46983", "value": "T18246E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072271, "uuid": "4e4fd9ad-c9f0-4638-acb8-46949cd114ca", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072271, "uuid": "fe3a9e07-66d4-4af8-adfc-9c7efd78eda4", "value": "98304:hzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:hhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781072271, "uuid": "74427190-959e-4d6a-9f60-1166f2af67e4", "value": 5643272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781072271, "uuid": "0d6f18c0-b6de-498e-a39a-58fa8607fcf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781072271, "uuid": "8bb9b59c-4be8-4c60-9d97-32c466c62c1b", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "379879d2-6471-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781057285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057285, "uuid": "c487a996-4666-4e34-ae70-559abcf24c38", "comment": "Malware payload", "value": "e93c140f37c1bd91b5a28264ddd0cc44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057285, "uuid": "070eff19-70ce-4de1-b36f-bd865526a37d", "comment": "Malware payload", "value": "f4676173b9ab9c5df9228c9b4f1bc166fc9e5d86d7f8e6e50466b0e22e843841", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057285, "uuid": "b181d3a2-8534-4bce-ad69-af429223f017", "comment": "Malware payload", "value": "512e43672f09d4756ed5862195fd96cfbca3e629", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781057285, "uuid": "34ff1d9e-8c7a-49c8-bfd6-6bdb7e88f2fe", "comment": "Malware payload", "value": "a851b703f37a47f76e71bdc121515ca0df05171168e84f1913a5e55325f1ed33b5aa69630ba3f207f42bb560425eb66d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781057285, "uuid": "959ec73c-4884-42f9-a2a8-c45318660bb0", "value": "T1AE937DC9E992F4F1F55301B12926D7B38633D43A2067E987D3692E32DC71650D72A3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781057285, "uuid": "020014ab-dd10-4260-982e-03258128325d", "value": "1536:zT/L8GEQKeVuHaJZqNbqPvQevkSDS4ISWu2IYGL:zVEQ7gHaJZqF8vdjVWu24L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781057285, "uuid": "e87f8229-efbd-40f7-a548-69fe2401f612", "value": 92200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781057285, "uuid": "3c85e8fe-0f9b-4750-bc76-46542c6b73a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781057285, "uuid": "7affd6e0-12df-4024-a09b-4538cbfe24e9", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe1d5b31-64f9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781116029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781116029, "uuid": "0a17fa33-bbdb-40a2-875b-61386407bd78", "comment": "Malware payload", "value": "5333a678d12ba3b5813762fef43f54ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781116029, "uuid": "4141e6b9-1554-42c8-b9ad-77cbdf492d5e", "comment": "Malware payload", "value": "f681fd6ce59054691f794374b12e01e930c203131fd77d257f025e35f0f63e8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781116029, "uuid": "f5f9b3f3-c90b-42bc-afdd-767acbdb8a9e", "comment": "Malware payload", "value": "d45acde9e684e2882022ef1c4de7535ad9004454", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781116029, "uuid": "e2e2ba6d-4010-4999-a66e-063854b3e7d3", "comment": "Malware payload", "value": "9a34fd44ab53ac4acc14d6bc553d84d6f86eef19b09347ae44c2342bcb5e947fbe600b5bf7d12c019a44947d0f5e7c2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781116029, "uuid": "1c0142cd-3423-4083-a1e4-c49eec9db262", "value": "T1FAF4CF2B76928E12C2C86337C0D7590593F4D6867637E70F368613961A073BBDE4A39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781116029, "uuid": "43197411-0865-40ca-b5e5-21e4ea9a4f04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781116029, "uuid": "67c3fc01-9e32-4c7c-a9da-3e7ceb49bc6a", "value": "12288:BBpuTVsAbnxKmaKGkerRkAz9LLxL3EMg6PqVtDuoRESFLPEtcVgBZe+VLr7Txu0X:BMnrZGPxLxL3Pg6iHpJocVgB8C00", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781116029, "uuid": "87e9903c-4bfa-43e2-ae6b-d0a578aef77f", "value": 780800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781116029, "uuid": "b9243a19-4f23-4358-ad32-ee868d887731", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781116029, "uuid": "d3cc5b21-31c5-43ae-a68a-0027bcd252e0", "value": "SecuriteInfo.com.Trojan.PWS.Siggen5.33840.17593.13210", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb81247-64a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781078203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781078203, "uuid": "c85fbc53-9364-48b5-a4f6-a0afff12117f", "comment": "Malware payload", "value": "c94217555cc96641720ef3960daef32f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781078203, "uuid": "fbcd9cf9-e5de-43e0-b967-d94d894d3648", "comment": "Malware payload", "value": "f6dd217d20a907a6cbb9998c50f28e3bbf6154d3457fd39c00ce324f37140714", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781078203, "uuid": "81c5c5d2-a495-451c-be50-30baf396bca5", "comment": "Malware payload", "value": "70683a490d6b7ca4d08a8ec2c93ae377f059bbe7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781078203, "uuid": "e6bd97ac-5cab-41ae-b0f3-17a18f8f5b64", "comment": "Malware payload", "value": "167ce94f00dc873ec87663ff4fcacb769a3e0e70fabe72d6e694f01e9a5863acff03cdeb55f8defb9346e23c59aaee8a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781078203, "uuid": "3eea9397-95a1-4a6d-9a59-b5bdc93977f8", "value": "T1F001AFDEC005866055D6D86C36976088B811C3CF2A418FB9BF9C543DCBECE287019F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781078203, "uuid": "c7eabe84-4624-40c3-9e4f-93f4441ba6a9", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaPfIjvI6APx8IxqX1EaSIYPBCy7SIk+X:kXCKysE2hi0ziQvZohaPfKheqX21n+UX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781078203, "uuid": "1cd9fd56-ec03-489d-b0a1-c23eaafbd58a", "value": 847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781078203, "uuid": "7496fb40-07a9-432f-9349-4a2c52cfd2e9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781078203, "uuid": "952c53fe-c381-4b01-aa83-c626705e4c09", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce8562b-64cb-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781095868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781095868, "uuid": "d395518a-c940-4ea9-b44a-90e1d177bc3c", "comment": "Malware payload (Formbook)", "value": "ed5de0ec5384e65e37ea5d3e22b3c23d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781095868, "uuid": "e122ac5f-96c1-4440-98fb-68404fd493ed", "comment": "Malware payload (Formbook)", "value": "f77faf7d8d425fdbb25bf7498cd5e6704da674aeb8c6561becc56dd9976be038", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781095868, "uuid": "28278172-1886-476e-a67e-96d1fdb7167e", "comment": "Malware payload (Formbook)", "value": "acbed09c784bcb032b6dbc5ec045f00cb1474118", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781095868, "uuid": "c5721ba6-1f7c-45fa-93e2-99c2533f3364", "comment": "Malware payload (Formbook)", "value": "97f7b70e8bce9a36929d327882ea9c196fcac53c0ebbed8ecd02dda2891c0ad4a5f2077d9d7566e304c7a0a59cbac32f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781095868, "uuid": "fb7abd6f-f0c1-488c-9d8a-113a7a051429", "value": "T13D45E0225D462F58C6BF1BB8C067184823F2DC439F96D7DB2EE849E87BA3B45C916413", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781095868, "uuid": "6d3dd27e-cd95-4ff8-9a9c-302713f245aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781095868, "uuid": "b12e7705-d585-4163-881f-02b04950c0e1", "value": "24576:ZPr14da/tXeT5ySthrvV4KcedMZGRpk+8:Zjyd8Ow0rvrcQMSa+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781095868, "uuid": "fec2ab7a-20ff-43a3-8eb2-df474167f814", "value": 1249792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781095868, "uuid": "d249b150-752d-4904-a072-e8174e35701d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781095868, "uuid": "129a4b1e-cbe3-43e3-a6bb-8a6adda0492b", "value": "PO_2026.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e244749-64eb-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781109614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109614, "uuid": "e353667e-26ce-47fe-b130-e05261806c65", "comment": "Malware payload (RemcosRAT)", "value": "76f6fd862acc2129917596caaa1e3126", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109614, "uuid": "09d6911c-0181-42ab-a3a2-ab217fb04edb", "comment": "Malware payload (RemcosRAT)", "value": "f78b1bc5110600861c39caea879cded379762e13098adc227159c6cf137ed115", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109614, "uuid": "902b80a8-b5b5-4c6a-acc2-800701af5db0", "comment": "Malware payload (RemcosRAT)", "value": "465d272a33a276e2c5b64e3d8a0966f8dfe2c999", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109614, "uuid": "ee15ec2d-79a5-4051-9d5f-a18e8a9a7761", "comment": "Malware payload (RemcosRAT)", "value": "3e40162f6abf285266348df4cfd9b0a6c37dcd189678cffe488f3672cd8c863c44cc01521fb70f1de8d78ab3ec818bdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109614, "uuid": "9bf609e8-cbf0-4d24-892e-a9af19478092", "value": "T1DC8564302BEE1059F573AE61CBD8B692BB6FF7E33206E9DD1500434E5222946DEC4939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109614, "uuid": "d6c0e22b-1c86-487b-9de7-978cc3a7864d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109614, "uuid": "bae22ff4-0d94-40e0-ae24-48b122a8b096", "value": "24576:JH3/7Xh+GwVtFHmSknreTLO7UsLg6Zr3x:h3Dwf0pnreTLO7Blx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781109614, "uuid": "99eddfb0-3891-4cdf-9b5f-9acb17f377f5", "value": 1821184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781109614, "uuid": "bde869f9-bbba-4307-bc29-00257b0da29a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109614, "uuid": "d84fdc9e-8421-412d-80f1-63a3000d0f4f", "value": "Visor+Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f50108-64a6-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781080102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080102, "uuid": "c1de3e42-3b1a-4c03-8b79-8887d9755a12", "comment": "Malware payload (RemcosRAT)", "value": "1dff8fc983ecc5f984b2a0b8ffa69682", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080102, "uuid": "d9a34fdc-83a9-4938-9969-bb201910b74f", "comment": "Malware payload (RemcosRAT)", "value": "f79cc0eb8f04ac52c8348cea792ee75b4697487da0aa71c852d6339d5c7e1eea", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080102, "uuid": "8e372295-aa82-4a82-82d7-df93c5f6a634", "comment": "Malware payload (RemcosRAT)", "value": "eff18dd91e3fb54aca9b3f2bfd7989c5be82ffc3", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781080102, "uuid": "b64bcfe2-a6e6-4f5a-8110-3f322452211e", "comment": "Malware payload (RemcosRAT)", "value": "58fdd71a1fb90272e62d3d7d28d824b9641dcc4a99e026bee0e770f88f3d03928aae88051cdbc7506e55392a01fd96cd", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080102, "uuid": "c14aee56-e909-43e1-8f4d-131d6b03fe2b", "value": "T18E927270DB8A0BD1B98367BCCCD03A64B6B4CFA1517244DCF9A10784A10DA78FB65E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080102, "uuid": "d59da971-c7fe-4b24-a385-230e4e074a2b", "value": "192:RQuqavOGnqF8T7oPbXEAbVGd3YkVOT38m0SjtbggPKkWCGcRQrInNI6ognA2BOWJ:ROBKqFh0AKQeVONs2D3oG9QbEzgBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781080102, "uuid": "7530eae3-b3ee-45bf-90a6-695e80dce4c3", "value": 20430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781080102, "uuid": "646a46d8-25e0-482b-8921-5069bf026c7f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781080102, "uuid": "ca56a8d5-3f55-45c3-8a2d-e3377f34fdb7", "value": "DHL Shipping Documents.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c0c7ec4-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105530, "uuid": "aa8df0e9-0855-47be-9f4a-ef664352333d", "comment": "Malware payload (Mirai)", "value": "77ac671b66d5e6af5ec26f908b6458db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105530, "uuid": "9d23bbd0-b0c2-41bd-bcb6-12b623c7b23b", "comment": "Malware payload (Mirai)", "value": "f7fe4e262d4a78b2874260ac5e700b2ee50f3f27811748a5d55b5af925389c67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105530, "uuid": "4a126bac-1929-41f2-b47e-086f869c8eca", "comment": "Malware payload (Mirai)", "value": "d47d710aa91d370433f1730c22ae9943fb46b8a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105530, "uuid": "e8381e08-4494-4fde-8bb1-e24195d4fe24", "comment": "Malware payload (Mirai)", "value": "259d4feb0e177c667c5aeec963d9790ed7e5675c38204e2c9f2e33b1330f6ae9a77044a84c495243759413492dcd96b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105530, "uuid": "b70e0354-efd1-49a3-bdf0-55aff5cee0b4", "value": "T1883319D6B401AE7CF85BEBBA8022490AF931671151930B3B637FFD936C322958D63D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105530, "uuid": "7197bc9e-b50d-4db0-adf7-cbbc4f2afde0", "value": "1536:jv+IiJ/uKbd/GqHvg4Hb2KfNnG5iX5VT5PBR86t:dcd/HHL2ApHT5Z7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105530, "uuid": "4d377513-e973-4cf9-bb1c-ca8282595691", "value": 52584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105530, "uuid": "be45ff06-537e-42b1-b6e4-87ae92d96375", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105530, "uuid": "72303af9-82ad-4ca7-89dc-354cb3b4b3eb", "value": "miraint.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea036c0-64cc-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1781096434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096434, "uuid": "88fcdde8-3bd7-42d2-90f9-e24936215726", "comment": "Malware payload (BlackMatter)", "value": "ac20273a59fa9af033d22c1d25ac390d", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096434, "uuid": "2d43f089-609f-4a1f-8665-bdc228b6bc0b", "comment": "Malware payload (BlackMatter)", "value": "f8850a32d2b21be78972966fa0cc0d809b997fa80eb27a2e0be95e83ffd21463", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096434, "uuid": "51ecf03a-f97f-4a04-98fc-a30663d0ee24", "comment": "Malware payload (BlackMatter)", "value": "0540954398693e3e64685a822b45167d3a55f753", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096434, "uuid": "206a9761-ae8e-422c-821a-c1647f390bf7", "comment": "Malware payload (BlackMatter)", "value": "3d73d5886ef90fb4ccca0d2789cca826ddba477e6645cfd07bed8f349276242ab54f7b956fa2172a97c3e0646fb7efa9", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096434, "uuid": "25785c9c-d9b3-4453-bc96-54f7eae4cfb9", "value": "T1BAE36D21F212D073C87718F13736B172F39E8D6C19A96847EAD80F99BCA58232F45997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096434, "uuid": "880b0f62-13f5-4516-b54c-4064fe4db11a", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096434, "uuid": "a9b1a9bc-9c05-4ae1-9322-69afcd159e8b", "value": "3072:o6glyuxE4GsUPnliByocWepWLsXqRdUiGoYwx1J:o6gDBGpvEByocWeA4XqvUiGo3x3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096434, "uuid": "481444ed-9dac-4fc8-bf25-3b4419483488", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096434, "uuid": "572c90a8-ddcd-4ab2-962b-f3402217db22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096434, "uuid": "8ac3003d-f9bb-4e51-a728-4dcdb62eb4c8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f705b223-64f7-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1781115158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781115158, "uuid": "984d749b-e0f6-4d3c-bcf7-2934141fda23", "comment": "Malware payload (DarkTortilla)", "value": "dfdf19924c93af2cb726897d89f0210c", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781115158, "uuid": "9bc5f272-5a46-4ede-86b9-d5e50feaab6b", "comment": "Malware payload (DarkTortilla)", "value": "f9c1c4d9c91dae06fac8597b5cf6e182060c6fb99df5b066e10ff7560fd3b168", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781115158, "uuid": "fd94518a-ac24-491b-baa5-8d999a14b081", "comment": "Malware payload (DarkTortilla)", "value": "89e64a4d93119c6af13f4f9c97b0c3a24e268653", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781115158, "uuid": "12b477fd-2f22-4ebe-99eb-c3daa5e89266", "comment": "Malware payload (DarkTortilla)", "value": "feeebe9f5993a479c38f9dc244f55ab149d7baf4b9cdd887ba9c596105730b5dc4e32161200ba3c46cfda83c7bc7e6a3", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781115158, "uuid": "4fcb32d8-cfa6-42ea-a9a1-a58ddb5c323e", "value": "T10765F1265EC33A85C2D94FB8D16A089873F4C55B4356E7BB2EED02F4CE93B89C907512", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781115158, "uuid": "739b7074-ff19-456b-b95f-f57dc8e24159", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781115158, "uuid": "c36b0e7b-8e2b-474b-b47e-0aedfa76b6ed", "value": "24576:qDnQ0Sujgbd3vAtr77eHC4s9hCwCQgR5mtjOvUWOCsb6qJd2YoJ:KXjq3pHC39EbYCOx6q/v+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781115158, "uuid": "ff70051e-02fc-439c-8699-2982b1499f9e", "value": 1423360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781115158, "uuid": "919238f9-a014-4d65-bde1-10223ff9084a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781115158, "uuid": "5338909d-4cf0-4e23-98fd-05df6c2061f6", "value": "FACTURA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ed27103-64d5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781100166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100166, "uuid": "8c289c80-7bc9-4d19-af41-f942ef369ea9", "comment": "Malware payload (Mirai)", "value": "43bab84f8755fa59ab3a1ae8684d459c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100166, "uuid": "dcdc8bd4-1c18-4cd8-93d0-c77e1bb68e2c", "comment": "Malware payload (Mirai)", "value": "fa0a24391d136b83e48ae57f6a58b34d34c9692c076398bfbf5b8ee20b8b17d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100166, "uuid": "97a5e004-6b23-4302-9f2e-9c1b8ace7c21", "comment": "Malware payload (Mirai)", "value": "87bae2b73d92e266dd7f5dd3d4a4e6fa29bd127f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781100166, "uuid": "be49c0c0-53bd-452f-a25a-0cfe12527346", "comment": "Malware payload (Mirai)", "value": "840c19f20b7e61062350892de0d95e11208554bb87916b1960af14b6911e55c3205a8295ec4ae77e96be3853c8718843", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100166, "uuid": "cb5e6d07-8458-4f0e-9168-60a529149261", "value": "T177C30946F8819B15D5D151BAFE0E124E77231B3CE2DE7302AD14AB747B8ACBB0E3A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100166, "uuid": "706b99f7-e680-42e2-a726-f275d750cfa2", "value": "1536:sEn3AzQWDHhFBKN8cyFPQ1YXyytL3hTGiFiYCHoVEKxMUX4b0m0WAdTcA2aT253G:TAzQUhcTmXn8HoVEeMUX52ajA47J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781100166, "uuid": "15068b1d-31ae-4b14-82dd-3e6f392098cd", "value": 121232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781100166, "uuid": "2491da0a-ebc3-4109-a46b-bd346de9a1fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781100166, "uuid": "69aa002f-ba57-45d9-abca-98165fe4c83a", "value": "zero.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8def2852-64cd-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1781096943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096943, "uuid": "21e2ee67-f29d-4aa4-b177-ff1d6564e61f", "comment": "Malware payload (BlackMatter)", "value": "b72d50ea8dc21d86430efdcba9646d39", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096943, "uuid": "38a9acbc-cd1a-455c-95a3-b23256a5d721", "comment": "Malware payload (BlackMatter)", "value": "fa361c712381c82552952e348c36dca949329db6ea6088c7228c3884ebb0bfe7", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096943, "uuid": "0b9a4cd5-f7ca-40d1-9ec1-a291bc8443db", "comment": "Malware payload (BlackMatter)", "value": "c3927aaa94c768095fe983d5b46876fa080dca02", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781096943, "uuid": "b5e16259-e96b-4fcd-afbe-8330e80aebf0", "comment": "Malware payload (BlackMatter)", "value": "4d1ad8f05afcd841ac56e4b3420e96bcab6fcdb264a708b9a671c04a55495382a5920238b64882d48207bae2b623cdaf", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096943, "uuid": "6b25c86b-5e00-4f20-ac4e-19609febffbe", "value": "T1B8E37E21F212D0B3C87718F1273675B2F39E4D2C199A6857EAE80F9DBC648232F54997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096943, "uuid": "b0cc0a26-ff80-46ff-a493-014cea36e9cd", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096943, "uuid": "dff319f7-ecb7-4ba6-bb28-9a20eadfdc7d", "value": "3072:O6glyuxE4GsUPnliByocWepu7JFibU4BQu:O6gDBGpvEByocWeM7JFio4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781096943, "uuid": "e6c49535-5462-4523-84f6-cd5f4e73e87a", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781096943, "uuid": "7891907e-53d5-46ff-91e3-2a0f50f0725e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781096943, "uuid": "5a422d67-c021-47c3-bfeb-6a2a904f7ea0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "388cd725-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105390, "uuid": "4cd62add-0eff-4e22-863d-848365a9dfb0", "comment": "Malware payload (Mirai)", "value": "2347cfe0ea76003dad50f9d6413777d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105390, "uuid": "8a3b6372-60f9-4899-8626-705155db2093", "comment": "Malware payload (Mirai)", "value": "fa56984ab3af271f1b98e625e0f5dc33be6be1635d9c86ca08946f597400d051", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105390, "uuid": "4409ea51-42a7-42ea-8d8d-ced7730a602d", "comment": "Malware payload (Mirai)", "value": "bf82218f077ce1e90eb9de70f7def3b556f51a75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105390, "uuid": "ae368c0a-776d-4af8-818a-b8f1d6acc44d", "comment": "Malware payload (Mirai)", "value": "0b7bfabaef250f395b2ba544aa14f4975aa57f7735b966c584a7a93919930fb289e051aa071cbf225670963713fa8a80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105390, "uuid": "3ea81f04-2ebc-4f7f-a0e0-ce1dbc7a7b7e", "value": "T10C933AC7B800DD7DF84FDBBA4463490AB670E2610E930B267727FDA7AC760A54427E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105390, "uuid": "b2182800-7b9c-42d5-b7a4-fe0f5243592c", "value": "1536:iC+5sfAnRtvEHNTtns4nbTNmXwHDPR8Trk0mFl2iz6bbzmCkFQldoLLJPS:IXvI9RPtUwHDPWkl7z6vnldoLdPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105390, "uuid": "26d8c25c-b00d-4476-8790-1169bce17c0d", "value": 94888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105390, "uuid": "90dd1564-5d3b-4012-8df8-d3b620956e53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105390, "uuid": "8ccf0865-17a1-40d0-8aac-50ca291e5ce0", "value": "tdhyctkjq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "923956a4-64aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781081918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781081918, "uuid": "b7b09bb9-645c-4f42-9ffc-e17672aa2838", "comment": "Malware payload (Mirai)", "value": "bb75167f466646ee1737850150aa7d0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781081918, "uuid": "18174a4e-67dd-464d-b79c-bed092741bf7", "comment": "Malware payload (Mirai)", "value": "fa721394c370ee938bb944e37583c7a6b7757dfc0341c76c357011135485d082", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781081918, "uuid": "3bfe49af-f7c0-40a7-8ae6-f155cdce0649", "comment": "Malware payload (Mirai)", "value": "d7fa35fd38e2f1f6e824a71660fabae385fd157e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781081918, "uuid": "e2e48550-24ca-4925-886b-eb7c98feee28", "comment": "Malware payload (Mirai)", "value": "2fe9de9be6edcba98a60ae353430dd8e984c31b697bc4a33cf66820451acda4288f116cf83f95cd56aea328029d9572a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781081918, "uuid": "fc47cf1f-102a-46dd-9383-d7373b192cff", "value": "T1E2E3AA5E1E228FAEF66DC73047B74A25976923DA23E0D684D2ACC1142F2435E541FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781081918, "uuid": "f34f0eda-ca4e-479b-bb4d-b9ac49d8671e", "value": "1536:Fgc/40iY0iBZi4/Nqtx918FE32pTakLB7Kie0RSG+bxhxTGAP1UeF2+YZhTgGRQ/:Fgc/DA532pTakLB7nRSGWt1TF2+UBRQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781081918, "uuid": "daf3989e-b4b2-4894-b5e0-f1e563a7c508", "value": 152824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781081918, "uuid": "ea93b903-51f2-49cf-bc2e-c1c1af6eef6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781081918, "uuid": "126119df-217e-44f3-b6dd-5bc5ab9e005e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3636cbc3-648f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781070167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781070167, "uuid": "592eca7a-a9be-4b71-a3ef-b5363416fc69", "comment": "Malware payload", "value": "08273e809e1efc390d7dac40f5fef09a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781070167, "uuid": "4f6c5d9f-3f68-40c9-bb5a-c591e6ee153d", "comment": "Malware payload", "value": "fb103c725f1787f74de047cfa33c6dfbbca156792904206725e14b0843ba00ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781070167, "uuid": "66be1ce6-3035-4ec2-8d17-f4bcb0c7a3c5", "comment": "Malware payload", "value": "2e2ac959714427b5a96c51feec0a5cc56eace21f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781070167, "uuid": "6c7e9709-5c9e-4166-9c38-135c151dcd5f", "comment": "Malware payload", "value": "93d8e5b36e7968e3a716ec027afeee545e920e081b84fd9107f1cb8cb6a745110f8470da892095067f6752601cacbe08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781070167, "uuid": "732fe4ba-f416-449e-ba66-6528327eae09", "value": "T134953388F3828FADD847A1B10B7C21362EF13DFA21526169F493799615FDB1AD0C948F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781070167, "uuid": "a1182090-2233-46d4-98ca-846d809a3c6e", "value": "49152:5ZsA/sRYk6TBiepI+myibk8bVvGZk+g0O:5tsRYk6TsUXRibk8RvGlg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781070167, "uuid": "9d73ea87-53fb-47fc-87ec-a9ae1c89f190", "value": 1903884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781070167, "uuid": "e629e4d5-d58c-4905-927b-77f746c96f04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781070167, "uuid": "00ef968d-34b3-4192-a67d-3f8ddb80dc44", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d247b4c-64eb-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781109719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109719, "uuid": "1f562036-505b-40b4-8df5-fb81cd52b8ea", "comment": "Malware payload (Vidar)", "value": "bafd8c6db32eae523cf75bdcfa8e3393", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109719, "uuid": "e0eda4af-cca3-4609-879a-71cd496520fd", "comment": "Malware payload (Vidar)", "value": "fb4568b7c5ff0dcc157b71ac3a5f4d55161b75d169f323d986b0655d2701d0ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109719, "uuid": "9d02f50e-0884-4e63-b069-4154eadd4dd4", "comment": "Malware payload (Vidar)", "value": "1ab79c0085070b049302ebfebfcd2d53ae0fd558", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781109719, "uuid": "78a08d26-28e2-436d-8417-33f953a0502e", "comment": "Malware payload (Vidar)", "value": "8e224b5e7818baba5eae0cc5ddb02643bccd3406a82759b17c98b625823f396b2e1e4878c043ff3671ac33013b6ef0f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109719, "uuid": "376464d7-9e1d-4679-be99-ffa2bb4903a1", "value": "T1EFD58D4B6C980DF5D06A22318CB35291BB717C250F2653C36AA5F7B81FB27D06D3A3A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109719, "uuid": "03e69388-f455-4e86-805b-cdb63dae1907", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109719, "uuid": "b084e217-454b-496a-a461-d07fcd4e70ec", "value": "49152:nZXc/fIsijVyeAqDkJSB8iV986SxY893/xRrgzf4j/vyPIHn3:nwvPqV986STh/Drgzf4j/vyPK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781109719, "uuid": "367eb2cd-4212-43b8-96fc-63c6c7de0373", "value": 2922400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781109719, "uuid": "13cebb0d-21ff-41c3-bc1e-08e145854dfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781109719, "uuid": "3a517d1a-41be-4c62-944c-6c7d01b63282", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1080758a-6470-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781056790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056790, "uuid": "1be7c7c6-5a5a-4b89-94d2-35937fafc79d", "comment": "Malware payload (Mirai)", "value": "011be9d9d016df7cdaa810e4ad50b490", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056790, "uuid": "43f73557-d374-4414-bddd-3a8b832e3a71", "comment": "Malware payload (Mirai)", "value": "fb5dc78d2edf4e30d7a73df176f90665910508558f6ce12c9178d113ca8bb30f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056790, "uuid": "fe94ad49-2b41-4f5e-8228-b8cddd216bf5", "comment": "Malware payload (Mirai)", "value": "0772b91255acdb81e71044c490649697f59f4899", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056790, "uuid": "29416f33-2f39-4e5b-ba80-e1d0075f88ad", "comment": "Malware payload (Mirai)", "value": "58a46c88cc3c370c4b806f9daf22fa2a409a0ecb5114920c9f46dcfbb077a1f5c7ee2534f4982f66afc4abc84ffabe5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056790, "uuid": "0ec20d3f-fced-45e0-a6ee-28557882c406", "value": "T1584302215B5878B6CC3404F5F6298B56AE1D1DFAD1EA337FD31AC106966BCB5C0AC603", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056790, "uuid": "d0d58ed0-9469-4314-b514-16bdaa3bdaac", "value": "768:2c7fWZ0t+kgKqWJQm0VJn3vfesPJxX7JXPbOD8kXJFAwIZlSNI9xnyiTEdg+Ow3h:mZ0YGJTy2EjVfGXHALUNaxyiYCRVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781056790, "uuid": "abb758dc-e411-4050-acd1-898037fef9eb", "value": 59200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781056790, "uuid": "e3dc972e-9990-464e-8bb6-e67506fd4816", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056790, "uuid": "4bf91277-0bc6-4ada-b421-01cb45719800", "value": "wife.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda8ecbe-6511-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781126310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126310, "uuid": "b582311a-c65f-4bdb-896f-f6b61cd382ce", "comment": "Malware payload (Mirai)", "value": "ec3d145b2ca9244130df2c2ef3ff6eb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126310, "uuid": "b7c44c2d-11f5-4246-be42-e6d68f9f1d6c", "comment": "Malware payload (Mirai)", "value": "fb6e1f32318f2b5504f0a2d6a942fc570c1145b944b261fd184c3d3b98f9ce42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126310, "uuid": "bf9b4c3d-afb0-460b-85c1-d5485fc01749", "comment": "Malware payload (Mirai)", "value": "8266c9389510d8820eb4a190519bd95508994099", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781126310, "uuid": "c035c1a9-a437-4bfb-aef3-9aeffff85d07", "comment": "Malware payload (Mirai)", "value": "bd5209b99b34d9e20cbe43c7371a7f6470d54489f97f259846d1d8840149439690d9ab95988f533ac2b1d283eff5a115", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126310, "uuid": "7d4ce0cb-72f7-4146-9c5b-ff3e4589f115", "value": "T17333F885BCD29A1AC6E0537AF96E809E331073E9C2DF7623CC140B1176C655F4EA3B96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126310, "uuid": "68e1ff15-cd22-48cd-bad2-226967bc168c", "value": "1536:RfinNXlMJZdy9imMnjkYm7JSWOCrNO+1gAD2yKCQ5KkzoEOSSSSSSSSSSSSSSSSc:RqnNXiJy9j2yBezohSSSSSSSSSSSSSSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781126310, "uuid": "11f023a7-9f81-4822-b057-069ea9acac7e", "value": 51392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781126310, "uuid": "8e5e0dd3-b1a8-42c7-a293-f8b87e901d6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781126310, "uuid": "79517997-80e1-4650-9c36-f7d04e94a4a7", "value": "kwari.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4beef6-6492-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1781071736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071736, "uuid": "c4a257e4-f863-4c8e-8666-15fb466234c3", "comment": "Malware payload (MassLogger)", "value": "05f37e62c283c4c4296a6146720576f6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071736, "uuid": "d3e47709-b89e-4dee-867a-60d1d22e7ef5", "comment": "Malware payload (MassLogger)", "value": "fb8a28149cfb7b73aba293a376165db94c3c2b4bffe59965997cc8978ae15686", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071736, "uuid": "36e0fe78-e61d-4992-848f-5a41dcecf73d", "comment": "Malware payload (MassLogger)", "value": "7b7cf26485128edb5a2b05ce83a3bffc390f8a57", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781071736, "uuid": "8fa283d2-1c6b-4b3e-bbd9-d478b5aed436", "comment": "Malware payload (MassLogger)", "value": "f3aa49604308ccd3eaa81c512f172d6888f73fde9ba982db857c397a10ea2b4debc3fd9d73ebf32ab87b0a588e7bed73", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071736, "uuid": "edf1adf6-05d9-4faf-891f-73767ebac1ff", "value": "T17805C73DC914012EE576D629C44A052FF9D26A4F123CD90360CA6B5FAFA384677C73AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071736, "uuid": "966ba13b-1e1c-4540-b0d5-9040f32716c1", "value": "3072:Kk6+yk20iD5GQROX8d1c9FsTLVGaktKgGJx1tpoh2JPSQUaMnd8wG6r4FYIfb+/H:rchZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781071736, "uuid": "832515d5-c559-4a99-b85a-90e37d4b2b20", "value": 804512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781071736, "uuid": "6ecccec5-3bde-4e56-a1b1-979b24446c46", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781071736, "uuid": "11a6f4f4-80cd-4e6e-a470-19d252b8c735", "value": "Cotizaci\u00f3n_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d20d91-64a5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781079553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079553, "uuid": "31f4ca6d-4795-4f85-9126-d7dc6f6128bc", "comment": "Malware payload", "value": "61b9ad4c90572c5f6ec8e0927982301b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079553, "uuid": "f5a249d5-2225-467c-b565-6246b1dca435", "comment": "Malware payload", "value": "fbba505f8bb7f6d3a11a4566f92d3ed27db25f736798c8705595f37d68cf4000", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079553, "uuid": "60560e08-92df-4970-8e2c-fc1cd0522c5e", "comment": "Malware payload", "value": "4cf6e09783eb3634b33965c01ca8f49f6e56882b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079553, "uuid": "93f8e1c1-ce41-4fb4-9722-db701285f391", "comment": "Malware payload", "value": "af9f5c12bcdd5717e107da78639cf664566ebfa7035d7ea5c7fd655ccceba7e74ac2d4ce7efb397e54b58d15559e5b56", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079553, "uuid": "f3962dfb-c23f-4b0c-8758-92d9b8e3af71", "value": "T15CE1F93FC6A187EA428F0EDCBB79016D6028D79892467F10471F9C4AEFD19658D2E1F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079553, "uuid": "eb5399e6-37fb-4c5f-bb31-81226360d844", "value": "192:I7pTy/oWcc6VJcdLj55ySNyZTa5M4cSUqduV:yRy/mV2T8TaASUNV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079553, "uuid": "0989cd68-4c77-42ae-96ca-2f942e045df5", "value": 7358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079553, "uuid": "0a8ebe3f-7f96-40e5-b241-bb87ddbf7804", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079553, "uuid": "cc4266dd-0371-4fc8-acfb-1b564ba769bf", "value": "swPwQJeHTGS.jS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5b04f7-64e9-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1781108972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108972, "uuid": "ae0e5921-2f97-4e79-a380-34a04e479016", "comment": "Malware payload (SilentNet)", "value": "e10f1b4779897fab04e8313c07f6399c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108972, "uuid": "77f7e870-076d-4023-a31c-de014a0cc4a4", "comment": "Malware payload (SilentNet)", "value": "fdd7bec45bbf99469d65e79311067830e2acfb0385035f82c5a184719d560da8", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108972, "uuid": "69558f85-3702-4ba4-b95a-b15c9980c1f3", "comment": "Malware payload (SilentNet)", "value": "3fc528e75d6f9d3027f6dea992caa5bfe66a95c9", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781108972, "uuid": "6eea3197-404f-417d-8d66-af938b9bab96", "comment": "Malware payload (SilentNet)", "value": "90228c1c3229aa9391f6e34cd2449c034c62bd506f40733e5d778bd76775b0e07e02456b113bc86e1890eae993c2878a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108972, "uuid": "4dc6492b-f585-4899-9537-1f5ca1cee014", "value": "T179E3130B2CA4021BCDD35EF569D18B5371EC0430D399A87D8DD3EC9E847AA4C6B57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108972, "uuid": "0313a03e-5b52-4fcd-8bbe-845df984c358", "value": "3072:meW8ICy/57CUGzydVNsWqqf20h5sR87H7zOIYd:mT8I7hCUkyeWqqf20h5sR87H3OIw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781108972, "uuid": "2641c985-2915-4bb3-b676-0cdf6c53d0bc", "value": 149469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781108972, "uuid": "d2f80b29-7411-4227-9f60-dcd958c37d2a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781108972, "uuid": "54ee13ed-e8b1-411c-9350-928524633bdb", "value": "Prestige 1.21.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e289c6-64b4-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781085969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085969, "uuid": "276d003c-8ede-4989-91dc-0d5d75fcea8d", "comment": "Malware payload (Gafgyt)", "value": "f17e5803aff7287769230eab8f2d66b1", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085969, "uuid": "5473b89a-ba64-463b-93df-6a8f89982cb5", "comment": "Malware payload (Gafgyt)", "value": "fe69962db8397c46ebeb874074f99aefb62e8a002e195f284cf66409b43b24fd", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085969, "uuid": "9515540b-dce1-4dbc-ac2e-c4da1ab3891a", "comment": "Malware payload (Gafgyt)", "value": "b78d1f580cadbddfbbd78cff33611120dcb503d9", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781085969, "uuid": "4356377a-5aa7-42e7-bb1a-ff76af6d0417", "comment": "Malware payload (Gafgyt)", "value": "41a3384b15b3c71f0d547fbbfd1f469977bfdd76e9b18aaab3301719f039d5143eb71a010e8c2dce757211fd2427927e", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085969, "uuid": "944bf966-887d-4b40-b77a-76d8fc7badc8", "value": "T136B3121B5B440FB8D6A56EBAC41D62A2B0439EE14FEB3AE71B0EC0F109D6E4784F7041", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085969, "uuid": "e7d4778e-68a2-4062-8714-3297ad331a7e", "value": "3072:k5tCRynD7goCH6RxkGe78vRK2ztrImH/FpHZ7w3loV:ktC8Bi6RxkUvTzt/HtL7w3uV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781085969, "uuid": "72d873a2-e5f4-47ae-924f-80db2eb70e64", "value": 114456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781085969, "uuid": "057b6f3b-c8c3-4595-8f47-bfb2ab306ace", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781085969, "uuid": "7042b69b-7e28-4ac9-8c4a-5719a619272d", "value": "kworkerd-softirq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea46375-64a4-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781079120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079120, "uuid": "507ec790-b47e-45fc-badc-7690c7b186c3", "comment": "Malware payload (AgentTesla)", "value": "b7944aa5122928b9b9eced4fc105e5f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079120, "uuid": "9b6bf03a-2ff0-4611-a80b-aca84848ef01", "comment": "Malware payload (AgentTesla)", "value": "fe771a9dde708ec03bedcfb5adbbf6672d952961f218bcfcb0f5b6e45823e786", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079120, "uuid": "224612e8-2ad8-4043-b504-47d15e6b2532", "comment": "Malware payload (AgentTesla)", "value": "ac556d704e6f948dd0c1d35ade98f71e6ca7db4e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781079120, "uuid": "476c4650-5785-4195-bf58-4ee5b350d27f", "comment": "Malware payload (AgentTesla)", "value": "7258937b96cf493f93e8e563da09081e86b9b5ea1dae31f7e83de35feb85240f397706f9df21322cabf6a636476dfbb2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079120, "uuid": "8f521534-db40-4573-85a7-080bc2b1436f", "value": "T12C7652300354C570C25C5AAEEAA97158140D2DCE94F9FB0D7AAA4BB50776932E3BF7B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079120, "uuid": "efd3b5e7-c74f-4c8f-9324-7a2fab75d7ba", "value": "98304:wnbcW93AzL+xk7KRmD+6kRVJHrqRVMeiR0yIwy1626tX0nQMUepYNgw9FBedPXn/:XX7KRZ0QMUeSSweXPGCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781079120, "uuid": "f637699f-3acd-46d2-a28d-1251abdf5599", "value": 7365111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781079120, "uuid": "4cde7655-81cd-47b1-9e82-dada933f6b67", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781079120, "uuid": "9e059fd7-dcfb-4ede-a6e8-d12a428d7d9a", "value": "BBVA MensajeSwift_20260609_108452-PDF.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f591e0-6470-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781056925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056925, "uuid": "70fe74c8-ffc1-4a40-8efd-d7f18c6a052b", "comment": "Malware payload (Mirai)", "value": "e82e6f446fb3d71e4f84db631f15c902", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056925, "uuid": "83b15f35-0c27-47bf-a41e-ae5ca18469e9", "comment": "Malware payload (Mirai)", "value": "feb90e4d6f530a60e938249c586e420e4ba05ff0acbfa6d5397a666fa454dc48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056925, "uuid": "08bc9063-75ac-4d5c-a46d-e526dde8040f", "comment": "Malware payload (Mirai)", "value": "eba46402e0936a9a106d65eacdb4e59ca16c00c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781056925, "uuid": "9501f6a8-6335-4e20-86b5-43849ba0503a", "comment": "Malware payload (Mirai)", "value": "565be32eea7c4d3fbd16ddb0b843cccf4724cc06cee6200c632e735b91a0489210e7cf9295f5ba72601c5995ef28ca1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056925, "uuid": "72c6266e-9491-46ce-8e25-f2a59dc1e27d", "value": "T1F0D3C70A9F910EBBCCAFDD3706A90A0639CCA55722A43B753674D538F54E90B4AD3C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056925, "uuid": "dba97f15-e39d-4472-8fd5-6cf10bfeeba6", "value": "1536:MRM3RUljgLadT6Cf6m+qeUcn5swQkyy2JHgBYFVvydl5Ot89RFm5:J398vO8ABYrydHu81m5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781056925, "uuid": "ba5894fb-4872-45df-9315-2e05c342c747", "value": 138136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781056925, "uuid": "d64f8a80-c61c-4203-a745-2c1f5e88b8d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781056925, "uuid": "03e81521-a333-49a7-8498-7be5e92439ad", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3188c394-64de-11f1-a769-42010a9c0008", "comment": "Malware payload (KongTuke)", "timestamp": 1781104090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781104090, "uuid": "70b17f52-2755-4cc0-b399-5896cd5836d4", "comment": "Malware payload (KongTuke)", "value": "c9b6824d9eaf6bf06eb897079d31045f", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781104090, "uuid": "d7300651-e557-460c-b190-eb804e25d1f1", "comment": "Malware payload (KongTuke)", "value": "ff2f74cc198a07ea7bf4457dd9e5c0e0adc5b073b5e50d4f13d32b753d7be744", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781104090, "uuid": "b4e61089-a36b-4e30-b68c-cdb0129405dd", "comment": "Malware payload (KongTuke)", "value": "02e4df7def18399e59a2e98fc8f2d7a46108068b", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781104090, "uuid": "aca1f155-eca6-4fde-9669-60f3074dd546", "comment": "Malware payload (KongTuke)", "value": "bd312171a296fbe896560260a41d19eaed15afcad0f8877141320e7e472a99ec79821d69dbbef581a66bf0c25fda7400", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781104090, "uuid": "58bf5c85-b54e-4723-b6d0-228bed3f6b31", "value": "T17CF1AFB07D51AA5142258A5ADF5313F55F7421273188C920BC0D88C11BF9387F7C9EE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781104090, "uuid": "d7d17444-6ad1-4f38-9cd5-f103d948ecf3", "value": "192:/vx6fc1/NNnE8LIwXgwXqXIdJqykJO8xSikWBFN:3X1n1IsNXbd1kJO8O6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781104090, "uuid": "d201e59b-e224-4546-ac70-e302c7f27162", "value": 7789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781104090, "uuid": "14d7665d-e3a2-4b7e-bddd-d2dc8343d86d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781104090, "uuid": "abf5a31c-61d3-4696-9760-cc18a9934e74", "value": "o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b553343-64c2-11f1-a769-42010a9c0008", "comment": "Malware payload (LeetHozer)", "timestamp": 1781092188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781092188, "uuid": "796af0ec-94d7-49e6-938a-eaa4c71d94ff", "comment": "Malware payload (LeetHozer)", "value": "e296eaca24a8f446b2c76b10226fef89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LeetHozer", "colour": "#A57159", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781092188, "uuid": "2b7af5d0-ba94-4c02-9571-92515a1947c8", "comment": "Malware payload (LeetHozer)", "value": "ff6fa3af9a6ac4bc9e2c5aecae5142e6f7c0ffd0d0db78cc3c0b7ff7f83a9b39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LeetHozer", "colour": "#A57159", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781092188, "uuid": "953a35a4-c194-44d1-85c0-0f63fe42c9a0", "comment": "Malware payload (LeetHozer)", "value": "e4974289ec3508790dbbf7e4859bc63feb46583d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LeetHozer", "colour": "#A57159", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781092188, "uuid": "e7e4ff6a-1bb5-4c48-99f9-f43123ce6f48", "comment": "Malware payload (LeetHozer)", "value": "38ee60ffd6565fa8bebcf410e77f4d61fc1a3ac250382eee28ea2580dffc67f325863d36106868bdf33d6c818f129ab6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LeetHozer", "colour": "#A57159", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781092188, "uuid": "d539d940-66b2-4a54-b101-b78c6dd8e699", "value": "T1DFA30885F8509B16C6C661BBFF4E438C7B261768D3EE320399256F61379B95B0E3B102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781092188, "uuid": "7c637eae-755c-4e58-9233-f1ff75e9a169", "value": "1536:hrAFjYGIIot7JKR+4VdN7+HpElbfwywyY1TbcQb7EIN7GVVAhpAMJjObqi:hAYGSt774NMFcfAXnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781092188, "uuid": "abe31ef6-d23e-4a26-9ca5-5573449e30ad", "value": 102860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781092188, "uuid": "c56e162c-1f6c-4581-83e6-1afb2ca59695", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781092188, "uuid": "b0db98b5-69df-46ce-bfbe-42c1c0cb3c6b", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2520bf4d-6498-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781074004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074004, "uuid": "4d5a9331-8013-4840-80ee-2ef0290679fe", "comment": "Malware payload (AgentTesla)", "value": "ee8c3153875ca435a52c0274829e21b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074004, "uuid": "8464f187-231d-4f0f-ae3a-61b75a69d2cc", "comment": "Malware payload (AgentTesla)", "value": "ff97385cf2724c9c661bc5a53c41b2becf50a36a5c0424c71f4cc391ece9bc10", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074004, "uuid": "153abd05-d202-4179-8d45-a2b8f68177f5", "comment": "Malware payload (AgentTesla)", "value": "419f0d3bda51316242747a0e9267c9058f188c7d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781074004, "uuid": "d3d5dee1-594a-4015-b9c6-3377948eaec9", "comment": "Malware payload (AgentTesla)", "value": "347d4a6485a257d04a3480b0da52ba96abc8ec644e1b43c307cb5d06847c6c92b35e4e0f24f944abae9d567d177c5f13", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074004, "uuid": "8ea84ce5-6c47-44e3-8931-ddd82ed2fd8c", "value": "T1B54412003390C163EAE147354B7997AB8ED6CC46B9104F4B27A03FAF7F76391AA1A751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074004, "uuid": "29afe175-8c16-4344-bc24-8076198d72ad", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074004, "uuid": "dfeaaf00-7d16-46e2-9990-4ddf255582b6", "value": "6144:NQ606xEXA9HXPGPkHp8PJE/6ePNC/ZlZE+I8vspzY:0XA9H/5p8PJi6WChlvspY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781074004, "uuid": "5555a4da-4730-4d61-960b-ab78b538a6a9", "value": 271588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781074004, "uuid": "1422ece5-b832-4585-931e-15e2c8771466", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781074004, "uuid": "db2ffd93-2cee-4465-9cea-7f882b15dc74", "value": "Ordine_di_Acquisto.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d34175ab-64e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781105649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105649, "uuid": "5af9565f-ba45-409e-8b75-6c8b056ad125", "comment": "Malware payload (Mirai)", "value": "8af624a250d749c894c7009760c4a94d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105649, "uuid": "bc0f2ad4-b2ae-4db8-9f5a-7c440195e5b3", "comment": "Malware payload (Mirai)", "value": "ffa3669c1e4e2e4515c44a21f5d5a1fa099f8bac266d2211319fe67ef9720deb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105649, "uuid": "a95a176f-4044-42bd-abb0-c02663c9aa78", "comment": "Malware payload (Mirai)", "value": "bcda94575aec4d6cd0b557f9284dc8694f79d6ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781105649, "uuid": "1fc38091-1e1b-4a6b-aa14-cfbead11c0ef", "comment": "Malware payload (Mirai)", "value": "4370d3f1e4250f11f37b2635d74258b80747cbe931dfd26d29c9d973417ee17ea078756306eae0514acdb8639c48986a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105649, "uuid": "d572596c-e751-448c-a21e-4195c07dd578", "value": "T115C33A59FD819B11D5C622BBFA1E028A331357ACE3EF72129D205F2537CA96B0E77901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105649, "uuid": "ad29fc4c-ed6d-4490-ad4c-0b71b179f586", "value": "3072:LkUhW6FtxBaE6pcFRaebXQdcXmAULBc0lmP4O:LzhWutxBaORaebXQd+mzBzlk4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781105649, "uuid": "400d100d-8e6a-4f3e-b897-4bde89ac45b5", "value": 124752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781105649, "uuid": "d029be8b-40a5-428d-9338-f98740a660a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781105649, "uuid": "44f43571-729a-4ff7-b1df-f30b6f40d128", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "addd84a8-64ac-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781082823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082823, "uuid": "ec6a908e-25b1-42d8-a803-3aef5cc3169c", "comment": "Malware payload (Mirai)", "value": "24d000426db3e47e1eddb17165bbb386", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082823, "uuid": "9308566d-0624-4bf2-a3c2-93c18fc40553", "comment": "Malware payload (Mirai)", "value": "ffaaa37c207a779eb40c4434bfdfa16bced70c287bff06d6df409aa7082ec6d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082823, "uuid": "d8e55916-93e1-4dfd-bb6f-23bcb90257f6", "comment": "Malware payload (Mirai)", "value": "b9dfb449669cbaf77f0ff1fd4662d268b116bf42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781082823, "uuid": "e2906c3d-a61d-4e04-8be8-95cc88c7bcc1", "comment": "Malware payload (Mirai)", "value": "743971f180ecaf4c78a61f6f72fecc8ca2073857ff693893b632eb61004f4d3dfbbd575d68e90e164b6b21813918d8ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082823, "uuid": "f40ac00e-c5c6-494b-be7a-5426b777293f", "value": "T153D3EA46F8819F16D5C111BAFE0E124E77131BB8E2DE72039D246B707B8B97B0E3A915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082823, "uuid": "acfd1d82-496a-43b5-9e50-e3b00cf7b6dd", "value": "1536:6Tnc9gIKgHTGf5P5ZFXEeQTeXyBtHlAaD4bhVi/iB2f81DAXoD/5cU34B0m0Q9fP:19gIG5XKiX4yaa2f81DAXgqU3gB+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781082823, "uuid": "dc49f7f1-26ef-4ee4-8359-e3df6fafa9f5", "value": 133756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781082823, "uuid": "814072c0-cab2-4d50-8435-ae48a70c2b15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781082823, "uuid": "777bedd2-3d3e-4795-be12-d47747cf6f57", "value": "CRY.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7c497e-64d0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781098124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781098124, "uuid": "4a2760ce-c2ee-475f-aab6-eb60a6bf676c", "comment": "Malware payload (AgentTesla)", "value": "5feecadf232a069e5b9f9c3ca29ed7ab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781098124, "uuid": "6ce910ad-b50f-4a40-b7bd-4f36d2f98b0b", "comment": "Malware payload (AgentTesla)", "value": "ffb165e60e6498952cd68782e0c668a4cd9fbe21a516319d2b9eacdc835e4383", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781098124, "uuid": "9f49a95a-67a9-4c1d-b5e3-851881ccb2f5", "comment": "Malware payload (AgentTesla)", "value": "a1a5a60ddc0da56550a341a08463f458b74dd22d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781098124, "uuid": "a4312174-6a8f-418e-8fee-46248dc0a307", "comment": "Malware payload (AgentTesla)", "value": "aafb52bee5e08aba70d26d5f09d885dbdc4b9e5dced3f12cb8d0746d983e52f7227a6b76cf479eca52a1eac40142be16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781098124, "uuid": "d7a662ef-5677-4ebc-b44f-defe70b79f10", "value": "T1ED7661310354C671C1685EA72A99716D240D4DCFD8F9FB023B6B9BB5027A932E2BB770", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781098124, "uuid": "852896ec-050d-4657-be8b-57ad163f35bb", "value": "98304:mIJV6SzDqUU7ep8Y4UTyh9NFCPKvtkzML1APRxCzJP0ZwYCwEgLdlZPKf9J4:BDqD84Jh9NFuyWzOAr+JPawYpLpcJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781098124, "uuid": "ecfa91b1-bba5-41cc-92c5-8f8ebb0fb8c4", "value": 7197030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781098124, "uuid": "5b121eff-8020-4851-9587-7ba859027537", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781098124, "uuid": "62dabc1d-029c-465f-9d35-461f97716eea", "value": "RICHIESTA DI INFORMAZIONI SUL PRODOTTO_3247845.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }