{ "Event": { "published": true, "date": "2026-03-19", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-03-19", "timestamp": 1773964981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "f46ff7b7-2faa-4e08-84b8-27eece1b5ce9", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974b0a6e-23db-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773956146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773956146, "uuid": "44d29b13-89b2-45f8-8798-e1319383cca7", "comment": "Malware payload", "value": "a70575677b6a8473c596ccc86a29714a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773956146, "uuid": "52e4f0de-e44a-4d6a-82e7-fc06b762efbb", "comment": "Malware payload", "value": "0090764bcf2db6ec2c2dfac1726190d219b05174727f330c998452cef71edab2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773956146, "uuid": "57cb1887-96ca-4976-affe-57490058a444", "comment": "Malware payload", "value": "a4d60db687b351fd48f28a1d31523f29275884d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773956146, "uuid": "4473e5fd-6e95-4b1b-8b52-e8c7d77cca77", "comment": "Malware payload", "value": "dd03bb9cf0c38beaa2645199fcd7f71c6d780bfeb464c4b4d3d636d5dbe283e5393993d3529dedf6f93df18724596c18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773956146, "uuid": "a2f2e25f-2737-493b-bcd8-6907e310df4e", "value": "T153160A97B8D14682C4E4367ABC7E81C432A70EBD9B9A13676D05FE3C3ABE1990D35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773956146, "uuid": "e874aed3-2d9e-4010-a58f-4049354c584d", "value": "24576:79NbrYx697frd83OyNYvxPVSVRR43Ku9XljurW2F+RDKfkWT1PxTHRKptN62Eg8e:lXjD58jsz3qD+ImiA/NswGZj11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773956146, "uuid": "86aef236-348b-486c-8366-67c5bea60313", "value": 4259840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773956146, "uuid": "d5f53a3c-8433-4c83-9e8b-06af1da1c7cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773956146, "uuid": "655f9b42-6284-4c94-9a2b-5cff9f531057", "value": "linux_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73681b43-233b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773887367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773887367, "uuid": "4b7a4220-fcfd-44c2-b33c-0c0e7bbc8140", "comment": "Malware payload", "value": "f6495490e91be063b66ca5127bb608e5", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773887367, "uuid": "978e63be-00e2-4cf4-9215-1c2a8f9bd16b", "comment": "Malware payload", "value": "024b0f0bac71f8be85f1f7027a8b050ae80099fed72cb6212283a0f88072e99c", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773887367, "uuid": "38fe94d8-a9df-4bcf-84be-570755d03487", "comment": "Malware payload", "value": "d019cd9bbd3523205090a4f9fb94e07c8aefba6f", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773887367, "uuid": "c37e56da-4c1e-4608-b80d-122e07d58c1d", "comment": "Malware payload", "value": "9e4ae4e1dc543a994236f9f4f5b6fbd02e8e9dc7fb941b74411f868b31d3403cafdcd3cba4258426265fddc2804e0b8e", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773887367, "uuid": "96315652-cecc-41c2-87d5-f102af77936b", "value": "T17CB3E1C90ADA84769F5F2438891F4D078A9C9112167DCE80BEDEEF853F219E075BE6D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773887367, "uuid": "0fd8aa73-ba12-4043-9316-09952cde3e89", "value": "1536:pJ3rpaEuMeJwBQBiiDVrkXX0f785VuZt12yMtrRAx4bPJ:oJwBQ9fZmyMtrRAx4bPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773887367, "uuid": "52c3e8d6-1d2e-42cf-9b1f-787283b9f7cf", "value": 116546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773887367, "uuid": "b35e2bcc-f9cc-4592-972f-dbfe7227ddb1", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773887367, "uuid": "c6123829-6bd0-4168-951a-005bf969176e", "value": "Network_Data_Updated_3712.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0fccb7-236b-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773907994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773907994, "uuid": "bb550a90-9d79-469d-987f-04345d9af42f", "comment": "Malware payload (Vidar)", "value": "ee92509e85099451fdb94f09bc2d5f94", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773907994, "uuid": "66072815-d348-4c48-9a6b-ee7466f7e31b", "comment": "Malware payload (Vidar)", "value": "02b7edadae376ef4e7ffc713f413aa50efb3e329c4a45a45f3cb726fb10bb2f5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773907994, "uuid": "7e0fbd72-5ed9-46b7-a735-4460c56b5c27", "comment": "Malware payload (Vidar)", "value": "73bfe725641db2b381c46f601ea872c31461f72a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773907994, "uuid": "84c25d42-5553-4a32-801f-8fc871c85061", "comment": "Malware payload (Vidar)", "value": "5f274a46d9724420437624e576d02cd7f3964b4445c6ac20c794a4aba6b61edf90b59c9391565e1105cc61628ae7992a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773907994, "uuid": "6a250790-2db1-4016-9966-12e04290d06a", "value": "T1328609AB3A708168C169813EC0938BCD97F37275773BC2E7D26107A94E096D45E3A763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773907994, "uuid": "7017e57d-6d51-4190-9bf9-2fdde4aa4140", "value": "c92ff17b9c0cc71aa2a22e9faeb5d1da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773907994, "uuid": "2118dc45-05f8-4db5-8ece-3d87fe9d3363", "value": "49152:cZZDZ3Rgj02W0et2ZHpGFnRAwfSSTO7dAKYYnqBeId+W0+9Ur9AX44cg44qKlGQL:cPOkz7MVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773907994, "uuid": "80d20824-9c12-4753-a53d-487a78130371", "value": 8590848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773907994, "uuid": "66527272-57af-4fc6-99ab-3e8394e23ecc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773907994, "uuid": "c803282c-7e6b-401b-bf92-0334cfd4e389", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ccdc5c-2398-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773927235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927235, "uuid": "d7809fe5-1a1d-46d2-a547-a86c2ecf2eeb", "comment": "Malware payload", "value": "17d2a18514107a6949d7c33860044709", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Speagle", "colour": "#A458F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927235, "uuid": "8a761e72-277f-4c7d-ace9-8fdb26c96b38", "comment": "Malware payload", "value": "03298f85eaf8880222cf8a83b8ed75d90712c34a8a5299a60f47927ad044b43b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Speagle", "colour": "#A458F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927235, "uuid": "9a3ff491-7e62-49ff-8bb2-afb67bb1845a", "comment": "Malware payload", "value": "ec6ddc270bfbf2d6acf97571e8157bba0dc59d1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Speagle", "colour": "#A458F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927235, "uuid": "82d33763-1c1b-4531-a735-7b727e4931a3", "comment": "Malware payload", "value": "e979982b2a745bb47b228e86e83ac50b5bfd254ef6faad6fd407b714a7daf4c36d5ab841551bbc5e678e75c4f1601d37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Speagle", "colour": "#A458F0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927235, "uuid": "c758d721-bf16-4d89-8679-0f92e3c39317", "value": "T155F4182A3AC5E827E1AF8B71D1D128999778D0129742BFCB05A2D2F51A533C0FD4A47F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927235, "uuid": "4226a535-73f3-45df-974a-742c7281d582", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927235, "uuid": "fb2086cc-2525-4b83-8166-5bba00f305af", "value": "12288:zTFsl6I3+G3Rrp2aubcCEy/+PJ0WT6F6ncVserIfu:l23+Ghrp2zbc5yCmtF6c+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773927235, "uuid": "c4122246-aac7-4e3a-80e2-8f1578e343b5", "value": 785408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773927235, "uuid": "663d4289-524b-4329-a969-2eb15b84af11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927235, "uuid": "281cda2f-2c7f-49bf-9df1-d82703a7bc30", "value": "F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cfa6813-2391-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773924266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924266, "uuid": "b8cd9b04-cf6b-4d18-9e49-ba9f4d3e5552", "comment": "Malware payload", "value": "df5fef057448d212344e9fe69a2bf916", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924266, "uuid": "73b8dfef-5708-48b1-8e9b-b87e79c0b61e", "comment": "Malware payload", "value": "046ebdd9e30338c5c6880ca8e8c7da3c37a3fd05611e9c21310ec5989f98095a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924266, "uuid": "efd99ba0-627c-44ef-b5cb-9635485f12eb", "comment": "Malware payload", "value": "edd6015f3148a2443b3c21fd1a4119eed19b2639", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924266, "uuid": "386680ad-f7a9-4f7f-817e-99a7358646a9", "comment": "Malware payload", "value": "8492c9cf4512073d651b77ab72b95a22717c58611b5d1eb87c377781c67ea82cc52662722dcd8e30b0392ac0180e98c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924266, "uuid": "186f18ac-055e-490d-8c93-ebf587048f3b", "value": "T1B1652265235CCE26D8AE57B80670D3342B786E5ED842D71BAED17DEB3CB3700491A683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924266, "uuid": "6b0da276-0d41-42bc-9108-3e56c5707daf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924266, "uuid": "48646bf7-4c0d-47af-8e87-734fb766a39b", "value": "24576:aNch15rXKMJiKV9GAqimB3tLXcEk0eoqj4AtOwhfPDp8Y5AXn7Sq/z:aqvKMJJ9GAMLMEk0eoqYwtrEXeq/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773924266, "uuid": "77ef3703-6bd5-4a6e-b1b1-9b0d5ea86248", "value": 1540096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773924266, "uuid": "b8629b10-553e-443b-bdb4-02ecdee2baee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924266, "uuid": "d50df5ba-db6e-4d0f-ade3-e401f52e916a", "value": "SecuriteInfo.com.Trojan.Siggen32.29302.7690.22791", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e94d64-2398-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773927282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927282, "uuid": "9aaff5d3-3102-4592-926c-3433c62c8aa6", "comment": "Malware payload", "value": "3ccd7fcf936ca600f7946899ce69d23d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Liansitong-Technology-Co-Ltd", "colour": "#A420A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927282, "uuid": "9c5dac19-dbf2-4a79-a515-f1f59c75cf5b", "comment": "Malware payload", "value": "0492f6fb5a8ddb0a37c92c8bc8fd05870cab1c281320641bd3dd227f9357b155", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Liansitong-Technology-Co-Ltd", "colour": "#A420A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927282, "uuid": "0e0d1a13-1c21-4bf7-bb35-a1500fbf3e18", "comment": "Malware payload", "value": "60f492cd11da5e90c5d3a6a3d90a25cf4fe21db5", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Liansitong-Technology-Co-Ltd", "colour": "#A420A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927282, "uuid": "9bd52d3b-da6a-4943-ba4d-c26cdd63473c", "comment": "Malware payload", "value": "badea8a33620d388104114cd455d45b26cc109a25472c8bc52ff5bc318b41fe29b2368a91c0c9285620bb4528c7bb31f", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Liansitong-Technology-Co-Ltd", "colour": "#A420A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927282, "uuid": "b01cd1c1-e79b-4fe3-9865-ffbcf02582bd", "value": "T1A1A6C0217BDEC036D26F0171993ADB5BD63CBD210B3196CB63D4B9A919326C21736B23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927282, "uuid": "1585ffcd-b281-4b8e-86af-06c7e5d355f1", "value": "98304:0iI/uKL8gfA4SnqFozxY/XuFkf6xRwAM74u89rjqaqBXzPLx8LuSDFAe:1KhApnqiMu+f6xeB7F89rGavL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773927282, "uuid": "9c298ca6-01a9-40ce-9008-e93ecf576990", "value": 10420736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773927282, "uuid": "6978aed3-8f46-4f96-b583-8eaf1af31aad", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927282, "uuid": "7c67fa38-e267-4973-b567-66b95e37f517", "value": "0492f6fb5a8ddb0a37c92c8bc8fd05870cab1c281320641bd3dd227f9357b155", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df201aff-236b-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773908163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773908163, "uuid": "15439446-d3eb-432c-bf7c-668a8dab5fde", "comment": "Malware payload (Vidar)", "value": "e7e0a97612b2b5127f16f220c1db8657", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773908163, "uuid": "bc653fa4-c14a-4a29-97de-026eb4b6f421", "comment": "Malware payload (Vidar)", "value": "07fa4a92aa5295a701683290d5080970810723df64b1d1fd7bf4f70606ffb8c3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773908163, "uuid": "5a69f8b7-4d5b-4f9c-b478-00ca08968790", "comment": "Malware payload (Vidar)", "value": "80a2499daa43cf94395d5e174f3861c6110a791c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773908163, "uuid": "95d9ffcb-1b9b-447c-beb8-e45413dd8f9e", "comment": "Malware payload (Vidar)", "value": "770f08258f9cee70f45e7d380d51003990896a58ac56d5bb7f6cd872c9b6180ee642f2c1bbb0641ace0377b5be8c4128", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773908163, "uuid": "442d6d6d-f887-49e4-b2c9-7e20d20f48f5", "value": "T13396286BE6A1816CC26DC13EC09B8B03F5F372760B33C2E7579103655A4A9E45EBE670", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773908163, "uuid": "b1d69100-bf84-49c7-83d0-8069c9ce7fe4", "value": "c92ff17b9c0cc71aa2a22e9faeb5d1da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773908163, "uuid": "66498dd8-0b3d-4696-a3b2-474edd5fa0e8", "value": "49152:rZZDZ3Rgj02W0et2ZHpGFnRAwfSSTO7dAKYYnqBeId+W0+9pr9Abt1FDpYv8UI:rPOkz7MIQtrFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773908163, "uuid": "0019a551-6f4c-4632-ab02-d05ad8dc936c", "value": 8627712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773908163, "uuid": "8974dac7-2f15-4219-add8-4f3b9e3dd594", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773908163, "uuid": "698c8dcb-7eb0-472c-93c7-a14a28bef31b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8edca127-2374-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773911894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911894, "uuid": "b4b85ba0-ccb7-47ac-b131-9474daffa574", "comment": "Malware payload", "value": "db1829dcecb2f498ae47e2848412c124", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911894, "uuid": "37fd1750-f2e7-403d-a96f-fcff8e69c3cc", "comment": "Malware payload", "value": "0a10ffc39fbe9cdf60e75b4a948af235e274c79093cfc14baba9e1992ad671c7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911894, "uuid": "f79f0a6d-3444-4e95-87a5-74c1e520adcc", "comment": "Malware payload", "value": "fee19bf3586d811789fdeccfe30adf99f8a77359", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911894, "uuid": "ed1a4f94-d6f5-4fbf-a8f6-4fc67e07eb86", "comment": "Malware payload", "value": "c5eedebe7d00c2c4e446de581592515b1091dfb7929f60d58b538d0f3bcc8f21596e68e5676f79c026ea8b3e1ad1762f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773911894, "uuid": "532d7359-1d26-4524-8814-8f274651deab", "value": "T1DAD3192AEE0230BBF9935970674EF3BB5822B63053155D16FF428F5D6472AE59208F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773911894, "uuid": "d52a1742-b60c-48c7-bc9e-227d34504f73", "value": "18f1908e9f1258f21f183105eb52bf9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773911894, "uuid": "c4e9e7e5-3eb0-4ad1-b88e-42dd8d3f453a", "value": "3072:lo7WmQaS+7rfjy014+ipo/cbd+eEoga6T9EULS:W7djy0bcbd/vgiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773911894, "uuid": "63d5132b-9413-435f-8355-0a9c852b6cfe", "value": 132096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773911894, "uuid": "d679213b-c035-4f39-994d-20cb68740e3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773911894, "uuid": "dd949f3f-a75f-4061-b5f8-48a61177e646", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ba64fb-2345-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773891885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773891885, "uuid": "4c6a4d8c-52b5-4dfa-8b7f-0a7ddd66ca07", "comment": "Malware payload (Mirai)", "value": "78922d2891aca7a4123dcfacc4e37179", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773891885, "uuid": "256e0975-bd52-4ffd-be48-0c05609fe595", "comment": "Malware payload (Mirai)", "value": "0b7bea135dc3b2cda590959c9cc847949c56b0e8d4c5f7ce9ac6dd2590aa6b71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773891885, "uuid": "659a5d41-07be-445d-bfff-4bad5ec41a56", "comment": "Malware payload (Mirai)", "value": "7fc0c991c5b39e549858b78547463df7c62262a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773891885, "uuid": "da19a768-ff0e-4726-94e3-e882e59635f8", "comment": "Malware payload (Mirai)", "value": "b64c455a662296c6c3e521eae2b54dad6aa0d0299f5ef15ff70846891587ece3912075f838af7cca6f0caf1704321f79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773891885, "uuid": "776c477a-02d4-44ec-880f-33ca8d4ca5c8", "value": "T13C934C02770C0E57E5A71EF4293F27E193EEE59121F4F6882A0F9B468176E321586EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773891885, "uuid": "b2523a14-7ed8-4c17-a6fa-d395c69f83b1", "value": "1536:sqs2cLm1QDmkwyUeGBfJZ+uO616l6y+lfZcyc5la7VktECn:CnqmAh1b+Jx4RZ/cc8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773891885, "uuid": "4010513f-f2bf-4461-9665-a8488e4cec75", "value": 91376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773891885, "uuid": "637a2f1f-0ed0-4351-8311-38513efd667b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773891885, "uuid": "7aa67978-0220-44ad-8dd3-fc98b1f18262", "value": "tuxnokill.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0cf4969-2396-11f1-a769-42010a9c0008", "comment": "Malware payload (BumbleBee)", "timestamp": 1773926661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926661, "uuid": "aab30acb-43bc-43e3-941f-b7821a3f117a", "comment": "Malware payload (BumbleBee)", "value": "fc7ff175d1bb2f8b3c9953715b720039", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Xisu-Technology-Co-Ltd", "colour": "#1A0A5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926661, "uuid": "462d011f-5d95-4054-a581-7276dace50ac", "comment": "Malware payload (BumbleBee)", "value": "0c9569cf1f8592b1e60e81d2bede54ca33a228955696b6d996e8cc0f7ff09732", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Xisu-Technology-Co-Ltd", "colour": "#1A0A5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926661, "uuid": "7395c48c-1030-4101-934f-6479d64e2d30", "comment": "Malware payload (BumbleBee)", "value": "4dc16ab1f2782ddd18da3a63d2c7ae19167fbe49", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Xisu-Technology-Co-Ltd", "colour": "#1A0A5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926661, "uuid": "c698d1f2-0a5c-4abf-9490-1ad1dcf72c16", "comment": "Malware payload (BumbleBee)", "value": "354c53b7c51dcd30e29dd901ac0fd2d4b58e8977270050667ef1ea31362433a1c5de6895878c9335c056a5f6ba820679", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Xisu-Technology-Co-Ltd", "colour": "#1A0A5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926661, "uuid": "1547e0a7-9a1e-45e9-adbd-1b6ed9ef7d58", "value": "T1CF85339FB71C0405CF68FFB3DD9E9E24B892498878B54F6214297D8C2D96231EF44A78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926661, "uuid": "5b3fd539-f061-4918-81b8-fbdb0d92ea01", "value": "8e9e805eb172ecfc99f7aeb249768cce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926661, "uuid": "768dae05-214d-4ed3-a2df-3c057689cefd", "value": "49152:DLeKLBwpJyAbT5G5B55Gm1v63BFhSBja7w7Ko:DKKLSpJyAblSB7G0EXJw7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773926661, "uuid": "6d05f0dd-a22a-4931-b86d-1829df394c0a", "value": 1852608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773926661, "uuid": "cbc9d2b9-08ed-417d-9092-c44e7cd99c47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926661, "uuid": "0ca184d0-5554-4539-a07b-e5dc2f2a6d5a", "value": "protectos.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72216b8-2395-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773926242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926242, "uuid": "619084bc-3974-4fa9-8374-d0762fcd2c34", "comment": "Malware payload", "value": "fa6cc0b7ad02dd4aa1d8d5f544106f07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926242, "uuid": "d5f159d1-e8b4-4603-b6cf-3c5db5fa8b42", "comment": "Malware payload", "value": "0d3b4ca2d0d7534964713ca13e10d3afd96ff25135843a01ef533237da1327d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926242, "uuid": "a9eec221-bb5c-4717-b0b4-b9827853a444", "comment": "Malware payload", "value": "d1dc77264c33662f009ae0cebf199df3ba943c19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926242, "uuid": "0121085d-b77c-4bd5-82b9-b9c814402b85", "comment": "Malware payload", "value": "b07499f795bce42f3975b4d1240b148751bad611c02b4a525b9885b04ea95a5383e7c2c8a313ff6b38b0f1bb3dde954a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926242, "uuid": "bbfbe894-66dd-41c8-9df6-bfab5caa1222", "value": "T13DE533217FF9C9B6D4414A339EC66B51B2B4F6090F1382CB49A05846AD753D12E3E2EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926242, "uuid": "6424d982-f82d-4ec3-917e-71b629987e73", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926242, "uuid": "cf95adee-4a9e-4a49-9c93-12c07c84d43f", "value": "98304:TM5ozXTBzgSUIKA9VUtc3WQqElRKwXjgSf8DLb:TMTq9D3WQqJwXSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773926242, "uuid": "779a9c35-a6e0-4628-95bb-8c94de3cf77c", "value": 3236808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773926242, "uuid": "3b61869b-b676-485a-bd4d-f2a35f1e545d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926242, "uuid": "b2aea465-bc35-4fe8-b78c-e2486cf2f895", "value": "fa6cc0b7ad02dd4aa1d8d5f544106f07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c2317d-23a8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773934110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934110, "uuid": "a20e75a3-6fe3-4048-a5db-87c67c6bf015", "comment": "Malware payload", "value": "f69ed99d53cdab8ab6f2d73173b85852", "object_relation": "md5", "Tag": [ { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934110, "uuid": "a1d88d52-27a9-478e-864d-eb735f6b869f", "comment": "Malware payload", "value": "0d66563c6369f93c62eda4d269f46b411039932ea31db809e07deb55ae905f50", "object_relation": "sha256", "Tag": [ { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934110, "uuid": "037548f7-25ba-439d-a6f4-b549c85a04c9", "comment": "Malware payload", "value": "3f04791b69548da2b306ac5ba9edd789f821dff0", "object_relation": "sha1", "Tag": [ { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934110, "uuid": "75cbb05a-de22-4244-8a18-78aa09002e57", "comment": "Malware payload", "value": "3ee91d92c4e7b7fd83f40668f0ce709c009564b444b8c110d42049a44f3dfc59496a9b7597605949cab0bab0af9284cb", "object_relation": "sha3-384", "Tag": [ { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934110, "uuid": "f51ee669-8a9f-454f-a651-012332e5dae8", "value": "T1C962D03E0E5E4A2BCA375CB5506760CC2B01E7E11A8E51F0F1FFB25A170729E5A6819F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934110, "uuid": "a0dfd896-0bc5-460a-892c-231bfadf3ecc", "value": "384:0q8TedlO5qBkkzLkv2GCpEjOUc9MnO/XH1XJuBSrH1e:4iPk/v2GgEjo9MAtJESjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773934110, "uuid": "4e751e51-6c90-4a93-ac6a-dc2a09ab2ac1", "value": 15921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773934110, "uuid": "69fa1180-af13-49ac-863b-ab97f86443ec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934110, "uuid": "db635ad6-9287-4067-9db7-f8da7659a54a", "value": "liushen3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd898fd-23b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773940801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940801, "uuid": "7da2c648-024d-4a56-a62f-747dd7244b24", "comment": "Malware payload", "value": "87b124f44a077675ad9cbc58e353f543", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940801, "uuid": "875556d5-f6e2-4203-af65-1ac9d26de097", "comment": "Malware payload", "value": "0e238e1eadf2dcc372c23dc8b2e77ee82f3fb7d72df803c466a2a43d899ce932", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940801, "uuid": "76275f87-eb0d-4e65-9872-836781457884", "comment": "Malware payload", "value": "2eb6e03a51069f22b56d0c8aadd406c735020c13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940801, "uuid": "65f83866-4825-40c4-aa18-8c0fc1c70960", "comment": "Malware payload", "value": "305f9a250fda219605efa1bbe9d7fbee9f92a99b7bf253c2b74bb0c8f92c5ed15d562339d9328d82de367e255ff4994b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940801, "uuid": "278aed6f-64b4-4678-ba7b-12d7927121b3", "value": "T111173343F794CFC7C0DDFE79A0E0095699E34C74AAAD430ABD2DB5BBADA22402C95354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940801, "uuid": "151f46b4-6bc0-47a5-b6a9-dfe0c5607559", "value": "393216:rbZmOQ2oScn1PXnB2LFU0IJ78oExxVJ0ANLm3RNBfc4fKWFhC:vQ2oSa3B25U0MyVJncBkOFhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773940801, "uuid": "20d485ea-f42f-4e28-a57b-c1e0749dc90c", "value": 19047640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773940801, "uuid": "b00f9468-9001-4937-bbcf-63e36c99e0ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940801, "uuid": "422b31ee-e4ea-43b4-bea7-850b48b19773", "value": "0e238e1eadf2dcc372c23dc8b2e77ee82f3fb7d72df803c466a2a43d899ce932", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b578ba7-23d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773955106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955106, "uuid": "4b7846bb-65c9-456c-99cb-79dc644d54c4", "comment": "Malware payload", "value": "ab778dde6547652461c88b872b521014", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955106, "uuid": "fbad17bb-239a-4f94-97b5-bbcb6dd79fc9", "comment": "Malware payload", "value": "0e7af68125450f1a0071d23518fa90f4c9f7d6342d7edd077cc4888e8da1ca2c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955106, "uuid": "edd935cc-4a58-40cb-b741-2d669d44b9e8", "comment": "Malware payload", "value": "4bad0a76d2cccc8014461f969e2c108ff1541bf2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955106, "uuid": "68616650-7e7f-460b-8fb8-2402c5f617aa", "comment": "Malware payload", "value": "14fc931370c3a0e5ed735224d1502f0597f38945f2b9758079f43aec87c77461a3751c62b560a64a2aedaf288a65877b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955106, "uuid": "0df03161-1c2f-4148-8ae0-8432284fd546", "value": "T1B34192CA0B79D832B5D57D18BABAC048DD9DAAC7ACD1041AC5E41F345974AA432C3FE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955106, "uuid": "47879215-4958-4dad-87f8-0b15ca42c7c7", "value": "48:kn5S62iw079ymGW+DKpbuA/MzLoFa9vXyBQlcqD:QXdt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773955106, "uuid": "41f6d34f-ba70-4483-a574-c045be1014e8", "value": 2396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773955106, "uuid": "dcde0201-5ac4-4783-89bd-d72c380c3335", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955106, "uuid": "06b05095-d5a3-42c6-8f2a-5bfe7a8f8fa8", "value": "dddd.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7124346-2371-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773910754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773910754, "uuid": "e5b4ca53-4261-4471-8162-ef751ab5a02f", "comment": "Malware payload", "value": "30b1f7e18513f12db37abceda9315f72", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773910754, "uuid": "e0a4b6a0-477d-463a-9806-8e8c92c9fc68", "comment": "Malware payload", "value": "0ec1513c145a3f69b2b271e66f70d122215997b8761799d9c9b8cda4ae511710", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773910754, "uuid": "61db143c-2ef1-47c8-87c6-3bb78f9707bd", "comment": "Malware payload", "value": "fb2d9ac1e7d62dfd3761729c176352205e484588", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773910754, "uuid": "4b274e98-da9a-4216-93f9-df6ea3bffd45", "comment": "Malware payload", "value": "1948bbda54620d467477f09de2d2f579940f06a14762815bf3fe881e3c05345100254beac3c48d882a8a9e961cd61351", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773910754, "uuid": "a3a7a782-ed6e-4e05-902e-88abcc0337cf", "value": "T122924CB512896C79FBD0CE399F3C7F4DADE8C2C42124A3ACBA4F39215A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773910754, "uuid": "832436a9-6171-469d-bc20-d6af30877fa8", "value": "384:DFcuQpWx+BL0SWL0gSzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:DF8i+BL0SI0dzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773910754, "uuid": "a2dbd024-4886-4722-874f-0ca3e0c5db86", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773910754, "uuid": "a6f43c2c-6aab-498f-8564-c5ae856d9b1d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773910754, "uuid": "fb4ca1cb-c470-4963-b1d0-659f5adac1ce", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e844fd8-2395-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773925933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925933, "uuid": "a3f3be9c-6dd9-40d2-a524-27ad1943a1f7", "comment": "Malware payload", "value": "eac17ce3a6e4d3a4f76981270d3a2dfa", "object_relation": "md5", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925933, "uuid": "4f09d3c7-6071-4f82-8b71-604b098c2999", "comment": "Malware payload", "value": "105874ff4428f8d3773cc03e4a2a172aab3ab62823cce4a00a9b59bf7ee3fa80", "object_relation": "sha256", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925933, "uuid": "a775e914-3681-4e6a-9526-fbe028f7a0f1", "comment": "Malware payload", "value": "4ee895e3a6fbff2f4b9eafde7f10d63cb41404fd", "object_relation": "sha1", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925933, "uuid": "4a00e4df-9179-4d33-b34d-36e4552acb7b", "comment": "Malware payload", "value": "f0db4bcaa76c40b43ec8e4a9b7325a879a82c57095f6e3beacf9230001d6cbebaf08a68d7feee1ab61e51b89368255ad", "object_relation": "sha3-384", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925933, "uuid": "009cb285-b09e-4aa8-a1ff-3ffeea20eebc", "value": "T14D76CF207A8AC036D26E01B1AA3EEB6F953DBE720B7144D773D87D6919308C25736B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925933, "uuid": "1c673e82-a365-497d-a5d8-b732b7844ea9", "value": "196608:zcvWSuXYyVCh8mfjxx1Prh7S89rOagc6RToHJ1zp7:zcvluoy3mNx1l7S89qHNdoHPzp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773925933, "uuid": "cf04907a-1c3b-4c0a-8a27-9b2ba9d71a05", "value": 7629312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773925933, "uuid": "46704066-d524-4935-becc-6485ed17733b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925933, "uuid": "3098874d-e3bc-42a5-8118-e18ccf01180a", "value": "105874ff4428f8d3773cc03e4a2a172aab3ab62823cce4a00a9b59bf7ee3fa80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2518bb75-23c2-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773945217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945217, "uuid": "0b6da8e7-0d25-49d0-b02d-eae611ba214f", "comment": "Malware payload (ACRStealer)", "value": "005d63ba299bbce8c6140c5942d08335", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945217, "uuid": "1fafa6fa-431c-4190-9e7f-7af327bd4198", "comment": "Malware payload (ACRStealer)", "value": "1061cebf8ae68e988db7bf2e9b3b1801f829360ac7f6fb6ce37bb5b83ef13f33", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945217, "uuid": "fa366b90-7f63-44fc-990d-69411fab775c", "comment": "Malware payload (ACRStealer)", "value": "6a99453d8d3ce24dd76a45418d06acc6d9285696", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945217, "uuid": "e5b262a6-5a61-4f31-bb0a-4889840e7ad2", "comment": "Malware payload (ACRStealer)", "value": "35474efcf57d3b9ca6a7cd7d8acff3a42a5d7e5f0aa77d7302fc4e58d2bfb67e3d1c251be6d48369b15e38671b060367", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945217, "uuid": "68691232-2186-4e65-805a-d37c72de6838", "value": "T1438519C5F8C224E3D37282B6B2175817BF3B45C6513E8C6DB4DC129B3A734A823AB594", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945217, "uuid": "7290c705-7f5b-47f5-b679-df57ade39143", "value": "1de9e1ebb8477f1a39e9bf5d8945b527", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945217, "uuid": "15e1f109-b95c-4ae0-9c3f-92e740e28505", "value": "12288:k7VIw9Wy5pMnhxzAe6d7w6LOBlP1VT8fJ4TH0KRDIJbrxC5CJ+7OQyX8IyBq4dQ0:kpfWy5pMa7gHT8fJREELz+7Bu8Iym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773945217, "uuid": "8b766e1c-652d-4de2-90f9-2bb71e1f6e35", "value": 1843200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773945217, "uuid": "9cb79aa4-cad8-4b06-a708-dd5e9453a9ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945217, "uuid": "ce7403c1-9bda-4808-9985-2f58afb3b203", "value": "SecuriteInfo.com.FileRepMalware.97334683", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b4d5958-2393-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773924988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924988, "uuid": "f9ba2f32-171b-4e73-aa13-d0fc69e715df", "comment": "Malware payload", "value": "aa4ba810bcc7c1df4f0b725c8bda100e", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924988, "uuid": "7d40197b-e29f-499c-af6a-fc4789741fad", "comment": "Malware payload", "value": "116172d0d4407bc2a3a5e03b9f45dee3927d2bb6adf54eaba1c0cf3b38bd03c1", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924988, "uuid": "43d7e56f-09b4-4504-9d35-2b05841a6476", "comment": "Malware payload", "value": "0b6f1b50dbfeb965d72607db384510ef3c333eb7", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924988, "uuid": "5965c30d-c1ad-4c58-9c65-98921fdd7bab", "comment": "Malware payload", "value": "09db49247bed4dcd04231db6e999d3dff2d4f4d287b5b34be4b62627ac3275b579e07dd8c1be0e6b03132702a302c852", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924988, "uuid": "1f1ebda8-4eeb-4255-95d6-da81430f8eb9", "value": "T1A093BFB2D064C4894AA5087B2C3E8B653729B1BCD59807444FF56F7CB98C18DB94EEB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924988, "uuid": "b24eb2c5-1a09-4c20-9a30-26110d09777f", "value": "768:zYdUjlGWAzogt/RtD784epZQ1w2uDPbNaDrhx0jOOpE:UqRdgXtf84epZd5gqCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773924988, "uuid": "6e759624-749f-40ab-83cd-8650e1a32ca5", "value": 91098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773924988, "uuid": "82a0542e-813d-40a1-b58e-0673aebc1e5a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924988, "uuid": "dc9f674a-5603-434c-b335-6c5311fa8636", "value": "\u0421\u0443\u0434\u043e\u0432\u0430_\u043f\u043e\u0432\u0456\u0441\u0442\u043a\u0430_2_17_8_1906_18.03.2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bb14f96-2348-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1773892910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892910, "uuid": "f742acd4-8eea-4a5b-9340-748e51f3e73d", "comment": "Malware payload (njrat)", "value": "b2659dc07d24083f8adf3138d39054b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892910, "uuid": "c8b62c60-e622-47cf-9857-ba35c62f3504", "comment": "Malware payload (njrat)", "value": "1180329ed79169ab4d209f825f211beae892be6ba68e9c3c15276b4f1bc95746", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892910, "uuid": "78248d40-c269-4299-8aa6-c83bd86567b8", "comment": "Malware payload (njrat)", "value": "10ba01fdbf8bdc3ff564fbc025bba6f77b1c5620", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892910, "uuid": "57cbb0ac-9085-4851-9f99-ee78623c5bcc", "comment": "Malware payload (njrat)", "value": "d1928fe910e5a35c5eaaf61d10c013cc1c05fed4f40e97caea6e888929695b4b45e9315a6b649cb0bd2fb24603dbb3d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892910, "uuid": "a5f5c12f-8534-4f0a-92e4-f785cf3f3e2b", "value": "T10AC3394EF7418A08D0ED097F886B504A41FBCAA7752FF72F14D86DE19D229AC998F1C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892910, "uuid": "3ff79062-7f0d-418b-884f-e86d6eb7733b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892910, "uuid": "3eafcf46-0828-47b6-8627-82ac1bdb0475", "value": "1536:xu011RFj97eeHueCqxuOqrGFkyQTags4ePQ+H1eHfelXFqbjd/2rJ5WDKb93S:xu09z7e5nkNrV4q6c0eu2b93S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773892910, "uuid": "d2d5de59-8aba-4330-ba99-33869c6befab", "value": 119808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773892910, "uuid": "af6a82ff-f1f2-4bd6-ae19-cb45504a0810", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892910, "uuid": "bc4b68b3-ac41-430f-ae8d-cdde07257370", "value": "oop.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "877dc8fb-23b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773940658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940658, "uuid": "75ba508e-7be5-4eb0-874e-97dcc3a0d8a5", "comment": "Malware payload", "value": "8c10d341b1caa6a5bf6172b44fb2a6f1", "object_relation": "md5", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940658, "uuid": "d9b618bf-1bb1-4bfa-8ee2-4188a07de186", "comment": "Malware payload", "value": "13bb558ff08190a0a8f945dcddb1e1e52b5b991cb99aeac5a44c8a5f5f642f3a", "object_relation": "sha256", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940658, "uuid": "6c5e3313-4cf1-411d-95f6-728f95bce1b1", "comment": "Malware payload", "value": "53187203029107b009966a6282987fb969b58da6", "object_relation": "sha1", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940658, "uuid": "d63e6f38-10b5-4e88-b55e-d44bf15cbdf7", "comment": "Malware payload", "value": "a3769ec20d66bf433209200ad6c8aae2a2097fe8a97693edd14a80a7d24f2e89bb1487c20584644a8e078aa42dd1db0e", "object_relation": "sha3-384", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940658, "uuid": "ee1e17f6-e857-44d8-8de7-548280dc53c2", "value": "T1FFF5F13FB28B653EE06E5A3679B2E210583B7661A5174C1696F4C88CCF254B01E3F787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940658, "uuid": "e6b54d3a-489e-45b1-9ae8-8a94afa2a931", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940658, "uuid": "b07807a3-7bba-47fc-aa18-c696c92e80e3", "value": "98304:F5/+mvWEzHyMBq+AslbkrgA6eXC+0hv35P8OLGA:32mZTUeCgATC+0hPfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773940658, "uuid": "cbb07216-656c-4eee-9911-a5ee4ba6cd10", "value": 3391824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773940658, "uuid": "f3bf8fb9-76c2-45c1-a610-5527ea4f5b8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940658, "uuid": "9148065a-78ad-4c95-8215-ae2d12d05655", "value": "13bb558ff08190a0a8f945dcddb1e1e52b5b991cb99aeac5a44c8a5f5f642f3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06d48c5-2353-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773897857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897857, "uuid": "96e19637-592d-4812-952a-660eedcfef45", "comment": "Malware payload (Mirai)", "value": "024a5b38fce959a00e183d01187d0dc0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897857, "uuid": "a2f845a7-5bda-4ef4-a8a7-c4f7d13b7ab4", "comment": "Malware payload (Mirai)", "value": "155550b63c50405ceb597a8bf1ebe60f724a9c44a1e50f2d26a6327cc4d817a0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897857, "uuid": "7467d6f4-6056-429e-9260-8ce8ab646294", "comment": "Malware payload (Mirai)", "value": "05159be63546771d2bfd7de4c186e8123ecd34de", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897857, "uuid": "b27c3dc6-9cd6-4ca7-a972-53bc8dbf70ea", "comment": "Malware payload (Mirai)", "value": "e9f2acf98bcb19e69fe9aae4e656ad1846617d11e4166c886394a2a4a65a53207f3a7f277169fa6698b753dce8698fde", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897857, "uuid": "239da067-d8b3-4281-b9f4-4b47df87c694", "value": "T14F51138C7421942788C58D4CB657E35793EC93A4E69CC01D9560FE3B3852BEA7AFAF40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897857, "uuid": "06ec4bb9-2b13-46db-80f3-6e400122e071", "value": "48:mUBzEpcCCqP7k0HIFYFWFFFFOWJQp1xEtZrRxHbbibPZF6FYFWFFFRIuENF:tBEB9rEuiy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773897857, "uuid": "37e97396-95a1-4285-8f7c-57e0d684119d", "value": 3120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773897857, "uuid": "cd17e45b-47cb-4aaf-9bd6-cb17b1b61b29", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897857, "uuid": "03f13819-c515-4357-b9d0-6fac72630b79", "value": "tplinkwan.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d5027ac-2361-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773903677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773903677, "uuid": "8812e620-afcf-4823-891f-37902c47c49a", "comment": "Malware payload", "value": "dc28daa8ebd90d6d0d698c607f8818c9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773903677, "uuid": "d50c72ac-9bed-48b5-9d42-2965b467eaa3", "comment": "Malware payload", "value": "162d8fd14a20f457473b236c8c50d329b27520583849f0bfd6374f6d0d476d21", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773903677, "uuid": "0ee2f5e9-1ddf-4dff-9a6b-340a2dcde488", "comment": "Malware payload", "value": "9bd899b50869e72ef375ae33824cc4600dec9c5f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773903677, "uuid": "b1eab853-9b79-4156-892b-0e50292e0ce9", "comment": "Malware payload", "value": "cd8441acf2076c52e343f05f57b4dc344df671161b81005855ba5d5fed00a20778905833ac266311e65893a417d6ec1f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773903677, "uuid": "3520ff10-870c-45c1-bdcb-44b12910ad89", "value": "T1E0C48D7B76164E21C29A5337C3CB894193F4968676A7FB0E715133D628063EFDA0B263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773903677, "uuid": "79b34656-475c-4440-a57b-5af59886e78d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773903677, "uuid": "e00b50a4-507e-48b9-8c17-38f3f79520d4", "value": "12288:bdgYqWlKr2TwV6ttdWmQBdcIvLTR/XCYcxObNt65Rz9Lj:cMPTvgdcSLZCtgj6hj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773903677, "uuid": "e6f942ad-af48-49a2-9354-53ec351736ad", "value": 594944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773903677, "uuid": "2d593234-c115-4412-965f-24dea5b87681", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773903677, "uuid": "6c010ac3-e2ab-418f-906f-6c18b2c09235", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ddfc03b-2394-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773925422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925422, "uuid": "74685026-937a-478f-8941-51035010e5fa", "comment": "Malware payload (Vidar)", "value": "3728639b8dc680461bd878824bb96efa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925422, "uuid": "6bffc4b7-f045-428a-a92f-415113688e2b", "comment": "Malware payload (Vidar)", "value": "16eb83928b3e7c726666ea622cd750d0c1e0af39f236e2db045f7642c85e2d27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925422, "uuid": "d0579e6c-b13a-44a4-86e6-0681d80dc11a", "comment": "Malware payload (Vidar)", "value": "5846869e00fb0983eda2fb311e475f0a18f59d32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925422, "uuid": "615b073b-5985-449e-81be-516bf6ee990d", "comment": "Malware payload (Vidar)", "value": "9188bebe025a1c0b4e35433bb60f73e3cd7a2c5c0227cc8b2bd25bfae542db1345780e4f16741f70e05faf35ec8145aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925422, "uuid": "3a769c30-cb02-4395-a7b8-ceadd15a70b7", "value": "T113A57B0ABDD418E6D06E97728DB762927B71BC190B3223D71EA0757C2E727E0ADB4704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925422, "uuid": "8da02c59-1345-4e60-ba4a-9d9599544a6a", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925422, "uuid": "63e5c8ef-91ad-4040-b47a-1a12578b34b8", "value": "49152:H16SEsDHtKqhqK6zFJNvKOrIUGv1vsmytTgZ:H1OyITJrIUQsmyGZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773925422, "uuid": "83787a67-4d2e-4ca5-9a24-3f1a7574e568", "value": 2259456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773925422, "uuid": "68ede9aa-26ec-4a3a-9d8d-6f4158af1a87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925422, "uuid": "b70c45e5-f695-493b-92b8-72a380d57d93", "value": "Boostrastrapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1951e18-2394-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773925804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925804, "uuid": "8f1dc0a0-6e25-43b4-b2ce-d0b010bc8282", "comment": "Malware payload (ACRStealer)", "value": "f78437b65a0767f85624499f5c980010", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925804, "uuid": "64ffe737-b7f9-43e1-9f5e-f0b1651568a0", "comment": "Malware payload (ACRStealer)", "value": "173188d8eda45cd1ad937978beeac610799862b1ed18ef37cf3d10575421e04d", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925804, "uuid": "00c5791d-9642-4f9f-a461-42af0c5b1791", "comment": "Malware payload (ACRStealer)", "value": "942876be58a138f69ccb3b0ccb858b1ffa6ed39b", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925804, "uuid": "45f26f26-6140-4085-a3a1-17e46ad68638", "comment": "Malware payload (ACRStealer)", "value": "3cc719797647dbb043ce4c3bcb819209234f0290c93981176b0648988a4bdf1d13fc196259f2e26819cefd604f0af498", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925804, "uuid": "c0bfb922-1de1-477a-9ebe-51552b01fc43", "value": "T13A55094B844A2DF7ABD701B7A4570E633A7C41996765BC2A4AFE81FD20C37EC6367120", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925804, "uuid": "5e62856a-b8c2-4b03-9a3e-7c2cd6702609", "value": "c4f87be0ec3357f7db8cd0f5720fdd85", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925804, "uuid": "797745bd-ea6b-4c90-8919-99ca29cc2204", "value": "12288:IcRFshpgJDxanR7n78Yrxm6j46FiZkb4K3xrlA/ZeRr1SRdFj:HMkAJoYrxme46FiZ4zhppRrIRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773925804, "uuid": "3a09e023-779d-455b-9dc4-3584afa9e0c6", "value": 1325056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773925804, "uuid": "099461c8-1ed8-4358-ad43-e85d23922619", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925804, "uuid": "c26c5049-2ce8-418c-9258-6cb67073d707", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6bdae13-2353-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773897814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897814, "uuid": "228e5f36-a1fc-4852-ab8f-f22ab60cdb55", "comment": "Malware payload (Vidar)", "value": "0cf2280f068e7258f307c2d89d025799", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897814, "uuid": "c5117b59-aa3f-4083-ae05-44a2abe33b6b", "comment": "Malware payload (Vidar)", "value": "17661a7d0c3deca24b2ef18f48d61326fadfbf0069d045b5d51f294526280c53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897814, "uuid": "aca5e8cd-67ea-4b96-9c69-76dc7d221595", "comment": "Malware payload (Vidar)", "value": "648d28310f33f9fadb7acce9e0a2eda0eb3b1faf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897814, "uuid": "d369af05-ae75-4fe7-bb98-d075308c31d8", "comment": "Malware payload (Vidar)", "value": "8d5332dd798afb5c528f7ed703dd41f5e084d201f909f62ad7d58d5a6da9b30da9735b736fcbb46093ae4e5463cda8a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897814, "uuid": "fb775bdd-a9be-4410-9f73-88cbc52a8109", "value": "T100255A6513F74168E1B22A74797B08824F6E7F8D7B62B12F3142F2397B31541BBA0726", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897814, "uuid": "1fcc0f1f-b3eb-4f35-b826-1304867b7cf7", "value": "24576:bIhYpkNdb82OgkT3nV9nTH+IPsHvazR0dNo:c+pUb82l+3nVpT/kHv+Uo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773897814, "uuid": "271486ae-82a8-44a6-8757-49ca5926d796", "value": 969968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773897814, "uuid": "3501417e-955b-471c-8033-6f20c5dd4684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897814, "uuid": "f9543fce-5340-4cbb-b3e4-f03aab200716", "value": "Omise.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "080bc3f0-233c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773887616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773887616, "uuid": "1dff25b6-c98a-4a21-a03d-f565b5826a02", "comment": "Malware payload (Mirai)", "value": "43ebb8065a8693f4bfaca67eab5bd0d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773887616, "uuid": "13fee81c-f44a-4d5a-b659-03be70271a50", "comment": "Malware payload (Mirai)", "value": "191b736968ac5dd358fd81a6c179619d095255df7d465dc4649ffc515dd82218", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773887616, "uuid": "45948531-d624-4282-9dd0-293aca95778e", "comment": "Malware payload (Mirai)", "value": "735dc0e5f85c85dc470f699ebe91afda7e287048", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773887616, "uuid": "fe5d9357-46c1-47d4-81b5-3afdd162b396", "comment": "Malware payload (Mirai)", "value": "3536396396c4d1917e366e2327816eab80f6c7c39a1abac95b2120db58d629df3451364b98a14712a7182163317fea1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773887616, "uuid": "7a380287-a00b-427e-8175-00ebccbddf98", "value": "T14DD3B64E3E318F7DF7A8C23447B74A21A75923D526F1C541D69CDA012E6038E686FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773887616, "uuid": "74d3e630-192d-4fd9-9d8d-744794933e92", "value": "3072:3p6oqezMo1kzyYADPXijkS6jekw/xwDzy1ssghz:AoqezMo1uGSjkS6jePi/yOsghz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773887616, "uuid": "54d2d242-4993-4c81-a9b7-a9690e7be2e1", "value": 134020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773887616, "uuid": "3cf124a7-5b04-457c-9041-d136b0a4225f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773887616, "uuid": "3d311b8d-b0e3-4a7c-a924-b337090d2019", "value": "tux.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d95be5-23b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773940652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940652, "uuid": "30b0b545-8197-49fe-bd64-b863e3d759e7", "comment": "Malware payload", "value": "2e2098f9756216248f1cb76e5decb9e7", "object_relation": "md5", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940652, "uuid": "c427cd64-9442-43a3-9279-ea50c3fe974a", "comment": "Malware payload", "value": "19ba4d2bd5638445fbc8c8c3c57934658f6e094588471ef0d657353e84cb6cde", "object_relation": "sha256", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940652, "uuid": "a833763d-57b9-47ce-8aa2-1da348a20fad", "comment": "Malware payload", "value": "6a5dcb0c5ae83890ab1f094ffa1da05621555018", "object_relation": "sha1", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940652, "uuid": "67dabe00-cb79-4e14-9100-d84937b611ef", "comment": "Malware payload", "value": "402a0513d15f3e868c15a3698876f327b330c47bd096df8b34cae1c13222f26b066d02b157f8c1ffd305f9852d91d667", "object_relation": "sha3-384", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940652, "uuid": "abc702d4-f59c-4048-9477-0bb0b2b696ac", "value": "T1F6F5013FB28B653EE06E1A357A72D210543B6A61A5134C46D7F4C89CCF250B12E3EB97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940652, "uuid": "2518eadf-aa0b-402c-ad0d-5df2ac34a97c", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940652, "uuid": "be8c2d74-aba0-417f-ba78-bc031a5c3f92", "value": "98304:U5/DiOt24ZbrAg56xFEPN2BT4IjPaR/xysm:w7btlZb8g56xMEaRssm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773940652, "uuid": "a347d856-466b-43ff-8bc0-245fe0a809f4", "value": 3394512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773940652, "uuid": "433dd500-b155-4916-878d-e1618bc35117", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940652, "uuid": "9ea43252-3dd9-4384-92c9-402470a5cc41", "value": "19ba4d2bd5638445fbc8c8c3c57934658f6e094588471ef0d657353e84cb6cde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5fbc795-2353-11f1-a769-42010a9c0008", "comment": "Malware payload (NetWire)", "timestamp": 1773897867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897867, "uuid": "d75c8a8f-5b92-42ba-9824-7625f427b342", "comment": "Malware payload (NetWire)", "value": "80b56c8ad37141400b0fa7943a4adc27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897867, "uuid": "d79d829c-b034-49dc-8f51-f925393f32aa", "comment": "Malware payload (NetWire)", "value": "1a3a69efa2bee9e0d8e7bedbcac7dab0d27cb2072bfc2668cc3459e3f8abe5a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897867, "uuid": "1f91d2da-7f74-453a-85c2-038e7debff64", "comment": "Malware payload (NetWire)", "value": "a89e8fc1c2db324a40099f9ae3d9ff92c0dd4739", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897867, "uuid": "34e6b834-19dc-4222-a1f5-f9b99dfc26ad", "comment": "Malware payload (NetWire)", "value": "87eb60e25b61ea3aafb611f1f0e7771f463f7d50035362d4d8d2e247bcc0a56c22b3fa01df4fde35310d0a099bc7c03f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897867, "uuid": "90b3b29c-6675-4489-9ab4-910c990bcadd", "value": "T18755BF52E39EC2F0DE165172BA7DF71A2F3F3C254530B956AFC52D3AAD21021112DAA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897867, "uuid": "d3d6c0e7-5e9b-4a65-9320-a518d4c89654", "value": "649f6ed9a4d576c154bbc0357156a4a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897867, "uuid": "27633675-ffdb-4a2d-8667-0ddd0f96a558", "value": "24576:Ku6J33O0c+JY5UZ+XC0kGso6Fa720W4njUprvVcC1f2o5RRfgUWYe:8u0c++OCvkGs9Fa+rd1f26RaYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773897867, "uuid": "545f8f62-d3af-4eff-b01c-e97d1d962fa7", "value": 1390344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773897867, "uuid": "640eca10-e4b5-4279-bf05-8ad6bd0e5b64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897867, "uuid": "0e334700-7ff4-43d9-a306-974dc21c7fe2", "value": "e4se470.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06ed79c-238d-11f1-a769-42010a9c0008", "comment": "Malware payload (CanStealer)", "timestamp": 1773922768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773922768, "uuid": "42226fd6-2f13-403b-9259-90b0d4472039", "comment": "Malware payload (CanStealer)", "value": "562edd416301f5458f327f3885a70367", "object_relation": "md5", "Tag": [ { "name": "CanStealer", "colour": "#FD6137", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773922768, "uuid": "d25dda6f-646a-44a8-a6bf-411b7dab8682", "comment": "Malware payload (CanStealer)", "value": "1aa6644d67b2cb9d03f3d9f0d1836000164a0f490d9a7bebd441071a8987cce2", "object_relation": "sha256", "Tag": [ { "name": "CanStealer", "colour": "#FD6137", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773922768, "uuid": "aeeb2689-d179-4d0e-b472-ff5f400de3b5", "comment": "Malware payload (CanStealer)", "value": "975eee5688809158ae642cd563d422728253920f", "object_relation": "sha1", "Tag": [ { "name": "CanStealer", "colour": "#FD6137", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773922768, "uuid": "de14083e-c4a9-4c9c-ba37-33ded30b9f74", "comment": "Malware payload (CanStealer)", "value": "1ce94080e99cfe8bf6b7b1dc1ba40fc79031f972fd87a5e21d6e00884b956f614f74ee0296e5e66b5f704633b7b31316", "object_relation": "sha3-384", "Tag": [ { "name": "CanStealer", "colour": "#FD6137", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773922768, "uuid": "45e55b55-8a0b-49a7-a61a-649e4b5bd5e0", "value": "T1FD41F76093D204B3E3FB29B49B880883F831564C398F246174569B22AF20828AAD6680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773922768, "uuid": "b17e636d-b4b5-447c-bd26-045f196fe145", "value": "48:w5R2pRj0jbCcdUa9FVc8z7UPEg30d7KNbmD/IoH7Rc/:w5R2pRIXPdx9DRMPEg3iPD/vH7Rw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773922768, "uuid": "a3b4cb4e-9e92-4679-9962-36668eb33d00", "value": 2325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773922768, "uuid": "76512d75-5f43-414f-ba2d-af5683386d94", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773922768, "uuid": "de729e5f-93c7-4a33-8923-8866352b1ff5", "value": "1aa6644d67b2cb9d03f3d9f0d1836000164a0f490d9a7bebd441071a8987cce2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bad5d41-2395-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773925955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925955, "uuid": "034dd1ce-0328-4622-b736-562320dd4d12", "comment": "Malware payload", "value": "fa3cfd815cbf62880bd53f852743e4c5", "object_relation": "md5", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925955, "uuid": "91cf2840-dc31-41e6-b329-b66693e46384", "comment": "Malware payload", "value": "1b05cfd17192b60c249be0aaf001a19cd4b5ba8810c4877d05cce2d95a07d606", "object_relation": "sha256", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925955, "uuid": "9f39ab73-b8d8-405f-b28b-7f605dced2cd", "comment": "Malware payload", "value": "fa3654f303c706551462d398c3b7f13b91f09ca3", "object_relation": "sha1", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925955, "uuid": "bae8cfb8-5465-4157-b2ce-25427adf704d", "comment": "Malware payload", "value": "29f96308889f01a804cb99b9a84af9931f4a49667c004b829d4c331de12bdacecd419106e122a913f221d582d605acf8", "object_relation": "sha3-384", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925955, "uuid": "dcdb0721-9f23-416a-afe2-265e452bd9e4", "value": "T11C76CF307A8AC036D66E01B1AA2DEB6F953DBE710B7144D763E47E6A18308C25736F17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925955, "uuid": "9a2b7a6d-c609-4d79-96bb-70860ded616b", "value": "98304:uiI/uKL8gfACSnqFozxY/XuFtN6xRwAMou89r0qaT0+POq/5:rKhAjnqiMu7N6xeBV89rPaT0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773925955, "uuid": "b4efedba-cb87-4480-b955-d13778e58bc1", "value": 7430656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773925955, "uuid": "dd82843e-063f-449c-bc9b-3e175701aede", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925955, "uuid": "1473a8eb-13b7-4895-8984-478b09780598", "value": "1b05cfd17192b60c249be0aaf001a19cd4b5ba8810c4877d05cce2d95a07d606", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c716cdf-23d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773955135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955135, "uuid": "dd745a4d-cc8d-44a9-9305-49b112e8f8bc", "comment": "Malware payload", "value": "6d7a52e0a3955bab3aaeb2174b1275f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955135, "uuid": "b38b0f4d-7c46-4649-9f25-ff17a3ff2a67", "comment": "Malware payload", "value": "1d820e6c99e11b266ca47a7e465dd965a282805b3d60179f5c08101e395457e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955135, "uuid": "f0176407-1199-4921-ad39-4df30c5c60aa", "comment": "Malware payload", "value": "479e511e69166f21e1021180afdbf716cf06e4f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955135, "uuid": "365eef1a-8939-4b0a-9104-981ecb5246fb", "comment": "Malware payload", "value": "8c30c07b3bf3e632117238450057ccfba513f3e6bf480e2c0a86bf28a620489bbb98d1cc62975e7b6545612e541760ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955135, "uuid": "6a2a81e6-1140-466e-a601-929562b33807", "value": "T17D26D909BCC42BBAC02C5F7441FA8E5663746D044AF55A2B62A4FBD8B8762747F47C8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955135, "uuid": "53832620-32b3-45e8-b04d-777cb7b45356", "value": "24576:31pe1eCfcR4/PySm4ddhqE1II6WWptTRGqYUIMRkY07/fXB95j1PACID:G1e7H+cI6nIUrRkY07/vr5j11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773955135, "uuid": "4b69fe1f-85fd-4551-a5bf-2eab39974b82", "value": 4849664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773955135, "uuid": "1a4b98f1-d799-4073-8dff-3fba14c9faa7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955135, "uuid": "4e446034-db3d-473d-a468-0f9584356f89", "value": "linux_mipsel_softfloat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75e81905-2399-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773927744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927744, "uuid": "0c63dad5-2344-4629-adb0-debad5ed568e", "comment": "Malware payload", "value": "f82fcc9da38a8f038bf5fdc80e75c8f1", "object_relation": "md5", "Tag": [ { "name": "ForceMemo", "colour": "#5C7A4F", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927744, "uuid": "90cb45c5-3309-4680-8dfd-0de75c18d798", "comment": "Malware payload", "value": "1e6487b7fbb9a0ff4c1d7032bfecd153fa6b9cc3c523243e8183588a98168267", "object_relation": "sha256", "Tag": [ { "name": "ForceMemo", "colour": "#5C7A4F", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927744, "uuid": "7a81413a-b53e-475f-b278-695c249c8b2a", "comment": "Malware payload", "value": "16cb730c78e4f002f06a249673df5f2c6aadae9a", "object_relation": "sha1", "Tag": [ { "name": "ForceMemo", "colour": "#5C7A4F", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927744, "uuid": "deb8ee3d-3437-48e3-955c-46935e5c1377", "comment": "Malware payload", "value": "d5f8e40c9496ca145bbfe60e09db1ed7b5d3f9b119fbbcab4e7cc7e327e1a3ec811eb4dc306bd2171cb896a4b8979818", "object_relation": "sha3-384", "Tag": [ { "name": "ForceMemo", "colour": "#5C7A4F", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927744, "uuid": "336420c2-0f63-4c8e-85ea-2531b24966a1", "value": "T13862C661D621286BC347E43AC80694047A5B3C7F2F4578387EEC4A5D2F88734DAB6679", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927744, "uuid": "46c6c461-57e2-483e-b9b4-631751a23cd3", "value": "192:Z3//Z2ibRLPrlLp8Zfj6waOWHY8WU3MmAHCtzUyUsbA+TcFXl1VMR7ZtdfDO6jVI:ZftsCYaA8z/UuOXlOnfKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773927744, "uuid": "4ded5e61-e0e8-4d9e-a1d0-3e45fd56394f", "value": 15554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773927744, "uuid": "9007e9b5-a47c-4cd3-9f89-19dc83577c83", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927744, "uuid": "0c5f0e2b-422c-43fe-a2bc-d3282b5f4367", "value": "forcememo_decoded.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ce347e-23b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773940741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940741, "uuid": "8f6bfeee-df6e-4ec9-8262-8a549de3292c", "comment": "Malware payload", "value": "6cf0989b9baf9711f30aea52565f60c7", "object_relation": "md5", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940741, "uuid": "f22aa164-e2cd-4de8-a7cc-0853094add9c", "comment": "Malware payload", "value": "1ecce860c69369f007dfe6edddd98c0b28cc287cd026cccbae8acad8dabd8f3e", "object_relation": "sha256", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940741, "uuid": "e8eafc51-d1b1-4d63-b126-fe386a36d94c", "comment": "Malware payload", "value": "575bfbd5be6d4c1c9329c63ff083b7663ae5f566", "object_relation": "sha1", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940741, "uuid": "570f217e-5cc1-46b8-906a-364d5ea34473", "comment": "Malware payload", "value": "d73f27e87676f6491508734149a7ab4145ebe1825d386048ccbc7922495e5e8d97e5f3158d8a8d8e87398c959a0de59d", "object_relation": "sha3-384", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940741, "uuid": "2480edb9-0f13-4f9e-9751-6c80d32220fb", "value": "T165F3D0413BFC8932CAAF4FBA14F11141DA32B74756A2D74E6498903C7E5AB910F067E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940741, "uuid": "8c6a4d4b-8f39-4edd-88d9-f4d687c91082", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940741, "uuid": "2a8f7479-336b-4d51-b39c-803132b062f1", "value": "3072:RpqvcfbN9PsuMjziqX3Ln4suMjziqX3PXaU3nhxFSJ2R9u7jziqX3W9rVDO:R8EP1MH7X3D41MH7X3ykh7SJ2RM7H7Xv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773940741, "uuid": "50623fdb-b7f2-4530-a704-509dac3f680c", "value": 170696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773940741, "uuid": "d4cf758e-3a34-4273-b599-c8633debe4a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940741, "uuid": "b5f1d533-dfad-4664-9d93-b3c3c9bd81c7", "value": "1ecce860c69369f007dfe6edddd98c0b28cc287cd026cccbae8acad8dabd8f3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc7c3192-23b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773940747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940747, "uuid": "ed4aa815-2939-44c6-bd3e-ccbce2eda268", "comment": "Malware payload", "value": "9d3c95405c362fd8e355ca37f73d1f5f", "object_relation": "md5", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940747, "uuid": "f221a074-7d11-4716-872f-27c40b905a63", "comment": "Malware payload", "value": "1ee98e3ba3bf4efd8cf2f06960d08449f9d72f36f3779a4de8202991b5e57a00", "object_relation": "sha256", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940747, "uuid": "392b51cb-f60b-4d6c-8a20-338079a9caa1", "comment": "Malware payload", "value": "a4859b9e4bf78beeae97affa5481db9f015fa169", "object_relation": "sha1", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940747, "uuid": "d60bc9b5-e4cc-42a9-9a97-5979d8bd429d", "comment": "Malware payload", "value": "6c9174878db3fbd8cb8df783fb28d458501354a4dee23d0b09b3027e05ce086d82f03546d7a7012ba1b56d5ab2a4cb06", "object_relation": "sha3-384", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940747, "uuid": "f5792e94-6197-4422-8e3d-347115a5a020", "value": "T1E2F3D1813BFC8922C9AF0F7D54B111819A32E7475AA3D74EA48C906C7EA7B910F067D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940747, "uuid": "1abc6299-c3f2-43a5-a3eb-c9496a57d491", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940747, "uuid": "d8a7581a-d8c0-47c1-9ea2-e3e2ce1cf867", "value": "3072:nfKNEAzLaY5Y9suMjziqX3wn4suMjziqX3PXaU32Mxwju2M9u7jziqX3hpHVB:wO91MH7X3w41MH7X3ykFWju2MM7H7X3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773940747, "uuid": "694e1d39-fef6-44fb-80d8-006f9a2eb7c5", "value": 169672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773940747, "uuid": "9e5b3501-dd45-4922-bd4a-91f31d316505", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940747, "uuid": "92db1747-9e24-43fb-8d88-3b00aad5cd58", "value": "1ee98e3ba3bf4efd8cf2f06960d08449f9d72f36f3779a4de8202991b5e57a00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f1dc6b-236e-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1773909081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773909081, "uuid": "dd93738e-9b6f-4461-b250-51715fc2d7dc", "comment": "Malware payload (DarkTortilla)", "value": "d52d1e6abbef1b9d2da6268eb2c93700", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773909081, "uuid": "6509e6ca-d1c6-4552-aa41-07cc88ba214d", "comment": "Malware payload (DarkTortilla)", "value": "1f57a7ad9fa56f6a9f794667be10778602049edf2292eb573fd0efb9df95fb84", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773909081, "uuid": "58bf78ad-7ad9-45cb-b7b8-710a4cde9b2b", "comment": "Malware payload (DarkTortilla)", "value": "998a761ebdc30ca0cd07469213bf6627282eb0f2", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773909081, "uuid": "68e5cb28-5c1b-4fbb-89c9-f07cabf701ae", "comment": "Malware payload (DarkTortilla)", "value": "e75b2f33c79d4fee00edb4ca3e364854f56e16b5a35d27f136949ac17bb87314cf4ddf1fc039b58ec5864ddfd5829f53", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773909081, "uuid": "6a1cc39c-9a62-4377-8959-9e82905c2ebc", "value": "T164C4CF226E662F59C57E0B7CC123095473F1D9439393E7AAAFEC40B05A63AC5CF1B492", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773909081, "uuid": "3a66d7f3-c574-4f88-b506-0274ac85007e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773909081, "uuid": "f85ab128-783f-454a-a164-4a9024f9197a", "value": "12288:9OqZHZV62aFdI7pE12RAUvI3o9OMygQHJEuJK+O/7KLnLDr1Vb02GEl5q:9bRn6/cE12RAUvL2E0KR7KLLDPQ2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773909081, "uuid": "24ffdeef-3f9b-4e19-9361-19577236e595", "value": 568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773909081, "uuid": "a0b46b18-37ed-4b66-af9e-1cbfc2dfea57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773909081, "uuid": "f0268687-8886-4a81-95d2-9adb3e298c0b", "value": "ALZAMlH QUOTATION #00944722.pdf(68KB).com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8349b91-234c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773894891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773894891, "uuid": "9d6b6927-9b57-4d16-9729-41b64ce7f9df", "comment": "Malware payload", "value": "eaf24a189b79ae98c17f9d56838f962f", "object_relation": "md5", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773894891, "uuid": "9fcd6f1c-9f78-4361-9ddb-58a8f4524fcc", "comment": "Malware payload", "value": "206409fb5d58822808770c996979068b7aa04850f77bedf41ddf82ca814bc404", "object_relation": "sha256", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773894891, "uuid": "746b4180-f4c5-4d29-b92d-cbdcc84c5ec9", "comment": "Malware payload", "value": "5f141cba4c70b21cbc1522134e20003af4eb1cfb", "object_relation": "sha1", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773894891, "uuid": "93cffd30-2e3c-4fc3-bf4f-a20125f5f60a", "comment": "Malware payload", "value": "479d3a8be24fe9b5958ab7a68d31a3b8509d4bc8838c39f920a108c530c37b35d645c8344e36ec006a1989edb78d05ba", "object_relation": "sha3-384", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773894891, "uuid": "f8edcb51-628b-4da9-b075-f50e604cbf00", "value": "T1AA86333340B5B21FD41AE476E064873A8BBD7F867A1952037F712D542ECB8C8BA3D265", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773894891, "uuid": "15d888fc-ad5e-4e48-a991-dc530649cac8", "value": "196608:G075lL6IVo7ng081UDknbfgwK5xSjloucewnbPbRqp+NFbLxK4:X75llIMb4TSS0wbPtqirK4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773894891, "uuid": "6d05f98f-a6e8-47db-866d-a0359d1c4cdf", "value": 8150976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773894891, "uuid": "7c21837b-8d6d-4f15-a069-0ed65bfcdfb4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773894891, "uuid": "32e71a3d-1f89-44c7-ade1-a6223f0b481d", "value": "_____.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea788c9-2348-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1773892888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892888, "uuid": "4c2059a9-1850-42c7-b6f8-def50e8fb0ac", "comment": "Malware payload (njrat)", "value": "41d6932f9de360d8d9974236f96ad7ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892888, "uuid": "b9f50c0f-a1fc-495c-9d09-a92460f02496", "comment": "Malware payload (njrat)", "value": "20985888d059fdd496b3f85d36c8e4f281b084c1e247d89b1de614b60168d1d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892888, "uuid": "c7f9811c-a713-4909-8502-d0bba326b9c6", "comment": "Malware payload (njrat)", "value": "cf8da9f9940eb9116d7710d4b01c75eb648d71e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892888, "uuid": "80469202-c9d0-4fb5-9e32-26a54ab32c08", "comment": "Malware payload (njrat)", "value": "a0c2247d2c42367358b35895dce8c76df89853aa406b6b07fca4c13f22fc06a460ad3e256755ff1657367fb5bd41ecae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892888, "uuid": "0fe210a5-9ad4-4554-b137-64a7b24e1925", "value": "T19EB35C0EF7A19E48C96C4E778927D01853EAE0B7A637F77F25C81DE05C26589878F980", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892888, "uuid": "7a7f125c-9714-4fef-8a76-81ce01e716f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892888, "uuid": "317e63af-c777-489a-93fd-8cb7f30babc6", "value": "1536:/cpJIZIn025hxsPgoWjubnQSBtWBPhYSvUfWriN86HhY8Db097YSb:/ieZWFoWjWnQSQHsOriNo8Db06Sb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773892888, "uuid": "53d81695-ede4-49c4-831c-acd1a4ebcf7c", "value": 116736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773892888, "uuid": "710f8179-d095-4383-b049-bd6253e472ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892888, "uuid": "bf3f94cb-c170-4831-be24-8da8ad7f998b", "value": "XWormClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb4a0aae-2353-11f1-a769-42010a9c0008", "comment": "Malware payload (DiscordRAT)", "timestamp": 1773897876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897876, "uuid": "f6e0c3fe-26dc-4c8c-869a-923dd4bd9f94", "comment": "Malware payload (DiscordRAT)", "value": "873462070e034f32fd3682d56768e3d2", "object_relation": "md5", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897876, "uuid": "b19b0097-9918-4d82-baea-f3d7167cd9af", "comment": "Malware payload (DiscordRAT)", "value": "2111b957af319d01b2762d84ac91fa598aa9db54bcd4302e7b5a20ded66af53e", "object_relation": "sha256", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897876, "uuid": "84ed31d3-35ba-4e4c-b256-46d38c91e34b", "comment": "Malware payload (DiscordRAT)", "value": "49e437d346a4c559707b3f46c01a810f67f43cb9", "object_relation": "sha1", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897876, "uuid": "c5dcddca-fc00-41ef-bfd5-c026c5cd42fd", "comment": "Malware payload (DiscordRAT)", "value": "4f4aec5743e9280be1843e16d3c701040b10538a37c3f0fcda3dc8459aa70e2af92bfe9e7242c2f661c558d491b4e8ee", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897876, "uuid": "5c45637a-5db5-43dc-aabc-8e20f4495de0", "value": "T10FB48F19E7E405FCE0B3E574CE924912EB777C494771E68F03AC69A61F236908E39B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897876, "uuid": "6ad2cfdf-b077-43c0-8f4c-d62b35fee429", "value": "7c75a83e117d2bdfb2814c53e840c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897876, "uuid": "73c2cf1d-668f-4ede-b2f7-36ed9f80fa47", "value": "6144:jj1zho1x2kD02IXYwa6fWnUh7bxa57SzYCO8gG4iR+v/74D8+xcrAytte:RhoVY2+LfWvRSECKG4iRkTJrpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773897876, "uuid": "8b11c653-1b2d-4121-8fc3-57f52a19d57c", "value": 524703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773897876, "uuid": "ff12f98f-5eb5-470c-8f85-e7ec3d5bfff4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897876, "uuid": "9b0b25bd-b55c-44b6-81fe-04132b19d592", "value": "rat1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f09f4e65-2353-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773897885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897885, "uuid": "e356cc52-6d1b-40cb-a5ee-f4f0ca94b14c", "comment": "Malware payload (AsyncRAT)", "value": "898ad1bf49cfcbed106bec1e227c55d7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897885, "uuid": "e40b14f0-34a8-4729-a763-0a6b2b7f053e", "comment": "Malware payload (AsyncRAT)", "value": "214a9769cc9e7f5dd5f61235e9ea73b4a5fff7eb501b82b0a877e00c5ce5c76b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897885, "uuid": "c9309dad-5689-4714-a13f-05462a8b5743", "comment": "Malware payload (AsyncRAT)", "value": "235ddcbbe87a43e7c9edb9e0ff6d993cd6659de3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897885, "uuid": "039bfbf6-70d6-44f7-a09f-4e5442e378d3", "comment": "Malware payload (AsyncRAT)", "value": "062579f7856bd6f14d92710cca3fefd2935f7e3fe4ee5c476b4d7c64a7b743245202a898b2bbbf18f402a8161368ee17", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897885, "uuid": "062dda3a-2385-4264-9692-3c92050e8cde", "value": "T1BCE4AE11F7D444B5E1B78534897686628D3EBCAA1B71D9CF13C8562D1F32BE08E38B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897885, "uuid": "ae6b0c62-6bfa-4195-960b-7c08d84aae47", "value": "75d930149d98b9b34c55459c6a79b293", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897885, "uuid": "2432d8fe-6f57-4e2d-ac12-bcba21518ffa", "value": "12288:pYyDi5rNiQ7uysMFZzN/E/msumGDsFqjUjxohvRLqe0kupr/T+vW4:6yvgUGDOSnLqebs/TD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773897885, "uuid": "f338a916-59e4-4555-bb13-4b31404ad9f0", "value": 686656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773897885, "uuid": "b1ca5a02-c748-4dec-8f29-fb7b6dda10a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897885, "uuid": "720c2e61-3115-49b4-ae58-03db02766dda", "value": "8gt9wse.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86550ba2-2342-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773890405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890405, "uuid": "63d411e1-8393-4411-952a-419f8a6becad", "comment": "Malware payload (Mirai)", "value": "551569ba9dad606d320a7d8cc72f3601", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890405, "uuid": "7b683c82-ad05-4781-aedc-fbb15ac679c7", "comment": "Malware payload (Mirai)", "value": "217c1b8cb9205cde9b07790ddbf9b5e8e3f669309561618967468ab1e9503b7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890405, "uuid": "9f5910ab-a1a2-4db7-b9fe-fc36903ab75b", "comment": "Malware payload (Mirai)", "value": "cd56f3b7a4151a8526d1eddcc04af0dbef2333ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890405, "uuid": "09b02247-1d0c-438e-81da-181fe5d881a7", "comment": "Malware payload (Mirai)", "value": "dc481a4b277472e5d274409ce70009b31fd85a55bca69b8482fd04ad5302f4cdfe405b2dc5529385b30045ae03d558b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773890405, "uuid": "6bcfd180-927d-469c-9943-20f7633629a9", "value": "T17BB32846B8819B11C6C212BAFE1F118E331317BCE3DE72228D145B6477CB92B0E7B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773890405, "uuid": "a515c631-e241-40b7-a71b-9abb3d59c5be", "value": "1536:8MniEo2vwK2hHqxgvbfXNxgVNTWZJzaIAZpfdhVd9RiifRmJPhr7gM5AYG0Cqx:5o24KLEl6WZNaIUtfRmJPhrkM6Fqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773890405, "uuid": "323db8f5-0f76-45b2-bc3b-716efa5ae0a8", "value": 111980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773890405, "uuid": "dbabeae0-9ffa-451e-93ec-9efdecc7aaee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773890405, "uuid": "4abcc1e2-b584-470e-8368-8fa553a42a4d", "value": "tux.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de231a66-236c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773908591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773908591, "uuid": "bc7acffc-94d7-4f24-b202-35de9861eadc", "comment": "Malware payload", "value": "362a05c05433d060383c4ba383d00839", "object_relation": "md5", "Tag": [ { "name": "Zusy", "colour": "#14D9BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773908591, "uuid": "d8524b42-ed55-4c52-8864-38be9c25ac42", "comment": "Malware payload", "value": "240068f98bd3e3213351ebdac3a0e9657f9a17506e43425ea3ed19f14e17cf21", "object_relation": "sha256", "Tag": [ { "name": "Zusy", "colour": "#14D9BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773908591, "uuid": "be9cf435-8882-4043-b671-eea5cd95f2f1", "comment": "Malware payload", "value": "9b25bdf80a95ba749001b29119347b2a686b20c0", "object_relation": "sha1", "Tag": [ { "name": "Zusy", "colour": "#14D9BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773908591, "uuid": "3d0f8527-90e2-4f30-8c41-ea3a9cc0c75d", "comment": "Malware payload", "value": "431dc730563c4f0a3caa08d9f89fb95552058aa7fb61167f006954119368a4e0313af34228801e2878ce53440a7eaf82", "object_relation": "sha3-384", "Tag": [ { "name": "Zusy", "colour": "#14D9BF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773908591, "uuid": "e46284e3-89c6-4f12-8666-db0aecd5817a", "value": "T1AB45C62CB29C6B42D36D17B99DB509A7D3FA68073954DB1F109B0C1C05437AF8AE93E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773908591, "uuid": "a9facc0f-3aa2-402a-9bf3-d94c6c7a17e9", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773908591, "uuid": "1def24db-0a9d-4db3-8ad7-6ff40da8016d", "value": "12288:KZoMsg62siAUVtbLZJrW6+oUKOoKoXnsgEMD1EL7EfI6OIe5:KZoMspiRaadKo33T1E/EfI6OIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773908591, "uuid": "8944e2b3-9774-4a83-b0a8-ba0817a511ea", "value": 1165824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773908591, "uuid": "28d89923-095e-4511-bcc9-ee1c4fcb33c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773908591, "uuid": "20186895-d97d-41f5-bc6e-11c799678a53", "value": "Microsoft.Win32.TaskScheduler.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8066307b-23b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773940646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940646, "uuid": "ed7df46a-1ec5-498c-82d6-003cb791d8c6", "comment": "Malware payload", "value": "a6f20d80731b8911a42c182563f7c7dc", "object_relation": "md5", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940646, "uuid": "e249297b-a04a-4b98-8480-5a90fbaa6a86", "comment": "Malware payload", "value": "247238bf9fa6fda6af254f33489799fdf5d83905bf4d8bd6c86f3680bb044253", "object_relation": "sha256", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940646, "uuid": "690f85e0-4118-4f2c-84fc-c4a6fc60cb57", "comment": "Malware payload", "value": "1fb55711b83d5f6d9800f9f7528d9541fc33c248", "object_relation": "sha1", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940646, "uuid": "9283dad3-bd21-4877-8d57-f40f6860587b", "comment": "Malware payload", "value": "0fcde8e8560c31ffa96b3694854dc2180ee6e00326077d723f7baaa74015ae0a94040fb6dfd339980132489e6c85a5a1", "object_relation": "sha3-384", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940646, "uuid": "bbef5a67-f818-472f-a722-fc3fa1e4390e", "value": "T104168F03B388753EE4571A3A583FA284983F7A213A26CD4F6BF40D5C8F396416D2A757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940646, "uuid": "400e56b9-7e34-4f87-a4ed-f0f4321ad1a2", "value": "4f3a70412c909e6e8f69020f0bee4f39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940646, "uuid": "8e87f51a-cf13-4791-98b6-84c073bf2539", "value": "98304:tYU5hnuOajWwMPdCpepI3GrwrA+Jm333k:/xuHjWfZIzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773940646, "uuid": "604e887c-1ce3-4f01-8bab-959e076ff59a", "value": 4366024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773940646, "uuid": "0c9f7f59-59cf-4d45-af92-95216e876003", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940646, "uuid": "ee9b7130-fbc6-4691-abd8-3b80b82359c7", "value": "247238bf9fa6fda6af254f33489799fdf5d83905bf4d8bd6c86f3680bb044253", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970accd9-2387-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773920068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773920068, "uuid": "f4e277ef-824f-4e98-894b-d0b7fcd1b3be", "comment": "Malware payload", "value": "822a7fc86540e688030558e72bc3da14", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Jianzhuohong-Technology-Co-Ltd", "colour": "#EA53C4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773920068, "uuid": "e623763b-2170-47f7-b2a8-ebc115bc9ca2", "comment": "Malware payload", "value": "247e00a6962c83384d2a96bb08b10393ecbc73ef0477de80dc5f940fc1a384e6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Jianzhuohong-Technology-Co-Ltd", "colour": "#EA53C4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773920068, "uuid": "6e0da5ef-d09d-4c3a-a903-118f3e00750a", "comment": "Malware payload", "value": "3b1eaead0dc1ce261286118fd077b50c2c742a55", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Jianzhuohong-Technology-Co-Ltd", "colour": "#EA53C4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773920068, "uuid": "16be5ef0-a486-48b2-b9a8-8355cf4fdd6b", "comment": "Malware payload", "value": "4a15ea7286e117e61fdd14307365ff2a6cac8fa266f74d797ee949edc7ba622a8d334598b42d7d01a26639182669d37d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Jianzhuohong-Technology-Co-Ltd", "colour": "#EA53C4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773920068, "uuid": "8212e401-3ee6-4717-89ea-2644e5e58353", "value": "T1C7B36C96B6A0C171E5FE083D14289572AB3F7460EFA1ACFBA744056B0E342C19F35D6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773920068, "uuid": "b7960ad5-4225-4cdc-b19a-7f292574f617", "value": "58d9849bc819ca0b41331e0bb25edd5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773920068, "uuid": "c7b439d1-9d4c-4463-83bf-573f1418b1e4", "value": "3072:K5kt3PQNWEjM+B+XjoQciePXj3nLwHWJlRDX1y/VU:3tcM+BejoQROrRr1y/VU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773920068, "uuid": "e5b26695-feec-42f6-973e-abf2c92bbd7f", "value": 108776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773920068, "uuid": "736f6993-78d8-4be5-9ae8-1f9f077d4d00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773920068, "uuid": "10625ad4-e7ec-4999-b578-35b57b3fa8b9", "value": "wwlib.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b37b5e-23b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773940729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940729, "uuid": "abd6e3c2-d1cc-481c-afc8-ee346418c973", "comment": "Malware payload", "value": "3127125e15c86fb41f69d3792b8ef3d7", "object_relation": "md5", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940729, "uuid": "a41ef36c-ad4d-40c5-8470-1580b76d0189", "comment": "Malware payload", "value": "2550f418574d7b543f9bddb18a0c7da20b734589a2f839ea906a12903892d305", "object_relation": "sha256", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940729, "uuid": "051908d8-2b72-4183-b5c0-94850bcaf5f4", "comment": "Malware payload", "value": "127082e6c7e6b8d29026a5fdeb5c53e596344938", "object_relation": "sha1", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940729, "uuid": "122bf7ce-1314-4e15-9f86-0e363913e51e", "comment": "Malware payload", "value": "ef18ca50eee2f9be6e9871d9afdc6ccec80753508392eb88d685fa1ffaf597d4b649b2b73821c5c9b35f3d463c277785", "object_relation": "sha3-384", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940729, "uuid": "403fd596-ca96-4e69-97d3-7eb48744cddb", "value": "T1ADF3C0413BFC4822CAAF4FB914F21141DA32A70B56E2D34E649C90BC7E5AB950F127E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940729, "uuid": "44ebc75a-f2b2-4409-973e-7d84b85ef272", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940729, "uuid": "8815ea7f-42ed-4a55-91d1-3bf1704b8d80", "value": "3072:EqvZr3eqUGbF9+jsuMjziqX3kn4suMjziqX3PXaU3yoxsvS2L9u7jziqX3tLBV0:pZ3eqUC+j1MH7X3841MH7X3ykNyvS2LP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773940729, "uuid": "84aaa346-e2cd-4c14-a60d-9fd7207191a7", "value": 171208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773940729, "uuid": "1b22be2b-f987-4807-895d-374cefb33317", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940729, "uuid": "2dc78f9b-9df4-45db-a2e5-27f08d691c22", "value": "2550f418574d7b543f9bddb18a0c7da20b734589a2f839ea906a12903892d305", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b554f6e4-23d0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773951472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773951472, "uuid": "c40ae3d5-8eed-44f7-926a-9534a11487f7", "comment": "Malware payload", "value": "085e2c75fd02e188ab9e7b542870288b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773951472, "uuid": "729a8f01-62b1-4fc0-8931-16389667d7a4", "comment": "Malware payload", "value": "263b3f3c5e91c8fe858803ceae4b268af40536487828cf980e8d6e4d793648c0", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773951472, "uuid": "cf355f84-4407-4fae-bd21-5dbb949a9e39", "comment": "Malware payload", "value": "bc1a757262290fa1a96503680a028a6df8e800f1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773951472, "uuid": "59a9130f-bea4-473c-959a-19df55af4f29", "comment": "Malware payload", "value": "25ecc8997dab70cd54cc71498177cf94a479f8e3bd19debdb82b58b77cfba4c72c83dab8cc9629e20cb1e665a1d5b8ae", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773951472, "uuid": "b92cb2a1-239a-4b7b-9730-68e9075f9cd1", "value": "T19D0602C4C8432C70AB3D9451CA5FDA2D201F74A312366E296E59B2ECBA5C4F7CD652BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773951472, "uuid": "b47ef43c-9a5b-405b-a5b2-610130f7e4c8", "value": "49152:nd9whtDphPSD2jPfEQcUhXf255yT+RXcsfV7iVTH3Kou1lwQ6NXrdnlxmxkfhqxY:nd9w8cECHaRFAXpnbbfhG/afVWyYlav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773951472, "uuid": "a3153537-2e2e-4cac-88e7-970198ce034a", "value": 3683349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773951472, "uuid": "d7563ff7-c6cc-4698-aa3d-5eed345a3a7c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773951472, "uuid": "b1d3b0c7-4735-43ae-a037-4340c35f63d4", "value": "quote11232356.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77baa473-23a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773931183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773931183, "uuid": "da570e99-677a-4798-a8eb-b60e2986ac13", "comment": "Malware payload", "value": "246e65ac5ac50e50bf974fa738f2357d", "object_relation": "md5", "Tag": [ { "name": "duet-night-abyss", "colour": "#0AD0EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773931183, "uuid": "caf2b418-d901-4650-ab22-fd0d9b8dab7d", "comment": "Malware payload", "value": "2653fcfead0706674007ac0d2ae76fef6d694356c479aa0005c6c26828bcc3eb", "object_relation": "sha256", "Tag": [ { "name": "duet-night-abyss", "colour": "#0AD0EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773931183, "uuid": "76362bd4-5f57-4bc2-a2fb-5b0d0b84ca51", "comment": "Malware payload", "value": "15bb71a7de54c1d35f25b423e820df3176b5ba6f", "object_relation": "sha1", "Tag": [ { "name": "duet-night-abyss", "colour": "#0AD0EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773931183, "uuid": "bc07c27b-57c0-4111-b14b-eeffaf55ce5e", "comment": "Malware payload", "value": "181bd283a0ed6bf035cfbf942b2c9e71fe0d96a2d724171d6a11f5748c2ad2c0dcf4cdfadc8ee930e6358fd8c2693c51", "object_relation": "sha3-384", "Tag": [ { "name": "duet-night-abyss", "colour": "#0AD0EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773931183, "uuid": "36d44430-136a-4499-bebc-fb399f69b3d9", "value": "T160F0AB7E123E60A2DE41C076119A12D0F2A4659A4A8C2711406EA4ECD9077EA0F9EAA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773931183, "uuid": "a7a5e544-02e4-49c9-8ff7-9ebf0066a911", "value": "12:5ja668p/zxKCQqCahc3b21dA2m6nJPihamW663ia9n:9LhB0rqC+US1HNiht/Yn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773931183, "uuid": "ebd39886-3837-4c9f-9260-1f71930c794a", "value": 440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773931183, "uuid": "9ac86d8f-54a0-4b51-b3ac-004e12451e50", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773931183, "uuid": "91572d5b-1a9b-497a-b0fc-64fb869c4d67", "value": "2653fcfead0706674007ac0d2ae76fef6d694356c479aa0005c6c26828bcc3eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ae7b16-23b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773940834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940834, "uuid": "4005636a-51d8-4f0c-ab07-8146f42b6c72", "comment": "Malware payload", "value": "afb0aac78b918b58435438d5d6b4baee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940834, "uuid": "6d6ca3b3-c8f2-4b23-94f0-42a08c1ea20f", "comment": "Malware payload", "value": "274d05dbce0372a7656d7ce4be1213516163febb7919bd2ba10706322fe24896", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940834, "uuid": "c0aa5df8-cb0e-47c3-bc61-3c5b03cdaa2a", "comment": "Malware payload", "value": "12e70d2a616181754ce36a602e904a8936eee631", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940834, "uuid": "20b91d34-86c3-446a-9e17-dd29606d3d58", "comment": "Malware payload", "value": "a6c8bff764ceb123ed9d46f9fb45e4f6a3f952fdbda52aa24e479218d211c494e9e93864444edc9738a544c043c6065d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940834, "uuid": "95bf19cb-014d-4cc4-8da2-13f0b415ba13", "value": "T1A0173343F794CFC7C0DDFE79A0E0095699E34C74AAAD430ABD2DB5BBADA22402C95354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940834, "uuid": "7c83bc18-41d7-45bd-adde-c15f83bd0cc2", "value": "393216:BbZmOQ2oScn1PXnB2LFU0IJ78oExxVJ0ANLm3RNBfc4fKWFhCW:dQ2oSa3B25U0MyVJncBkOFhCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773940834, "uuid": "99ab01be-30f6-462a-bd07-b7942b7ab9a0", "value": 19047632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773940834, "uuid": "93762cd5-a8aa-443d-8f0a-a8415a8e6607", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940834, "uuid": "d8186d95-526e-4423-ba7d-9596ac577e70", "value": "274d05dbce0372a7656d7ce4be1213516163febb7919bd2ba10706322fe24896", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "727ae5d6-2373-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773911417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911417, "uuid": "902ceb6a-a5af-45c2-87a6-58062d2608c2", "comment": "Malware payload", "value": "01970eeb82122de1b22f08701d97487b", "object_relation": "md5", "Tag": [ { "name": "Chrono-Orion-LTD", "colour": "#D76FE9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911417, "uuid": "b83c4ada-7206-4a1b-b1ba-4d636af0170e", "comment": "Malware payload", "value": "287a3a052ff0b2c495658fa90c5a9bd76f16d832d82138f6f8e87f9e2f578ab1", "object_relation": "sha256", "Tag": [ { "name": "Chrono-Orion-LTD", "colour": "#D76FE9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911417, "uuid": "4180ee4e-3935-4b2a-a96c-dcc44097969e", "comment": "Malware payload", "value": "48c6321edf755b332dc67759dd4772ec0a837bd6", "object_relation": "sha1", "Tag": [ { "name": "Chrono-Orion-LTD", "colour": "#D76FE9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911417, "uuid": "e2fd4b5c-accb-4b67-b024-0240804cf8c1", "comment": "Malware payload", "value": "9633f4529abb64d3dc11fe994efc842508ea3c9b5974157b11c44ab1c8b91f0ed30be95a3c05db68aafd7e2246007fa6", "object_relation": "sha3-384", "Tag": [ { "name": "Chrono-Orion-LTD", "colour": "#D76FE9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773911417, "uuid": "e0c729c5-1491-40d8-912e-5edd055bca11", "value": "T19A149D112B2C8339EE6D8A3564A9328137F6E771189CF71BC444545E78F23C26A9C7BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773911417, "uuid": "337c1462-7eba-4960-8c22-871314a7ad58", "value": "1536:tGxTjEP5NgNpTQtIvCegIfQAXk0tnq1RgrlpC/wfoW1C957jBmrAYo8l1UOLt2hl:0d7LyreNnMofP1GOd19qhj2g33oV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773911417, "uuid": "4788de09-bd06-4c78-9d89-4ae7e54b360c", "value": 197848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773911417, "uuid": "118ea28c-03f3-4e03-8017-502fc6e292e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773911417, "uuid": "c9559296-fb59-43a2-9360-85ce57881d5d", "value": "287a3a052ff0b2c495658fa90c5a9bd76f16d832d82138f6f8e87f9e2f578ab1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98bba4d6-239b-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773928661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773928661, "uuid": "a9034b78-d2bf-4faa-ab39-cac5811a2a43", "comment": "Malware payload (XWorm)", "value": "c5ef7a9177edb73840ba41d709f69087", "object_relation": "md5", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773928661, "uuid": "bd2f4920-2c5d-4f42-aafe-ef315206db33", "comment": "Malware payload (XWorm)", "value": "292f0dc47472057b493e1858eda6c1843531ad0f9ddcb1f7959b3677d2e0b0f3", "object_relation": "sha256", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773928661, "uuid": "e9a5dfa5-a306-4451-9112-d2e882e6d380", "comment": "Malware payload (XWorm)", "value": "f0ff7ef6f23eafcfdd3ba6c8b7bebb1e83ba461e", "object_relation": "sha1", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773928661, "uuid": "6f990703-bce9-4059-928a-da84813427f9", "comment": "Malware payload (XWorm)", "value": "aa24c44e18c2004f16c4bcff5046b2dbfb521387c3f4fbf36aff7346ed8b4a4caf4292e5ee7d6390bc609c6c84e99df1", "object_relation": "sha3-384", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773928661, "uuid": "3ece6578-9e60-470c-8671-615b7835c919", "value": "T1E693E102C5D86EB9DFB80A0944FE0A1F4BF1869B16272A4EF3673C575EB320A541B7C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773928661, "uuid": "944006f3-b6a4-47f5-8aab-49e3d42dec4d", "value": "1536:aM446bOmWsOkkIzCgAs+7hPlQc7xN27oGX9tqwT7NN8g3NGrSMJsolOw6ttYEY:ajh64Ok/WIUhPlQLp9R0gdG7JdO1ttYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773928661, "uuid": "3b3a9ab5-ba9b-4aaa-ba78-14e4185d2f6e", "value": 93847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773928661, "uuid": "9a37d03e-da60-4941-9a5d-7c0c7d8a2015", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773928661, "uuid": "7bddb6c5-30ce-4f81-b743-da62f61ca253", "value": "PO-HM-U1A00109-000015-RJ-0341SO 0876PO 0747PR-4798.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db411f82-23d1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773951965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773951965, "uuid": "b7465be2-a974-49cb-81ea-3286370d6b76", "comment": "Malware payload", "value": "a1b2f4a69ee5cc9fe9e2b4bfad0adc64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773951965, "uuid": "b99a3568-c68b-474e-9a20-c91fdd449e47", "comment": "Malware payload", "value": "2a753f687ad576ea9c2b4524efce33aa3f1080f022948a5c9be2a7619a102aa8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773951965, "uuid": "4999bf11-08a4-4675-a938-be219ef75a92", "comment": "Malware payload", "value": "15b8579b47812c5d558ecb141f6f003350364f56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773951965, "uuid": "3791cf1e-de03-4738-8aee-1f24b2b06602", "comment": "Malware payload", "value": "37b3d7ee49ab5c755dbfe7f127ccc4e5053749b20fb64909d41b1c5a295e7f1cbb7838545c8502a255795710bafa8f5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773951965, "uuid": "59a96f8d-0ba2-4259-9ee5-814b0192a6e0", "value": "T166F733658441067FD8A24332B9A1E101CD21FC351779CAB69FCD8789FD7BBE89831E89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773951965, "uuid": "2b8fe8de-23ed-477d-a89c-174ded26888c", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773951965, "uuid": "e20ef8da-2ab1-438a-b4be-733ae34a1f3c", "value": "1572864:UfjqEw90CBvgngQx8QcO7Ri3Y7gGYBPl19Gf21HbwIFiEBZE/:SW90KvgMP38edGfWwCNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773951965, "uuid": "a0cc3f0f-9af4-4be4-a290-bdac85bed8b2", "value": 76523550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773951965, "uuid": "d7da4b93-8e5f-46de-9836-8bedc60f5395", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773951965, "uuid": "ae744323-8369-4461-bbec-ae851ada9ac2", "value": "nixware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d71acd04-23c2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773945516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945516, "uuid": "a0d6493f-6b89-4257-bbcc-cf08217012be", "comment": "Malware payload", "value": "0c19f747c7045c3237e5e03e301752bb", "object_relation": "md5", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945516, "uuid": "a4f66540-dfe1-410b-9df0-47126c2a49e9", "comment": "Malware payload", "value": "2ad8bf48eb721677daab7141a7bd87292d4b3f0ffba5c3fe3fcfe0641a4ae10d", "object_relation": "sha256", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945516, "uuid": "ac58bf5e-4f3e-4e54-93c3-68c834bc7773", "comment": "Malware payload", "value": "da8aa4dfc4940b068958a78173ea693970441edd", "object_relation": "sha1", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945516, "uuid": "4546b6a4-3b65-4ad7-85ec-38e5ec6b9b84", "comment": "Malware payload", "value": "455d814a1899ecaf3cba774ddf9aac410b9d0b0c951c9685c37a436382468fbd565d94bd4e67ec8925b0aa1164b558ce", "object_relation": "sha3-384", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945516, "uuid": "b8c2cbee-aa80-497f-9d61-663178c718e6", "value": "T19371FF1693F8466BE4B70738AEF7530267B4F8608E72976D0990121DAC616A44E31BF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945516, "uuid": "3e0107b7-8e4c-4575-ad10-06bde44e925b", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945516, "uuid": "a3bac68a-e0cf-455e-a40c-d33795990ea5", "value": "24:etGSDsh2WEMqlB3luyq4usdrj2SNtkZfjaoMlDzGWI+ycuZhN67qakS17bPNnq:6uHqjl9tufJjavZzN1uleqa3pRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773945516, "uuid": "9747fba6-c160-4db4-915f-0d52e9a944b3", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773945516, "uuid": "fe2a75b1-92f3-4c83-82ae-4a0c86c75960", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945516, "uuid": "d11f82f6-f55d-4ee3-ae45-e0feed10e38a", "value": "4opwjnpi.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a27a30-2397-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773926851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926851, "uuid": "4f9e7e3f-a985-4e9d-a867-07f1a19e9896", "comment": "Malware payload", "value": "d7390ef13c119daedf2350978786696f", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926851, "uuid": "00598647-fd45-4a33-a07c-82ee4e9086f9", "comment": "Malware payload", "value": "2c7a99f137efd718f89cf8b260379c99af89ea1939568df09314918f2c5999a3", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926851, "uuid": "1ddadaca-b4ba-4365-8d98-c4138b0950a3", "comment": "Malware payload", "value": "8ffb47c2eb9f76ed7a0f8a68d2019c11a4bba291", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926851, "uuid": "6bc53c85-1c61-4412-b4ae-691b5b1fb8a9", "comment": "Malware payload", "value": "4a6f07bb97900c992a552ba734cca843d4ec6667e4ac6507e588bed860d3c2d250519df8e29f705cfbd24295b942003f", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926851, "uuid": "05c8d05b-d421-4a2f-b5e0-7be911847fa9", "value": "T1B131834338216F9C43371175A65DA884443315BF4C448A723CEC88B96F2577E51FE3AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926851, "uuid": "287a8c9c-0c8f-4874-a6dc-98dceb80d22a", "value": "48:5vZmEuZ0mC2lBOtuSiclOix7lLw1N6UMT:5haZ7l7K5wTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773926851, "uuid": "b8d7cd67-c41f-4b25-bfa0-8985164b1013", "value": 1710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773926851, "uuid": "cbbd4ede-2754-4166-a8ff-5fa8385c9d8d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926851, "uuid": "cdf4742f-868a-441e-a607-f1227c65180c", "value": "ru1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9772024-23e4-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773960150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773960150, "uuid": "a2f10937-e76b-461a-87b5-da104df7bfe2", "comment": "Malware payload (ACRStealer)", "value": "5beef4725e28c9d23f324488b62262ad", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773960150, "uuid": "7fd9c4c3-6fea-4a64-8a8b-636b1fb0de73", "comment": "Malware payload (ACRStealer)", "value": "2d04db4989b20f9b9a4b77ff3e14bdb2112159a9172cb186a623de5d65cc8fb6", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773960150, "uuid": "b36bf609-f245-4b36-8e03-ebfab2359c07", "comment": "Malware payload (ACRStealer)", "value": "dcd1828d8c9d7e8bd00d835f012cd68b9f10e1ed", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773960150, "uuid": "ff2024eb-5458-4f00-9b1b-8d0d06887be1", "comment": "Malware payload (ACRStealer)", "value": "4fb26d52ee8a3b4163806114b3fc98b336b6d2f8c827d7a08c09baaba4faf30edbec7f230560550d3f0bb660e29ab87e", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773960150, "uuid": "bfe2424c-55ea-4ada-897f-455e391d2797", "value": "T1BF350D8680A718F7F7A202FBA11766573E3B44C84D76CD3E45ED41DD25932AE63AF0A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773960150, "uuid": "72f57caf-c3fa-49df-842d-21c3c0319a94", "value": "1833002e48cfbe2fc20fcbf4b195a03a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773960150, "uuid": "b2c666c6-81fc-4f97-b0f1-329837334fa0", "value": "12288:paUNOSL9t1itwjIv5Gw+q+kKVhNWzR/4ocE+8SdwU1RFIykfxetxyX/9hNFG7WwC:eRn9q1+nmOQWrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773960150, "uuid": "eb1b81dd-405d-4619-9c53-5e3705209e2b", "value": 1111040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773960150, "uuid": "12718d06-168b-4125-a849-380543cb96ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773960150, "uuid": "7660580b-7c29-40dc-9ae2-a0819b2e8727", "value": "SecuriteInfo.com.Variant.Fragtor.933707.27630.29968", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47fe9238-2348-11f1-a769-42010a9c0008", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1773892877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892877, "uuid": "4d7390db-b0eb-41c0-b1d5-98ba5664d695", "comment": "Malware payload (Cobalt Strike)", "value": "56c208c23477008049e4bb9c8e5007c1", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892877, "uuid": "009b466d-16d1-4ee0-8877-865192acd998", "comment": "Malware payload (Cobalt Strike)", "value": "2d2a5ab13081475c1b5760c2237c8ed0dd4c3d79b1d4fb34d4241ca28e512aa9", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892877, "uuid": "22dcaf36-2bb3-4ff7-8323-994705823cff", "comment": "Malware payload (Cobalt Strike)", "value": "3c91e2aca7f33362008a67f0f82ee231bcdcfb55", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892877, "uuid": "ff2b3e21-4b90-4e52-9be8-8c3ad9bfaf8b", "comment": "Malware payload (Cobalt Strike)", "value": "caae2c87c55c4aefa5300a888bef79056d36f5ebef5b6bda7f48e7d5f74504a07a5e046d65683765da151999ae247dfb", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892877, "uuid": "d8cf1d19-0dde-4a18-8571-a295b9e981bd", "value": "T17B548D59F7A910FAED6B813CC9520605FA72BC524BA0F78B13D04A667F23AD09E3D711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892877, "uuid": "f69bc225-cf00-4bd6-93d0-488c496813c7", "value": "f0267431bb498326fdf816e2f46c04b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892877, "uuid": "c10cef7e-fd82-4a04-b4c1-35098351654e", "value": "6144:ezF1QkcbKuv3XVqF9VOx7S29/6YkuXwpQKb:ezF1IbVyfOx7v9SY3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773892877, "uuid": "d33a29d7-050d-49ae-a0e6-3cc2a055a3ce", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773892877, "uuid": "9ffaa7da-0905-49b0-b71e-9161a30be7d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892877, "uuid": "81725911-c46f-452c-93d3-25c1390dc702", "value": "4jgad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358ea15f-23ab-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1773935367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773935367, "uuid": "50985075-6f9c-49c4-8e13-2efe2f25bf54", "comment": "Malware payload (NetSupport)", "value": "54e9b545c00053a8456fb4629b794682", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "freegaten-com", "colour": "#D4EE1C", "exportable": true, "hide_tag": false }, { "name": "freegaten-info", "colour": "#AE56C3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pw-grenworls", "colour": "#11A8BF", "exportable": true, "hide_tag": false }, { "name": "pwd-grenworls", "colour": "#A45944", "exportable": true, "hide_tag": false }, { "name": "pwn-grenworls", "colour": "#234624", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773935367, "uuid": "24a6c444-4aef-4860-8bee-da983238fd4a", "comment": "Malware payload (NetSupport)", "value": "2d5a6f0b745f5f1818806b4538be54d739e66f134dda56129a4983c79b4b8ecb", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "freegaten-com", "colour": "#D4EE1C", "exportable": true, "hide_tag": false }, { "name": "freegaten-info", "colour": "#AE56C3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pw-grenworls", "colour": "#11A8BF", "exportable": true, "hide_tag": false }, { "name": "pwd-grenworls", "colour": "#A45944", "exportable": true, "hide_tag": false }, { "name": "pwn-grenworls", "colour": "#234624", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773935367, "uuid": "7665cbc2-4140-4a95-be61-946ccea36b2f", "comment": "Malware payload (NetSupport)", "value": "945ac5806b9f8443fed8eff07a7509861997be2e", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "freegaten-com", "colour": "#D4EE1C", "exportable": true, "hide_tag": false }, { "name": "freegaten-info", "colour": "#AE56C3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pw-grenworls", "colour": "#11A8BF", "exportable": true, "hide_tag": false }, { "name": "pwd-grenworls", "colour": "#A45944", "exportable": true, "hide_tag": false }, { "name": "pwn-grenworls", "colour": "#234624", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773935367, "uuid": "5ba0b435-a8a9-445c-971d-6c3eb096651a", "comment": "Malware payload (NetSupport)", "value": "d01bf35c9e65bc11121a0aba7410316a12e0ee054be43225dfd7b43cded8a836429eb8b07cfd443156eabab1bbe36689", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "freegaten-com", "colour": "#D4EE1C", "exportable": true, "hide_tag": false }, { "name": "freegaten-info", "colour": "#AE56C3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pw-grenworls", "colour": "#11A8BF", "exportable": true, "hide_tag": false }, { "name": "pwd-grenworls", "colour": "#A45944", "exportable": true, "hide_tag": false }, { "name": "pwn-grenworls", "colour": "#234624", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773935367, "uuid": "182894ac-23eb-4037-9364-955f876b878e", "value": "T14E6533EE265594D1D9A025DCCF6FD06103491B13E3D9CC22288EA9EB7956EF2E273703", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773935367, "uuid": "c988333e-58a8-4534-942e-c66075483e63", "value": "24576:nOMzsethsHFlM+Sh02bI5nOuqluqBrB+IzN0nropdloDlTPP+cFh4hJdas:OMzskhKrq0f5VqjNzm8pcDlT3DF4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773935367, "uuid": "751a83cc-4ea2-40bc-ad18-06834af208c6", "value": 1469937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773935367, "uuid": "e9e4d001-ba02-4da4-aa1c-8e7cd7994a20", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773935367, "uuid": "8c9cac37-6cad-44fe-bbe6-28ee0a4d0727", "value": "AltPayload.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8412ab-238a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773921524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773921524, "uuid": "adc25078-ac7f-401f-8e51-63905702749e", "comment": "Malware payload", "value": "667e9ceee1df535c94ebbd5ca9a94cca", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773921524, "uuid": "084412d3-b94d-4df5-a7a5-a588a5a71004", "comment": "Malware payload", "value": "2e1e891da17c20d5d8eacc82374b84cfb30536c9b642cfb26e8ba6d8d3bf0a90", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773921524, "uuid": "d104ffae-52c9-49d6-85b7-23f3304cb68e", "comment": "Malware payload", "value": "5e3eefb3de963181f5f109b59e087c4596f03ac3", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773921524, "uuid": "88886f62-48a9-48fd-a236-e206d4012eb3", "comment": "Malware payload", "value": "3a5d74adcb5e9fae8772f75fe3575a704a666ba05ecead7b0c72e8eff82edb8d7aed9a882ca1931da2ed4380749778e3", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773921524, "uuid": "69a7557d-7dbc-419e-a4fb-e2e382b3981e", "value": "T181E4B787F1208AC7F44FDABF14504210AEF0F4704607F2561B6E885A6FEB9C89E657E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773921524, "uuid": "beae6808-3188-413f-b2b6-ddf4eb315776", "value": "6144:+1eMX5Uh/W94gpr2TgPjhMoUW/lVVeIwqG/8PBKN4IUVG+Cr/1Jp3x1Zt7b:+pzkqrslR/1bvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773921524, "uuid": "257a0cc4-138f-47d9-ac00-dc817c7e9b16", "value": 702517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773921524, "uuid": "83b1cea0-04f1-48f1-b54f-a282003f1a51", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773921524, "uuid": "389479aa-36d2-459e-ba24-940bcd0b50de", "value": "DonutDupe-2.1.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6712bc7c-2398-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773927289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927289, "uuid": "50da2e3e-4a12-4180-a4fb-00bb1229259f", "comment": "Malware payload", "value": "a940bd24518f692868936ac99d5101f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Liansitong-Technology-Co-Ltd", "colour": "#A420A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927289, "uuid": "712a5778-f02f-4591-a81b-d3cd2ee4f717", "comment": "Malware payload", "value": "2e775b4d6e08d393d45eef272df92ad173ead4d8dd20a5df36b6ea906f19c7bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Liansitong-Technology-Co-Ltd", "colour": "#A420A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927289, "uuid": "1cd8dfcd-0a18-476f-8845-05f502a0e1e9", "comment": "Malware payload", "value": "99ebd3ae138dcb8dff9591e89c1ff7ee5d26627e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Liansitong-Technology-Co-Ltd", "colour": "#A420A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927289, "uuid": "fb224d99-69e3-4dba-a27e-052dea2caafd", "comment": "Malware payload", "value": "b2dd209e2415bf3c48c43a4bf7b6d65e8a3b20555b96db3317a18a7f1a78578330e67dc3b24f10b9313212787ab2535b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Liansitong-Technology-Co-Ltd", "colour": "#A420A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927289, "uuid": "a18c8392-2d9c-4a22-9be2-eb8012db1023", "value": "T1B3544D0677F42102EDBBCD391CB191330A38B16A8E22E5C538AD505C4FB3A53563A6EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927289, "uuid": "2d7f8e89-97bf-47a9-90fb-094350216b57", "value": "768:889zX3OGXbW7Eu2oKRjQrE52U2fr0DnJEFr15ZfKIqJjjiK6SMtiViBdqTRNrtY/:8aXbW5Kmg2U2jin0WvyhsLmYBlY2qQv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773927289, "uuid": "838eb474-1dd1-4d04-a376-31a8ad40603a", "value": 297216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773927289, "uuid": "7bbda671-1d52-4071-bbfe-b014339e06fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927289, "uuid": "fec56096-5d52-4001-aaa6-367e182b405d", "value": "2e775b4d6e08d393d45eef272df92ad173ead4d8dd20a5df36b6ea906f19c7bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a38877d-2394-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1773925415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925415, "uuid": "69089f95-b909-4a5d-9b36-3ea1e02d1570", "comment": "Malware payload (QuasarRAT)", "value": "b78e41a98d6fea633bb9f2f00082ea46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925415, "uuid": "6ce00832-dbca-4cc8-8a77-6c032ba57707", "comment": "Malware payload (QuasarRAT)", "value": "30dfe87c5c3844e6d6a1ad8800c177cce116afe6b123ef385d6fc6df5b6f535a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925415, "uuid": "4c0865f0-99cf-4c0c-92b8-6a70b1bfb136", "comment": "Malware payload (QuasarRAT)", "value": "259919078ca00a2ce270a7afba4938f2114db7d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925415, "uuid": "618e50a2-6b51-425d-af55-8986754fb8b4", "comment": "Malware payload (QuasarRAT)", "value": "e8be2288b3ce504f32fd8a2e444bf011c8c9627a1b298e392d32a87aeb815b90b5d7beeca46d610e0c835fa9e2d24ca7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925415, "uuid": "8dd9c95e-a26b-4401-b463-1dd7bd687e6b", "value": "T1E3C5AD243DEA401EF1B3AF75DBD474DA9A6EB223770A965D149503870F22A40FDC723A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925415, "uuid": "f1e2141d-fbcd-48c7-ba46-7555aac35d7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925415, "uuid": "43c94d6d-f6a7-4661-b6a3-db2a9fe4433b", "value": "24576:3nolSWeWBRYRR1qJ10m8yXP8oc5R2NntxO0KKSb7yviUSQaBaOwIRxl2S62/90yG:XG7YRnirm2NnPlKKSb7L3wip6MaRx2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773925415, "uuid": "3395dc25-ac77-4b6a-9555-5ecb9a04ab88", "value": 2497536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773925415, "uuid": "3711e664-b90c-4090-b79e-2deb6c3bd4d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925415, "uuid": "8c1d27d3-7583-4229-8b20-e986d3248a0f", "value": "Echo-1djeuw1fkgrola13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b78a19e-23a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773934517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934517, "uuid": "46a26167-b553-4286-b697-cb127797a590", "comment": "Malware payload", "value": "b0210f4ebae8c8e37c95cf326291771c", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934517, "uuid": "589840f9-c9fa-4a21-89f5-774da2d19f35", "comment": "Malware payload", "value": "313b72070d85ef01e6e096417321c86dd69fea0738cd06eb35bfbe693874176b", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934517, "uuid": "25c014fa-c3e2-4992-bddd-e0e0cb99558d", "comment": "Malware payload", "value": "f760bc495b075b27a9f2fbf8329b0a252d31d165", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934517, "uuid": "def4413d-efa4-4b77-a2e3-4f23d8436850", "comment": "Malware payload", "value": "7e73a894529985195dd5797260b834d476f1531e0d39ce7d60d71201fcb30feeb1017b6d26c43e84b6335661c3bd4472", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934517, "uuid": "3a4fcdb5-9acc-44a2-93fd-d34961d40d51", "value": "T184B3218E8E4EC9ECCB5FB4258A1E6D07CEDE0143171EC66036AEED803F21E6571A55E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934517, "uuid": "c44c4aa6-02b7-4840-9d9b-3e9c471a1175", "value": "1536:lKIY01dzTcYkghWCtK8WiNbUndPXplPUUGpGGDgpUlxwy2QJwB:X1xTVkghWCtK8WiNbUdPXk2PB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773934517, "uuid": "7b3349c2-0c77-4333-acd4-41642c398043", "value": 114880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773934517, "uuid": "6d68394b-d4d0-46b4-9976-591e970975d8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934517, "uuid": "1e0ab44d-455c-45e7-b691-1e3ecb081359", "value": "Meeting_Alpha_Report_925.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e03a49f-2371-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773910550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773910550, "uuid": "16a401b3-8690-46b5-ad56-86e637690dac", "comment": "Malware payload (Formbook)", "value": "41c53577d2f4bfa75af06d6c60e9c9f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773910550, "uuid": "4bfd9665-54b5-4c08-9e79-6bbeaf89e2e5", "comment": "Malware payload (Formbook)", "value": "316fee57d6004b1838576bb178215c99b56a0bd37a012e8650cd2898041f6785", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773910550, "uuid": "2c130e00-434e-443a-8d7c-da5ac6344c24", "comment": "Malware payload (Formbook)", "value": "fae4ba1974b3ef76d82de9183a63d085ad769d2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773910550, "uuid": "2e557e05-595b-46d8-8b5f-68cd5067b603", "comment": "Malware payload (Formbook)", "value": "59727908dd6a6170e48c05a3002e38d940ad07e2168607e11d7d89648420695d4b256daf26b6e203fe157ebecb4f5716", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773910550, "uuid": "d87513aa-0b4a-4844-8623-91cbaf187063", "value": "T1C03512543728DA52D8AF977456B1D2342330AE6ED853D717AFD03EEB38B3710462A683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773910550, "uuid": "2df7e331-393e-4182-ada0-bdb697409e70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773910550, "uuid": "ec33caa8-68f3-4ad7-bbb8-5c56d43855be", "value": "24576:oych15rXDMJMVqoB9MVa0eWMqMRnskG4oR1LE:o/vDMJTobaaJWMNskG9rE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773910550, "uuid": "07cdab6b-20e2-4cb2-b249-d85e8cfc9635", "value": 1161728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773910550, "uuid": "e05c2a19-ab4e-44d9-92f5-04901fb24125", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773910550, "uuid": "d8733239-d7ab-40dd-9c9a-8195b1d9fffe", "value": "Quotation Request.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f4168bf-23b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773940698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940698, "uuid": "e8f11482-9a1b-415a-8e58-271709a901f5", "comment": "Malware payload", "value": "d61939918876d5ec139c3e6890f2206e", "object_relation": "md5", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940698, "uuid": "a2b423aa-5756-4281-b0fb-f5edb9e0b088", "comment": "Malware payload", "value": "3187d7d38c47124e360db6441709c1a6ce0617a06cd02668399ec053e60aeb8c", "object_relation": "sha256", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940698, "uuid": "9b062cc8-cb31-49e7-8a33-1faf6b54bf1d", "comment": "Malware payload", "value": "2ca7f3f288f4537a983cf4e32f3e6fe8645c67d6", "object_relation": "sha1", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940698, "uuid": "78ac0604-a3e2-42cb-a28c-bd6dd6bf1482", "comment": "Malware payload", "value": "91b46c60d81ce8c34de48f45304935cc2bd50e6a886f03b5003c2fb980d4e3c2e8cdbebca00f010a6aff463a035e685c", "object_relation": "sha3-384", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940698, "uuid": "75330438-1d7d-4854-8255-0be290f77c2e", "value": "T14DB5D03FB28B653EE06E5A357A72A610583B7A61A5134C1697F4C88CCF250B01E3F797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940698, "uuid": "bd077472-6b60-4632-b2b7-f5627eeed688", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940698, "uuid": "fa7a93d4-dcea-4a72-8667-6317a19b4f09", "value": "49152:WuI5hHUszP3aLqFaa7H7+eJJ1v6Bnadq1e:W5/HU2j7+eJJkBZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773940698, "uuid": "6dffccdb-f0f3-473b-8852-394d4c88fd11", "value": 2396872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773940698, "uuid": "e359b31a-48a8-4a68-ac5f-48eee606dede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940698, "uuid": "50930bb8-fa3c-4fac-896e-4428fd43ca69", "value": "3187d7d38c47124e360db6441709c1a6ce0617a06cd02668399ec053e60aeb8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af559b5e-2353-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773897775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897775, "uuid": "1491683d-9738-4d4d-aa5d-9bddf07051b9", "comment": "Malware payload (AsyncRAT)", "value": "7239930060b6cea0e612592dddb539de", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897775, "uuid": "5961cb22-702d-43df-a3fa-2550e800f3de", "comment": "Malware payload (AsyncRAT)", "value": "3233081b92022de886377f096c194f9ef8d663659fd95bf8f72fdfa7ffa8c2c6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897775, "uuid": "1aafab57-cd5e-4500-a7fb-8deeae5df57e", "comment": "Malware payload (AsyncRAT)", "value": "3d4d3f2c55c05c7fc03b4c17f4f5f10b554724e7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897775, "uuid": "31ad470a-0fda-4590-b98d-0863290064f1", "comment": "Malware payload (AsyncRAT)", "value": "653b2d30f8fcc52bc5118a3cb9ed6d762998d0a5586ba600c0502c9200dcbb1ffc5ac9ff4f1459df64e52ed909304d8b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897775, "uuid": "806bb716-eba7-471c-ab63-3ff0cefdcdba", "value": "T1CBF25C0877A04326D6EEAFF069B372014674E5179813EB9E0CC5899B7F77BC086513EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897775, "uuid": "67cf4042-0ceb-417a-a3e1-77e313d66b47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897775, "uuid": "281311ee-cb78-4f17-bbbf-eb0e6806cc51", "value": "384:kfqRqZpTcQYekMvCJttwe2reNpNXiLsp0d6lL4gJEUFzHd5ApkFyHBLTnOZwpG2j:6fRuVp1msGS4FOddFyZ9FXOjheSl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773897775, "uuid": "ae5eb53f-b175-4022-9d49-4023174b219f", "value": 34304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773897775, "uuid": "3ce53a1e-c02d-409b-a9f6-39e82f03e911", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897775, "uuid": "78662130-4654-4f74-834e-5773809fc795", "value": "ExcuterD99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac2d0793-2370-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773910225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773910225, "uuid": "a428fa0d-386f-4db2-b908-45a39fd21628", "comment": "Malware payload", "value": "39fcb914789b6d948d8ea0bff134b95f", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773910225, "uuid": "c0bb64c4-2977-45b3-a97b-7b61da35e79f", "comment": "Malware payload", "value": "3241037dacddcdabf17cb68ba67fee7d48c4bf1caf16c15832b9979040a9cb76", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773910225, "uuid": "67c85f75-71d9-42bd-83c3-8e6d3b22f10e", "comment": "Malware payload", "value": "2f64bd76c93b80ae3d3490140aa02675c710d97f", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773910225, "uuid": "59cafbb5-125b-4bce-afb3-66739a723596", "comment": "Malware payload", "value": "75a6dc842f94ddf1e659fd72ac5c98aa00968824567d5e6919e42497559a691359ac47241693be447f85db3888188a68", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773910225, "uuid": "e8265557-856c-4fe2-ae0e-95f3d8efdff7", "value": "T173C3EC249D5BB07816963D18903B498FEEA85B891447DBA0BA3EDF301F12773B4D62F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773910225, "uuid": "96f1809c-e98f-4e65-ad6a-bc582b880a24", "value": "3072:bmXiX75ncNVBnSIcXhJ0H1ctDK7/NZ878R9vUqgiMafxop5jlqBzT/HSrwW24rWx:dU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773910225, "uuid": "d97fb4f6-314c-474d-a0c9-5f0162a96087", "value": 121204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773910225, "uuid": "ef5098db-354e-4299-99a6-1732daec81fc", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773910225, "uuid": "a2087adf-b513-437c-9913-3c928531d286", "value": "USA_Journal_Stable_310.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee53c068-2345-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773891868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773891868, "uuid": "a3f67d27-1b68-47a6-949c-1b5a1a0dfaef", "comment": "Malware payload (Mirai)", "value": "a667fce1ea94c1235d2c95f04ac7e7c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773891868, "uuid": "b4b529ac-77fe-44f8-b802-39247cac4e47", "comment": "Malware payload (Mirai)", "value": "32ca4b70e84787144574bfdb85a0092f3ebf524bb78febdd28d4c832b53fe100", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773891868, "uuid": "556b6eb2-a36b-4494-a9e6-96ce97d1856a", "comment": "Malware payload (Mirai)", "value": "ca61b536f11d8159fa0f416c5f266a3ab5e8cf9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773891868, "uuid": "b7de4c39-45d0-47f1-bcaa-5eac912644a8", "comment": "Malware payload (Mirai)", "value": "d5cbe76896cb40d7f1842e5beabac085b86e41113a9d8ac24ef41937dd52a665c1a11effd9f46c9190a7458036a6ca37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773891868, "uuid": "e198a460-9759-4f76-ab7b-4b9133971dc5", "value": "T14E043B46AA419B13C0C72776FA9F42453323AB64D3D733069928AFF43F8675E0E67606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773891868, "uuid": "567430f0-07fa-4809-af43-e13c2bc4a249", "value": "3072:waC2+bitwODWJa4K8RTul+d19jd9aa+64RjsqTipuM/9cwfM7xI:xC27uJa4K8RTuly195Eav4ZsqTiUM/91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773891868, "uuid": "7c186a26-647b-424f-a1d2-74b0183e9d0f", "value": 180982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773891868, "uuid": "667783a0-69a9-4dad-86fc-b3314f990c9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773891868, "uuid": "7534b76e-947a-4196-bfd7-d33984ee16ac", "value": "tuxnokill.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "012bc710-23bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Meterpreter)", "timestamp": 1773943010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773943010, "uuid": "5db3a444-ba3c-4dc7-a5ef-5cd292c9c9e6", "comment": "Malware payload (Meterpreter)", "value": "16730fc6f05f588002bd420ca29756ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773943010, "uuid": "c0c674d9-8675-415e-8457-b9f826c2fc1f", "comment": "Malware payload (Meterpreter)", "value": "3404b9e283fa22f8140855f5257853da1dc16380e8bb2f91409d3a71469784d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773943010, "uuid": "ccf18963-0d7b-48dc-b80e-84668383b8a7", "comment": "Malware payload (Meterpreter)", "value": "3efcd68e91751414a19f3be0856265081322097b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773943010, "uuid": "8daec16c-a611-43d2-970a-2da2a90badfe", "comment": "Malware payload (Meterpreter)", "value": "a91403073707ab82aba634a68df2f2288fe5a0b2612fa22a0506194d2e56b380d23d9f24cc0f234ea12330987d2d557f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773943010, "uuid": "a19076ca-80fa-4abe-9aa9-8edfd9e738d3", "value": "T18E353843A69885EAC85EC03C87579632BA33B89D4720B6EB27D45B343E67F406F0D719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773943010, "uuid": "835fb248-f69f-4411-9c00-e5a3eb71fe24", "value": "4dc5d829ddb1ea7dc25b3d1eebeb7d63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773943010, "uuid": "39dd8c6e-8e0f-46be-a8d5-40776e5b5cd7", "value": "12288:U43qbFY0vg262DPeVMMef0atjQj55jP64pxCK9yH0XWVU/lyYa5eI2ZuCF2H9d:U4+62DPeyHj14pxFBWSyYagJZuCM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773943010, "uuid": "8585a53b-d3c8-41e5-b87c-ac6895609339", "value": 1137664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773943010, "uuid": "45055f0f-ed6e-4234-9fca-24ceaf3551c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773943010, "uuid": "3e59d8ec-4863-49d7-be2b-25f36bbe12de", "value": "loader_v4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef2f16d6-2395-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773926229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926229, "uuid": "a19c88d4-0636-4eb2-aab1-239172fd6b82", "comment": "Malware payload (RemcosRAT)", "value": "c17d8a12dd918979edbab99147ec80a5", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926229, "uuid": "fa779696-b9c7-41d6-80f0-2522b9773dda", "comment": "Malware payload (RemcosRAT)", "value": "343c989bcad8842c0a01e23538cca8037aebd48a11fbe973fed68b4f197798e9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926229, "uuid": "dbf56daf-cd1c-4dcf-b48f-2b849a61e035", "comment": "Malware payload (RemcosRAT)", "value": "a76e46a5ecf8ad6e13378e8933d3989f2294752c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926229, "uuid": "b63bf674-dd0a-45eb-abba-c88e0c1d51a7", "comment": "Malware payload (RemcosRAT)", "value": "5e445c8307ebc0ea383115b5a224eb41854598400a9c8e12e677cb3a1d78de4577fea9b8d01e02a69ad959c8b0c63219", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926229, "uuid": "6cc557c6-63ba-4275-8983-0e2eab274447", "value": "T1AF552374AA03BFDCF06679F586D25010019CAE209FC6CA9FB2A873392C7967057767C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926229, "uuid": "3d0cfa4b-81ce-428c-b0ed-b90bf2113e24", "value": "24576:2eP8oTCi4Pf5GVnEjP8oTCi4PfBgZV2j6cFrufKritWC/:5Eu4pGqEu4qZI6wrr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773926229, "uuid": "bbc8eba0-fe7c-4be1-a580-6f368831136d", "value": 1296896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773926229, "uuid": "dae5c031-c330-4609-8f2a-aba1b68dcb23", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926229, "uuid": "c7217880-e48b-4497-8f0b-95eb1620f00a", "value": "c17d8a12dd918979edbab99147ec80a5.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bea34f0-2386-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773919566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773919566, "uuid": "5310148d-957b-4658-8fb9-0f224e519bf2", "comment": "Malware payload", "value": "3d6eff92c2e16c2c674a2421d6b6a3f3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773919566, "uuid": "30b7dafd-128b-4843-867c-cfa793928e21", "comment": "Malware payload", "value": "34c5cc6efcf9d937dd525c2156068cc248b41ceb46fadf1acfb744e84722bf93", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773919566, "uuid": "17434e72-2cbb-4bb4-8760-4d54f8ed370a", "comment": "Malware payload", "value": "d76d729416d0cf725a267969d0b82b6e1433be41", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773919566, "uuid": "9f3ab2d5-7ed2-4f54-add9-45874c710315", "comment": "Malware payload", "value": "2be5209606cb9ba6f7b8addfc748feba7cf44a9d94cc215e660f8081aa9226529e1acb4391ced5ce516a6e399dc2179d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773919566, "uuid": "89aee915-ce5f-4e7d-ae00-d161f3f17f53", "value": "T174664B03FD9144E9C0AAE23586639253BB717C494B2163D73BA0F7292F76BD06EB9710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773919566, "uuid": "2ce9f763-3ed9-471e-bbb4-7d2da17766a8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773919566, "uuid": "d861cc40-0bd9-43fe-ab6d-6b009bba626d", "value": "49152:wLi9++/JL4sXVACCFpPJSrt/p3kzzIZb8rtR6/l1uOjLYSI+4iETk2EWL9AUV7Ev:w++M6xgts6t1uOjcJwoC8bTVxME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773919566, "uuid": "b8f428fa-3935-4d0e-b7a1-c6d391b8fbd8", "value": 6934016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773919566, "uuid": "c3db55a9-a8fb-427c-8f5f-481e0edd66fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773919566, "uuid": "8a675d68-cb3f-4ead-b609-39227b079390", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d5e631-23c4-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773946284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773946284, "uuid": "c1a49bc4-a0f4-4a19-86b0-986758bd8300", "comment": "Malware payload (AgentTesla)", "value": "cc94aca45246f8094c7d0bf11be0edcf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773946284, "uuid": "f33c2456-bfbb-4baa-9289-da810361af9d", "comment": "Malware payload (AgentTesla)", "value": "3507a2757ff8521aec61165f7cb7a42c8c96f7058bfd4a7b26a81006b67198a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773946284, "uuid": "45a7156b-c068-4b89-b40f-b5dee7f8775a", "comment": "Malware payload (AgentTesla)", "value": "44b9e9183a83b3209772452b8d420263c00db6bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773946284, "uuid": "d0c3847b-7c00-486b-b382-0c2a4a9284ca", "comment": "Malware payload (AgentTesla)", "value": "e14625c871fd85b7120fa62d466306fec13acb11b7bdc40daff26c85ab202885ccd2c01553f6977d85461141155f8ab8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773946284, "uuid": "03a9c9d6-8d14-4eef-b1c8-cd7df6a24292", "value": "T13935AE0273C1C062FFAB92734B5AF6115BBC79260123AA1F13981DB9BD705B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773946284, "uuid": "80bb4143-e29c-4ceb-a3eb-c7c3d7314291", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773946284, "uuid": "dd0f7542-77c5-47a8-8834-8ff66b3b314a", "value": "24576:L5EmXFtKaL4/oFe5T9yyXYfP1ijXdaVYuKtZxdxs:LPVt/LZeJbInQRaVcx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773946284, "uuid": "e4d4ecab-6115-4320-9648-360652c28839", "value": 1155584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773946284, "uuid": "540b3406-22b7-49bd-b999-312ca311fd60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773946284, "uuid": "2271bd98-0395-4f08-b92e-0383016137a0", "value": "shipping document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd8f7193-23a8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773934414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934414, "uuid": "c1de2bdc-3d13-4bba-b8da-718275690f78", "comment": "Malware payload", "value": "0b541d8d97eec44efa16399d6f025416", "object_relation": "md5", "Tag": [ { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934414, "uuid": "e3a36a71-0e0e-488f-8915-5c0f060baf3f", "comment": "Malware payload", "value": "36affc7afbcf01664d0f4a129cf4d98a9434ae00cb92d2e6ef3c0aaf605a3bbb", "object_relation": "sha256", "Tag": [ { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934414, "uuid": "ecbb2061-627c-49cd-b551-fb5a7c1981f7", "comment": "Malware payload", "value": "e9d47c59be70a71f395244300e59250d7928a5f9", "object_relation": "sha1", "Tag": [ { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934414, "uuid": "580ec87f-d16f-47c8-bfd2-8ff221539aa0", "comment": "Malware payload", "value": "2592d55684820b4290e7b2d5d7e51d24b816ef3d6b436e3ae9444eb21a802b17c06f685e54958fa1ec27f6c45fb53a0e", "object_relation": "sha3-384", "Tag": [ { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934414, "uuid": "74922312-cc75-46e1-bf88-e1ee417d234c", "value": "T101135242EC6ABC54D393D57A8817A4832A4A78074A192C3C7FFC91642F5933D86F5EF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934414, "uuid": "34375f60-4acb-4ddb-8f60-2067815fb557", "value": "768:CzxkO3NpXQmH8zCW5lENXR1MK8QZKZYsguWvAsxY:CzxL3NpgmcWW5lIXRL8mjuWvnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773934414, "uuid": "802c61ea-9090-47d3-95c7-ad2d3fd6924a", "value": 42561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773934414, "uuid": "7ebe09de-b44a-411f-bdf3-31215b27967a", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934414, "uuid": "10821d56-fb7a-44be-8131-511da34f92af", "value": "36affc7afbcf01664d0f4a129cf4d98a9434ae00cb92d2e6ef3c0aaf605a3bbb.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27aa2882-23a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773934484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934484, "uuid": "232499ed-2106-4505-894f-b8e616ad5aba", "comment": "Malware payload", "value": "252e57f0fd316e31a44ef160d90663e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934484, "uuid": "1fcce587-fe81-4f71-a49c-a8bf60e7ad17", "comment": "Malware payload", "value": "370d36a89f8ffa291fd22c40dda78fd6154078b2e2b4b100d5c2429135e4aa72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934484, "uuid": "187b2786-6ae1-4ac3-955e-fa75db9ee114", "comment": "Malware payload", "value": "621a4ff26ef07fb666f54936c19b437e4db6f8b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934484, "uuid": "c77dfba8-4217-4cfa-837e-a456b551fd00", "comment": "Malware payload", "value": "0ba29bdc34948523347448d4cb731a94af50afc9166c62c9587728e616480a254d22d3ac93709b9421a02c6f3ef702d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934484, "uuid": "114ae202-7485-4101-ba61-a7796530938b", "value": "T1239633A5A3B208F8D9F7953A82ABC118D67270574719D2CF27D006926F27BF24D3AF11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934484, "uuid": "99539408-be0f-4360-a4a7-380a88f8cf61", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934484, "uuid": "10f219df-2c05-4f79-8edd-1b23b57b0f08", "value": "196608:uBNTwhLTyfA1HeT39IigwqtauDXURuAEk0ax8ZnEqCMS:uWLTyI1+TtIiFq8uARuAUax6nEqCMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773934484, "uuid": "908e5c49-cc31-4ed1-bcce-e11a2761039d", "value": 9243561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773934484, "uuid": "8772585b-ba67-4ce3-87a3-362314c12c28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934484, "uuid": "d62489ea-b2cb-4ec7-8a78-d53ab59a1332", "value": "370d36a89f8ffa291fd22c40dda78fd6154078b2e2b4b100d5c2429135e4aa72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12048f9b-23d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773954205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773954205, "uuid": "374a1813-fc42-447f-af33-6725b23dce22", "comment": "Malware payload", "value": "284d07b7fbe979a88617eb3cdd0b510d", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773954205, "uuid": "aeb5f1da-2cf6-4047-9ab6-88f4c2cf1559", "comment": "Malware payload", "value": "37ab04d71c25c4c158be7e571f44344676dda0614e06166d56b4b152a4c0ac16", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773954205, "uuid": "c9d5c996-1ff4-41c1-aa98-c2bdd5e72b47", "comment": "Malware payload", "value": "8b2f5aca377d9a2d18d9dbbb641349f6782855de", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773954205, "uuid": "bc871a14-037b-4c13-a14f-368a083d310d", "comment": "Malware payload", "value": "a33931e96b17f053977d768464567c311518fa485d66ecaf600a599b7099c5561e4290cda2f040cc348aabdb045a9b18", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773954205, "uuid": "557da998-1d93-4fec-8401-486df5fcea2e", "value": "T1E1B3009E599A8476CB5F7034850E6D079B9F92230B5EC4C4BACE9F453F12EB070BA6D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773954205, "uuid": "545c5b96-ef87-4e29-a84f-72b6755582a0", "value": "1536:WJ3rpakO4lvh7waWwicGqiv46qId6qwV6q4V6q2myIT:P4Fiwi86qId6qwV6q4V6q2cT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773954205, "uuid": "20c0d601-215f-4f21-8bd1-b6d1d699f21d", "value": 116225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773954205, "uuid": "8aa1b0bb-e741-4662-b2c3-6eec9f0227cf", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773954205, "uuid": "9377fb63-335b-4c1f-ad00-661ec6f3179b", "value": "Office_Journal_Stable_455.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f9a7a1-233d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773888143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773888143, "uuid": "be3de70d-dd71-4283-a657-9e53b9ac5ddf", "comment": "Malware payload (Mirai)", "value": "306d7c97329f69588ff6ee54417f5e38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773888143, "uuid": "dee03231-d366-49ff-b23b-521c8a47a949", "comment": "Malware payload (Mirai)", "value": "37b97489234f9690888dd82f1e4d9d24f0d27e907e56e3195e3965de7c1c4c0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773888143, "uuid": "3a2b6d8f-23fd-40c7-b592-798f8d17e2bf", "comment": "Malware payload (Mirai)", "value": "6557a3287508798adce80ac84f1c987574f82c23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773888143, "uuid": "b550178d-ff22-4f91-9cd0-7794c78e171c", "comment": "Malware payload (Mirai)", "value": "ce5b34caa4f5ce0e3da903393ae6087dc19ad4fb2f515817d3e98822a43390226a470f2d77a47a678889a4efe8b7f442", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773888143, "uuid": "2c2142ff-23c6-48e5-96b4-407283e14d1e", "value": "T1ABB35B22BD791D2BC1D4A53B21F38365F2F2538A20B88A1E7DB10E8DBF6464036577B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773888143, "uuid": "97a3e566-5f64-4345-a2b8-1c290e1ec139", "value": "1536:0RuOZaNjlheG7LsLaOXVxzcXdbaqHPtRY8Nl5qu/U+lCt+AEdHy3T:SuZpoNxAta63ZNXq4Vi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773888143, "uuid": "4ed6cfd4-c662-44bc-b8ed-eb6962b3e69f", "value": 108760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773888143, "uuid": "d84d1317-30c1-4bfd-902e-0462596480d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773888143, "uuid": "30d60515-dbd5-4f9e-8696-7108fc0f508f", "value": "tux.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d8c075-2342-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773890241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890241, "uuid": "7f9a297c-a5af-4308-8d74-b53f5e4c1098", "comment": "Malware payload (Mirai)", "value": "abc85ce643c49546372d5fc9720d4d37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890241, "uuid": "621eb138-19de-46e0-89c9-faec28dafa97", "comment": "Malware payload (Mirai)", "value": "38b46f687afc3d3f209f80f0b43ff919e482ed5ac751e832434fb4d07cf3c0d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890241, "uuid": "cf95de36-efa6-4a92-aa6b-a6475ad6f6cf", "comment": "Malware payload (Mirai)", "value": "76f949b4cf86232f7481b970a981a743e879bac5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890241, "uuid": "1ec42eda-c3bb-4954-9983-fe530c94d4c7", "comment": "Malware payload (Mirai)", "value": "ed4315ab8baaae9dbe52e023e1c4a6a0f40cb5e829451be02382e0269e047121f03a8c98a6b21c5a8ad1bb619e133669", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773890241, "uuid": "9dca68c8-c02d-4e38-9859-9f06fc6cef00", "value": "T1D4A34B92BC41AA21C6C12277FF6F418D371653ACD2EB3213DD195F21778A81B0E7BA46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773890241, "uuid": "e70f11d7-f16c-4a2e-9737-598fc51cfffe", "value": "1536:O/Pak9rSiFMqtWIHsnT/ux1CnbGXnhOeZrNiLZScZnKBWHB6blX4Qz3fOfNdFsnZ:O/PNrTdfsTQV3QqZeZ/B9B6RX4Y9nK0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773890241, "uuid": "ca10dd0d-4075-411e-b7a5-e6127b637a0a", "value": 103680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773890241, "uuid": "52c335d5-9ec4-49d9-91b7-b70e8ddd8949", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773890241, "uuid": "a88ca3c1-73f3-4593-aaf6-107450f868a4", "value": "tux.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baecd7de-2392-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773924853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924853, "uuid": "d7c25a67-4c90-4e3c-a48e-1b3e4c001665", "comment": "Malware payload (AgentTesla)", "value": "9c272ecd85514c4c38298522a61aa19e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924853, "uuid": "9b8baeb4-b12f-41d0-b11e-585155d7a011", "comment": "Malware payload (AgentTesla)", "value": "395e917012d660b8d5ce71f86488d97d4e9292086dc5b30d576b928871505d6e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924853, "uuid": "dbf10ffa-885b-432a-b400-064e7403707a", "comment": "Malware payload (AgentTesla)", "value": "60f6d590d5b9223d737d9ee3ad3d671acf4ad6cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924853, "uuid": "d96af07f-f32e-46ee-8de1-d54b46a3caa9", "comment": "Malware payload (AgentTesla)", "value": "fd13f25a1208df7150dcb9fafa82c83d2cdfa1accbb462f5da6e784dccc27d4b6209a679d7f9669f9c5ef04ee4fba40a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924853, "uuid": "077a99a3-3bcf-4267-a6c2-dde7e6c87d9f", "value": "T10B556C89AF31BCEDCAC8C38F50ED55083FD4995C051EAAD2B526EC50EAB71CD348958E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924853, "uuid": "d7853756-223c-431d-b37d-b8243af4f133", "value": "12288:cHJftuWLbWrTu3uHZQ9T8q1w1gT196U8XicD8NjcpZhs8JzoToQzF0AwhJH5b7jK:QqObWG3uZeTx1w1g48FcnX+vb8PlqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773924853, "uuid": "41fd6b3a-c383-48d6-9894-0d620331610e", "value": 1385491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773924853, "uuid": "fdce8420-a4e6-4bba-84ed-c876ced1b506", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924853, "uuid": "ebc76442-6867-451a-be58-a62de1e4ac63", "value": "WIRE TRANSFER03192026.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb5538b8-232f-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1773882360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773882360, "uuid": "9354566e-2ae9-4e00-afd9-a3a85505088f", "comment": "Malware payload (DonutLoader)", "value": "2277d5e30daab34ab3ddaf7ea75b53d1", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773882360, "uuid": "30e222de-9cbf-41f4-9dad-e31a9bdab8d8", "comment": "Malware payload (DonutLoader)", "value": "3a9c318067e5572499551f2d349d603e76f04ccd7866a77685af15438386bcae", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773882360, "uuid": "93317995-0caa-4821-9e80-653bbe78a19a", "comment": "Malware payload (DonutLoader)", "value": "6e2154e7646d6a6335b0d030813605d67918c5f4", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773882360, "uuid": "1bf62e7c-fd6f-4d95-bd89-597d483b8aed", "comment": "Malware payload (DonutLoader)", "value": "f2c89facc447b7695fadaae2f873450505834027df95c3870e862dc8b9f119092e7d68b6469f684d97eac32e9aa7adda", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773882360, "uuid": "ec347913-04e4-4121-8384-e43c9d65e260", "value": "T16686334AE7F508F8D063E6788A964A07F3B33C590770E34F27A467562E131A29D3DB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773882360, "uuid": "e53821c8-fb20-4c95-9ad3-f38f7d2b5bc0", "value": "7e0a0e8f80bbd1a9c0078e57256f1c3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773882360, "uuid": "f30ecce9-c8f6-42a9-b583-03be141f7e0d", "value": "196608:zzYdKRXlPFeCViqusEmu2mbW5wYVcC6lpX+CYB:8KRRiqqYVelpOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773882360, "uuid": "66ac87a9-c567-40c9-8bdc-210765e289e9", "value": 8489021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773882360, "uuid": "a36371c8-38f1-47b9-af8e-08c9221d5aa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773882360, "uuid": "506ffcf6-0ae9-49b7-b564-f26f0944c08f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c4bb9f-23b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773940811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940811, "uuid": "183d93f4-761e-4352-abbf-c90b91722d9b", "comment": "Malware payload", "value": "8a0740edcf76932174bb4bd45addd6c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940811, "uuid": "c7f5d846-6003-49d2-b6ea-c2a3e8e76f93", "comment": "Malware payload", "value": "3aab696800559678abe23661e79e80f0da3b7a799aa83087c3360cb888dd9ef3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940811, "uuid": "37efa342-47f0-4ea7-b38a-2e0eda6c77da", "comment": "Malware payload", "value": "d017a0a04a9005f28d0d88585087066949dd6c77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940811, "uuid": "1f51de9c-eaca-4426-a9ef-2bc7a96bff83", "comment": "Malware payload", "value": "b6ea5b6cc17aacf95bd355a21b95b1dbd8189c7831a02c75f1ff3fa2441a7ccdd6bc10a438b6afbafa90c5fdb2ccbd33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940811, "uuid": "cd74b2d9-ef3d-43dd-ad01-629c4ee0ec45", "value": "T18C173343F794CEC7C0DDFE79A0E00956D9E34C74AAAD430ABD2DB5BBADA22402C95354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940811, "uuid": "aa516c32-dc28-44d7-9700-858b8417bac3", "value": "393216:6bZmOQ2oScn1PXnB2LFU0IJ78oExxVJ0ANLm3RNBfc4fKWFhCj:8Q2oSa3B25U0MyVJncBkOFhCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773940811, "uuid": "5334b44e-dede-4dc1-9d2c-72676c4af3a3", "value": 19047632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773940811, "uuid": "b8acd523-e1cb-4619-a3fe-db266abc889f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940811, "uuid": "c22e83fc-2caf-4503-be19-4b7afe6d04f8", "value": "3aab696800559678abe23661e79e80f0da3b7a799aa83087c3360cb888dd9ef3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f98cdb-2394-11f1-a769-42010a9c0008", "comment": "Malware payload (KongTuke)", "timestamp": 1773925707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925707, "uuid": "dc7f7c92-b1b6-4bcd-8193-51e32b7c4f5a", "comment": "Malware payload (KongTuke)", "value": "a362d252a704cb1b48f74ae02c0147d0", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925707, "uuid": "6887c3ea-4021-4871-a9dc-f5e619c067c2", "comment": "Malware payload (KongTuke)", "value": "3b12fea31ace4c4d105c0f9f3e7c85d29bd18b5bef5fbde38043ebdff483abe0", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925707, "uuid": "f1938050-4e4c-4b35-a07a-78b2aac8e5f5", "comment": "Malware payload (KongTuke)", "value": "7485240a45f6282773a55ecf6d5ef45d36d5002e", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925707, "uuid": "b8d553b8-06a1-4338-9d55-c7def08f78f2", "comment": "Malware payload (KongTuke)", "value": "e9705855e793ff12453ab65fb900cc230ff1ace6c3ca10135b84a68bcfaa3f6b6424ac42e0ddb700b6926ca7555707ee", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925707, "uuid": "cc2f0708-45d7-4c77-9169-c7dd5fc20548", "value": "T19834EBE2AF0A0F7503F5C9A752E881918E9188E4FE7E4706F4CFC862585D855F2936CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925707, "uuid": "c33ac1a3-dd8c-426d-8353-149af1c13739", "value": "1536:lvZXqVMd4y7XLlFAjgRn6sv1QTr0DiRj5MPBk6SF:N7XhyQ6sSADiRVMPBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773925707, "uuid": "b70a3ee5-5c4f-49de-bf0d-492254c6b175", "value": 240149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773925707, "uuid": "6f8cb933-622d-415f-bd0f-ffa0f36c72bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925707, "uuid": "db3137d3-d3d5-4a92-8140-16ee7427994b", "value": "bookmarks", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cef3694f-2392-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773924886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924886, "uuid": "f1d3eaeb-905f-4e31-b350-7f15a2930771", "comment": "Malware payload", "value": "fe6ba26b433a0679d44a07d65023b2d5", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924886, "uuid": "ec75a7a8-4950-4efb-9523-88318baf279a", "comment": "Malware payload", "value": "3b1e78d4c6875805452b5e4cfa9f74e21f21d1e086eba3f6cb852af0e68b539f", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924886, "uuid": "4ee289c9-1b1c-4d22-a411-3b727aa019c0", "comment": "Malware payload", "value": "7543eebe45bd6df8385a0fc41a9b9a99e03c692c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924886, "uuid": "43961c67-af8f-43f9-90e1-92af183cf1ad", "comment": "Malware payload", "value": "67891dad46edd38b9545061f7f5e0fa1efb22fea13eac6b7b915f29e026dbf97e45280a82f75b0e0a8ba2e9534c5cc57", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924886, "uuid": "58a9f5d4-9fb1-48af-ba2b-47e593b7e39a", "value": "T1CC573326E8784687F827847186A2C64C86667E4855E34C736935372E64F7FF43EBE00B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924886, "uuid": "6f00d1f9-883f-4d1a-a157-c1a4133445f2", "value": "786432:1iLFt8gCdA2xteR2CzdZLKs5UnfOfB1qo:1in8gl2xtluLUngj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773924886, "uuid": "54945570-c62e-4c9e-9d11-297d83ee9070", "value": 29356032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773924886, "uuid": "a701486f-614d-4e00-9edc-0d9f077f1df3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924886, "uuid": "8af6dcd8-af1c-4bed-a328-ee129795bda5", "value": "Loader.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa592513-2392-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773924825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924825, "uuid": "45c076dc-3197-409c-ae81-1bd7451ed385", "comment": "Malware payload (Vidar)", "value": "0d8b5340d04b2826849d1bd400fd6010", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924825, "uuid": "0e4c95f7-d3a3-413a-9330-41f69967c4d2", "comment": "Malware payload (Vidar)", "value": "3b98686714a8e4109403eaeaf7114d68302b53155a4ac4e8b712f6c8aac69a28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924825, "uuid": "c9104f2c-b10f-4f45-a504-017f93eeb72c", "comment": "Malware payload (Vidar)", "value": "11776c846eda525a0163dd30fa93a8071feb0733", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924825, "uuid": "79d38781-27f9-48a3-b0d3-657a158e7b6f", "comment": "Malware payload (Vidar)", "value": "54f4c1f956898c31b7fa357759481fc7cb0e513ceee66215286ea863daaf3495d3784a77c0dd396866a902b265962f33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924825, "uuid": "3d416a18-4120-4f35-8def-5f483ade5e98", "value": "T18FB6F7FB22508568C15D813ADD928F40D5F761B52B33FEEB429147648A4ECC89E3A72F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924825, "uuid": "7a192075-6e44-4057-8189-1904b63f7252", "value": "be27ca3e2433d9854a57851ddb822150", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924825, "uuid": "69450e1d-2079-4b79-8439-9f00577da8f6", "value": "49152:R24+J84zmrSOJ30Fz5h/cetKxvqS9TWNKDKv+yUMCUYfwieJ7ivX8GOSs+KFEILT:RgI2AmsvMPSLK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773924825, "uuid": "bf762fd8-8037-4106-97ec-bb7054b23a30", "value": 10600960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773924825, "uuid": "24240deb-3af8-4cee-a3af-f6d74fb63cd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924825, "uuid": "5e163074-2f8a-4363-a2e9-22166f588cf1", "value": "0d8b5340d04b2826849d1bd400fd6010.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "812c6341-239b-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773928621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773928621, "uuid": "9a24353f-147d-46b9-b027-c898d9c0e171", "comment": "Malware payload (XWorm)", "value": "89cb6795d9581aea235e6e2cd724725b", "object_relation": "md5", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773928621, "uuid": "811cf9e7-9994-4010-9564-8290677eb304", "comment": "Malware payload (XWorm)", "value": "3bbb0f2b0eea2605f13e8541bf58e5fda3be1a42350153da88f9b6272f5a0fbc", "object_relation": "sha256", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773928621, "uuid": "c5a33196-368f-44a5-9b7e-639bfda99f89", "comment": "Malware payload (XWorm)", "value": "92e4ee9fe72fa6dbabb76b66d37373bdeb15c08f", "object_relation": "sha1", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773928621, "uuid": "132afdbf-0f0c-4c7c-8021-298520bf4c03", "comment": "Malware payload (XWorm)", "value": "ba8d3ef08e11f90f1255f5e9c2699401bf9be3b882a17da79097844ace079d4a10c7a993c1e9c726c548f4bf3fbe6856", "object_relation": "sha3-384", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773928621, "uuid": "6ed10b92-f691-4aa0-858e-410ee14a020e", "value": "T14053024120946924B958ECAED87AADC7BBDDE2870CC520C90ABD584D0E09F5B3A13C36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773928621, "uuid": "1c790ab8-25cf-4f5a-a367-1fbe2cabe335", "value": "1536:IFfz+otCrKnQWGuRrmKFj9BfLH/Yuyr6bpok0yvq:yCqt7NQhoOk0yS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773928621, "uuid": "cb94ba80-5fbf-4daf-83be-6230c816ce6b", "value": 63920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773928621, "uuid": "725777e6-352a-49b6-8184-8477f455e683", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773928621, "uuid": "52a806fa-88e9-408d-8b80-2095101a93bb", "value": "PO-HM-U1A00109-000015-RJ-0341SO 0876PO 0747PR-4798.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe3f92b-23b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773940618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940618, "uuid": "1a065525-5a7f-4f45-adc9-eedd7e44a2e2", "comment": "Malware payload", "value": "4eaf6e211c109c74a4a4e91df2f3f154", "object_relation": "md5", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940618, "uuid": "f9408d51-5235-42bd-b04b-57b8d7738680", "comment": "Malware payload", "value": "3c1896d4464eceb130785c23ee3b4f8a137df9653b26eba0219e7fed3c5521c5", "object_relation": "sha256", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940618, "uuid": "4a8f64b3-855d-4151-9330-bf9205d39acc", "comment": "Malware payload", "value": "6d3321f73e88f6b93ab5de2f5bb1057b2fdcfad3", "object_relation": "sha1", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940618, "uuid": "b8e62329-0cb5-480f-a8df-4243e4c5e60e", "comment": "Malware payload", "value": "243108692d874b76be325184d7e2d06b4481943db32b1e252a36383b451fd7793a885bb4aacb16b5f6ffcf8e9bbcbaef", "object_relation": "sha3-384", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940618, "uuid": "83296e7a-69bc-46e1-b46e-2128fcfe5739", "value": "T199168F03B348753EE4671A3A583FA680983F7A213A26CD4B6BF40D5C8F396416D3A757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940618, "uuid": "6245e401-9dc1-4aed-b61d-936506f81e3c", "value": "4f3a70412c909e6e8f69020f0bee4f39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940618, "uuid": "ef7d7cd6-8c5a-4c78-94cb-de44114e901b", "value": "98304:h3U5HY/KwjoYY1j48UWm2eTMFdC+Jr333Wy:W4/1jorPmEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773940618, "uuid": "f07331a6-e0fe-4a7c-8f21-5b930ff97103", "value": 4372680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773940618, "uuid": "a442211f-bcf6-4704-bcdb-65af22f42163", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940618, "uuid": "e0691b27-b6d6-463d-a788-0048ee3a5ee4", "value": "3c1896d4464eceb130785c23ee3b4f8a137df9653b26eba0219e7fed3c5521c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad1775d-2398-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773927295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927295, "uuid": "027d19d9-73cc-4b86-8f51-16853898eb03", "comment": "Malware payload", "value": "2f9008238954a6f9c7f9493857c28f83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Liansitong-Technology-Co-Ltd", "colour": "#A420A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927295, "uuid": "cad542b4-325f-4da5-9d6c-e548e7e3527f", "comment": "Malware payload", "value": "3c4619a34900b0e54f1b89cb81f96592d0d7b2019bae5c0cd621115129ade218", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Liansitong-Technology-Co-Ltd", "colour": "#A420A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927295, "uuid": "f5df4a90-63eb-4a59-a4b0-d857bb01934b", "comment": "Malware payload", "value": "5313ae3c5caec1f48c4653d779dbbeb3ee4ba856", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Liansitong-Technology-Co-Ltd", "colour": "#A420A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927295, "uuid": "7ff6e57f-6a70-4e38-b803-11d6e4e81813", "comment": "Malware payload", "value": "be1705174d1f6c2291320438fa3f961af5b91eabe6903d655e139a7a64166aff4bf23aa2c14ee6d8ed0dfcdd37ecf367", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Liansitong-Technology-Co-Ltd", "colour": "#A420A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927295, "uuid": "8213d9bb-7ed8-425f-a086-b9eaabf2774b", "value": "T151541B4777F41002FDB7CE791CA190320E3BB19A8E36E58538AD505D0FF3656922A7AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927295, "uuid": "3c00f6b4-a5a4-4f2c-b31a-9f1f11257f5d", "value": "768:aPK56EXwLcC9vDopjvr0DnJEFr15ZfKIqJjjiK6SMtiViBdqT6LtYcFmYB6KPh2N:D66oloRin0WvyhzrmYBl52q5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773927295, "uuid": "0a88de65-e4dc-44bb-9b71-cb840141d0a3", "value": 294656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773927295, "uuid": "f23c81ed-33a0-464e-b6ac-b57e6e96a271", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927295, "uuid": "491ca28b-34a8-49d6-a289-a580501d0910", "value": "3c4619a34900b0e54f1b89cb81f96592d0d7b2019bae5c0cd621115129ade218", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70607700-235a-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773900676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773900676, "uuid": "ae465f08-8e1f-422e-a929-5ef2eecbae36", "comment": "Malware payload (Vidar)", "value": "57b70694ac6549065a8ad3eb1e934b3b", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773900676, "uuid": "67bceb95-a175-4fc3-82f8-92d5eb28eb09", "comment": "Malware payload (Vidar)", "value": "3c87c17ae4e8ef7d193b41f48616aef4d95bdc871a0ac81e5c02ab97d5373079", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773900676, "uuid": "34502794-eccd-4e6d-9107-fd7db715d252", "comment": "Malware payload (Vidar)", "value": "022e6add1502d7dfac7185ec3aa4602a9291a154", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773900676, "uuid": "e7dee39e-7eb3-45f9-8b5d-80557e69108b", "comment": "Malware payload (Vidar)", "value": "656d01a6bd0bfcce6d29573492937a50ca1daf44c6ac643699e4e09cdaa92175f9757403bfadadbca2bb44cb1c36b8f2", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773900676, "uuid": "2e93da71-7c27-40a9-bd17-b9fca148f917", "value": "T199955B0ABC9498E6C06A5736C8B622F27B31BC598B3223C71E90BD7C3E726E45D75714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773900676, "uuid": "cdca23d8-fd3a-4203-b764-5d9f330e0dfa", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773900676, "uuid": "142565ab-52d6-4a03-b1d2-afc58ff20436", "value": "24576:CcmI4xQc/tOYpOpHxT/UFAJFPsCmW5mzq3TWtPG7nEtYCo:CcmXxQc/tOYpaTcFA7nmW5mO3T3YZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773900676, "uuid": "e544f5b4-6893-4993-91eb-807726efc10f", "value": 1996800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773900676, "uuid": "de298400-44f3-4afa-99eb-c4b28e231d65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773900676, "uuid": "4adc0af4-fe26-47d5-8d11-b961df6489c0", "value": "source code of carbanak backdoor discovered.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea7dca4-23a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773931167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773931167, "uuid": "da875d76-c27e-42ad-ab71-4aedaff31831", "comment": "Malware payload", "value": "2bb3e5fcbfe85fe369cb0130202f560e", "object_relation": "md5", "Tag": [ { "name": "duet-night-abyss", "colour": "#0AD0EB", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773931167, "uuid": "cf33bd09-bc0d-48f0-997a-45e6297c507a", "comment": "Malware payload", "value": "3ccc5b5b2d6e59cb32d31394287630f007658d01ded68dedf8e7c25e1da0b5ab", "object_relation": "sha256", "Tag": [ { "name": "duet-night-abyss", "colour": "#0AD0EB", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773931167, "uuid": "22b32daf-ffbd-476d-8dc4-52d77f857e39", "comment": "Malware payload", "value": "83280edf536ac34c32c3d61334fd812c78d02282", "object_relation": "sha1", "Tag": [ { "name": "duet-night-abyss", "colour": "#0AD0EB", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773931167, "uuid": "0c4ec595-51eb-43c5-a1ec-aeb9c19a3c45", "comment": "Malware payload", "value": "bb6ffb433141ab0500780be377de2339cf9a0f9178ae66fdcedd85df63abfcccba346e1e93409d0b94ca3e3199e59c06", "object_relation": "sha3-384", "Tag": [ { "name": "duet-night-abyss", "colour": "#0AD0EB", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773931167, "uuid": "dcde7e3e-1607-466e-a5fd-cf55cfd31e9c", "value": "T1190144158C01C3630A30A6B99743E70AE492087B101395273EBCF9584F36ADF30E87A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773931167, "uuid": "592b0fb9-5265-4956-aa91-13b3a74358fc", "value": "12:tvReJVMA0O+3THFdJOAFv3h2Pr3iPToiFlOR73TK9valOew:zMZjeTXJRZhqQTo+OBK9UOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773931167, "uuid": "5dea149f-8eb6-4202-824c-e18a19e584f7", "value": 725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773931167, "uuid": "7b973736-69c8-4d01-be98-02b61f196530", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773931167, "uuid": "626608b5-c6b6-4d3a-a348-16c83a1fc4c5", "value": "3ccc5b5b2d6e59cb32d31394287630f007658d01ded68dedf8e7c25e1da0b5ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf17bdc-23c2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773945472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945472, "uuid": "32c6692f-7e99-45d2-8bcc-474b85449c3e", "comment": "Malware payload", "value": "9c12519056350c62400b30b103b10d5c", "object_relation": "md5", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945472, "uuid": "60a66065-324e-40b0-b73d-35548ada9a7a", "comment": "Malware payload", "value": "3dff19317a2bd968201217402136b2ffa408806c2071d43f917453ff5ac1c5bc", "object_relation": "sha256", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945472, "uuid": "44d84c20-e399-4ffc-a7c2-6a31af943e26", "comment": "Malware payload", "value": "56edeabdb29905315e9ec3f1c47fd4101e04ee59", "object_relation": "sha1", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945472, "uuid": "4c0df4a3-6a90-4224-ae7d-dc854db2f35e", "comment": "Malware payload", "value": "a527371b2278deec6d330996b028677a0bd7d2c3691e81528822c5490037d618be8d67cf954d474206d6ac131f9f2b4a", "object_relation": "sha3-384", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945472, "uuid": "12b1bfb4-4e7b-4dae-a824-34588aa88818", "value": "T131C1A4879BC84366E06607317CB313522778E8165F7BA7AF25F4137A6EBA78048437B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945472, "uuid": "ec74a7f4-37dc-4dbb-8afe-fba021197c09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945472, "uuid": "fa4df439-d35c-4773-90f2-ba50df505fa5", "value": "96:+dew7V9rSbZRg8zZgyTy12D8BynqgHlNxiE07upBK6izNt:+vv2tzuyTyaoyqgHjR07rl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773945472, "uuid": "e4634c63-7294-494e-bd1b-e0785fb58bbe", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773945472, "uuid": "e1af585e-5052-4402-a53d-e4b3db41ab03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945472, "uuid": "666a7293-cf58-491f-bedc-38aea2acfd42", "value": "explorer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae1731de-23b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773940723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940723, "uuid": "a5fad1c1-578d-4d92-881b-4aa0c03a5ecf", "comment": "Malware payload", "value": "5c832fbaa3da8a913629880fb76e984d", "object_relation": "md5", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940723, "uuid": "93f37154-18b2-49c5-ac94-5b17533e25cc", "comment": "Malware payload", "value": "3f65f1f17d631beb4b0d89037fe2fb5bdbbe76e8bc7bb29113b801c5079b941a", "object_relation": "sha256", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940723, "uuid": "3f0c7cc5-d80c-4b06-86f5-76d476315ace", "comment": "Malware payload", "value": "fb46d520f35f9166f3d50c91a048528b06ef7703", "object_relation": "sha1", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940723, "uuid": "ffd1c241-6592-49b9-a0ce-a5a51070505e", "comment": "Malware payload", "value": "63fa9046167376edba8d222b877efc9e546d58ce6a9e18bfb4245b772ce37fea676998c416822a34675dbf1f369fc32a", "object_relation": "sha3-384", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940723, "uuid": "a404db61-0846-4342-8e2f-492561291777", "value": "T154F3C0413BFC4822CAAF4FB914F21241DA32A70B56E2D34D649C90BC7E5AB950F167E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940723, "uuid": "4a2f18ac-a76d-4d7a-abdc-21319e4f482f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940723, "uuid": "010efd46-14c0-4a69-ae4b-c9e462618d61", "value": "3072:nqvZp3eqUGbo95jsuMjziqX3Dn4suMjziqX3PXaU3HBxlyp2L9u7jziqX3ackVS:qb3eqUL5j1MH7X3r41MH7X3ykhLyp2LA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773940723, "uuid": "4808042b-d9ac-41aa-a508-f50cc757b463", "value": 171208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773940723, "uuid": "3c85b70a-8e12-4f0b-9765-46e29bdbc922", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940723, "uuid": "e7e5118f-0fc3-497a-8f1c-f9ac7599082e", "value": "3f65f1f17d631beb4b0d89037fe2fb5bdbbe76e8bc7bb29113b801c5079b941a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b8dc48-23b4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773939494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773939494, "uuid": "a279c90e-73ef-49d3-a551-9f24f6b69de5", "comment": "Malware payload", "value": "7eb98f654a399e04e41c22337e88a58a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773939494, "uuid": "12f8e97e-a997-4985-947f-330bf77dfd26", "comment": "Malware payload", "value": "4160a93073bd698a61c281ec4b12dbc76d708a1b8d9c074d9fe66b936d38bdaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773939494, "uuid": "439956ac-3cfe-4ef8-b0a3-71ffefc83596", "comment": "Malware payload", "value": "167537707017d1a025a8addd09a87f07de25346c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773939494, "uuid": "9f9d1ba2-bc1e-498d-b48d-19e5a83bfb37", "comment": "Malware payload", "value": "5cc0355704daa1fc7b26178f372853a362e9499c079bbf3d7db7080c903e69148bfdbb9ed5e7991e49439a8689a85b4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773939494, "uuid": "8e6b159b-221e-43d1-a3fc-b52f75625d99", "value": "T108D518822201A5D1D68D117DC6D23907914F2FE326DE0CAD0DB7BD0DE2B716B99B2BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773939494, "uuid": "d8c06041-d7cd-4f56-8e63-ed6372e30f22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773939494, "uuid": "f55c5785-9d04-4139-82f1-2402e8c726a9", "value": "49152:ebUSgLBVm8iq9Nk5AZrpmNRQkX8Kq9y9uVzjZJ1:e4hBc8iqfk5AZrpmNXsKq9nzjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773939494, "uuid": "cedb6c51-a812-4e96-9911-fea7a41a3677", "value": 2773568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773939494, "uuid": "88966631-d965-4dbe-8bab-4b617b24bcb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773939494, "uuid": "54e18e14-138f-4114-a27d-a504ab07e421", "value": "fatality.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b46652b9-2353-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1773897784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897784, "uuid": "14cd49b6-a64e-4280-849b-e307f814055d", "comment": "Malware payload (njrat)", "value": "afdb0ca4ff6ffd2199ce8cfbb3e061bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897784, "uuid": "6b515d6f-5c32-41ff-8b39-e98bce7c4692", "comment": "Malware payload (njrat)", "value": "418d30a21310119348b477086b808bd9675e262f7b721867705aa143ed9706b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897784, "uuid": "fdb744a2-3390-42ed-b38d-3d19b707c11a", "comment": "Malware payload (njrat)", "value": "ca8244323716680037796da475254225662f191c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897784, "uuid": "db9d13a2-b5d7-487b-bd67-22360b6c5632", "comment": "Malware payload (njrat)", "value": "cbe3115ff918118465a0f23f1cc1858740b36515d48567a32130909b590f389476d81dc2f7fd5280cb0b18844cef93b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897784, "uuid": "c6efee22-5d53-4b04-90f0-6d568ea6aaca", "value": "T190C33A4DF7468A98C37D2E734563A50C06E5C4B772B3FA2E56C99DE74D638C8868B0E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897784, "uuid": "6290557a-ad1b-4f73-88cc-4ba6eb5028d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897784, "uuid": "6f4c4be3-72f2-4f8c-befb-c7a95e8454ee", "value": "1536:XykFeJH0TdGU0Z1+nnDdzAa3ECu0YRH7uQGdGpN1Ggn3J+XAJm3DlbZSFJaxp:iBqGUBnRAwnUaBgn3UQJmpbZSFQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773897784, "uuid": "b460ac17-0687-42fe-9014-3ad224fa2055", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773897784, "uuid": "751195ec-7133-4cd6-92fd-8af244f166cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897784, "uuid": "50418472-fbaa-473b-abc2-d95f64658d7f", "value": "Haze3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b2149a-23d0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773951574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773951574, "uuid": "05d871ce-bbee-4f84-b10a-102b6d3ee355", "comment": "Malware payload", "value": "119a19f263c4e80a586b89fa1a786bc3", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773951574, "uuid": "5072c05b-3339-43f1-b1ff-3376708c6dd1", "comment": "Malware payload", "value": "41ac3626d127dbbcec3b9a7893c4e30ad7dae9cf2fea69d2c1c037b46065578f", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773951574, "uuid": "e180bd8b-75c5-4b45-b715-418145b64c8f", "comment": "Malware payload", "value": "51c3fdf8683d9c88648cc856146baca0ba87d7eb", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773951574, "uuid": "10a9f3b6-20f6-4b94-981d-2977d8472100", "comment": "Malware payload", "value": "7903a3449318a192127ff9a43af5e2c6dddf89759cdbaf9d5efd51837fc9c077aa56e9dfeaded19f32184674f6174cf2", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773951574, "uuid": "8e9c7990-983e-4444-bbe7-e5698a5ed7f2", "value": "T1AFB6238AE02211F4DBBD9F3C5D61E1F5A72BD880EC9122F7667B0675CAACD374A91007", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773951574, "uuid": "c2301a58-0b98-4d9a-8105-d6b1f104972a", "value": "196608:UmvFmvUmvLmvymv5mv4mvPmvmmvtmvHmvQmvxmvqmvDmvsmv9mv2mvfmvImvYmvh:UmtmcmzmamhmAm3m+mFmvmYmZmSmrm0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773951574, "uuid": "ad9671e0-3784-4f67-b369-38c770a38c76", "value": 11020542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773951574, "uuid": "c923d6ea-ee0f-45af-9e0b-4ee07bcac8b8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773951574, "uuid": "8f2b1fbc-a346-4e4d-93d3-12662fbb9cd9", "value": "Social Security Statement.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3339934c-238b-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773921619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773921619, "uuid": "bfeee17a-5905-4a92-acc4-eeeade38fa3a", "comment": "Malware payload (RemcosRAT)", "value": "0f3a5b239ecb4e56aed4b91cd3003327", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773921619, "uuid": "f70d563e-c4a4-4ded-8122-fe7df3a0eb9b", "comment": "Malware payload (RemcosRAT)", "value": "41b1d68e1aa97220d97108313d896893d7204ce935c84eb07aac1213351097e6", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773921619, "uuid": "509d6017-18b9-4283-b6ad-fa18b2985cc0", "comment": "Malware payload (RemcosRAT)", "value": "8ddff13838a83ff43e5bbcbdecfa2c944484c3f0", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773921619, "uuid": "7da198d8-771a-4748-9963-f8268aa130f9", "comment": "Malware payload (RemcosRAT)", "value": "e7f25375301f08c708ccd870828555160b464937fb42b2ceb25e01397c439167ad630fc7742cfe56c1a827cec5459b79", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773921619, "uuid": "52509e5c-493b-4799-a600-233b6d882352", "value": "T160B501F29A7EDF43618F167C1442AE62BBBCB1B57CB03FA003074996B4F721151B9986", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773921619, "uuid": "6d7dba5f-45a4-4bab-877b-99b63b59131e", "value": "96:E22222222222222222222222222222222222222222222222222222222222222T:vytFj/QT+o/lcw0lcPlblTk5lKRMEcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773921619, "uuid": "e9519297-63fe-4682-b1de-d2b9c930d41a", "value": 2376100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773921619, "uuid": "b16ed9e9-f505-408c-987f-c185c21804e0", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773921619, "uuid": "bc44d394-3839-422e-9c23-4c7925f68ec2", "value": "rpagamentodocontratodevenda-pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f606af3e-2345-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773891881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773891881, "uuid": "e5add283-5b6f-4c2e-a136-5f05785eb73e", "comment": "Malware payload (Mirai)", "value": "9d0b9c2a3eab87411479139055813855", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773891881, "uuid": "e195a31c-ee63-4a41-a772-83aa3cd59e40", "comment": "Malware payload (Mirai)", "value": "4274f8347de22cec9a959d794b65b3ebb014ff60051afd0369267b0f15be2a99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773891881, "uuid": "dc7a5cae-51db-4fca-b248-f579e20e14fb", "comment": "Malware payload (Mirai)", "value": "6bef2a349fe26446232d130328516d039e19939f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773891881, "uuid": "425de342-d19a-49b5-babc-042280d3c31f", "comment": "Malware payload (Mirai)", "value": "71e5ca13f8aecdaed03cfd83136160c55b666c8d46b0f498f7d8c0db470194688d65026e7057eb7c6d973629f846db28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773891881, "uuid": "144dec83-1012-477e-9045-a9486c36df1c", "value": "T118B32A82BC41AA22C6C1567BFF6F018D331603E8D2EA32179E185F2177C795B0E7B652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773891881, "uuid": "8f6a1637-24cf-463a-940f-44f3db22faaa", "value": "1536:6wzUwQBnWXCbW2/CbSdWv3TxEXEmG5NnheUnO7Dp+KBWHPDsFE00R3YOtg5fWrhb:NUddWXsRdEFu85raDA9PDmE0GRm4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773891881, "uuid": "59a461e2-e413-4206-8354-56e3c5d832b8", "value": 107764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773891881, "uuid": "15973d81-ce68-48b3-afcc-bb394531669f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773891881, "uuid": "79033a05-f83e-42c2-ba20-afa41c06f0cc", "value": "tux.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca0bddc0-23c2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773945494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945494, "uuid": "90f85d82-a151-45b1-b3a1-47009d811e9d", "comment": "Malware payload", "value": "b6179903bbc42afaa3e005753679b0d0", "object_relation": "md5", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945494, "uuid": "aedb068d-f85b-41c8-a8f9-b2d884a303c3", "comment": "Malware payload", "value": "44f19dbf1059e3a5f5e424ce28695d3eaa7dbe6a7ec9c9855486714dea80f53a", "object_relation": "sha256", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945494, "uuid": "4343083d-924f-4e35-afd2-a0dd3cec1811", "comment": "Malware payload", "value": "afe95ae375de9e69be9b2eabc82fc7bfdc8e66fc", "object_relation": "sha1", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945494, "uuid": "9c5319eb-a7d5-419d-919e-843afed0a14b", "comment": "Malware payload", "value": "fa27895bfa4c4fd69bfb4beea5d62cf62eb26aecacdce788a8cbf22eb5a3c0dc3671054dedcbe72cdbfdc64e7257bb94", "object_relation": "sha3-384", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945494, "uuid": "8d683eb3-e6ca-4091-ba61-5b3691ce4b3a", "value": "T1F851DF1A97E44A6BE4B70B316EF3431727B4FC615F73536E09800229AC717645A72FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945494, "uuid": "d23a05cf-a0e2-4e37-939d-020f286f8d67", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945494, "uuid": "6ea00d47-e9eb-4d4d-a13a-81323d596c34", "value": "24:etGSDfB2JuwALu8zigklnlKeoUfE2tkZf+d5q3LEWI+ycuZhNSakSqPNnq:6EMwARziLltNoJQ5cn1ulSa3Gq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773945494, "uuid": "6bc8832d-4fc7-42f8-86e7-9dd7564a5384", "value": 3072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773945494, "uuid": "8d048a0e-d6de-4c4d-80e4-daae69fdc8f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945494, "uuid": "82c3f299-2b40-4d2a-99c5-d2f69b6c1a7f", "value": "qqsoohal.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a03c61d5-23db-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773956161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773956161, "uuid": "8c8bc963-9457-4959-b5e4-b03b49d38a29", "comment": "Malware payload", "value": "9c36e22a768d1be90ec0e6ae9160466d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773956161, "uuid": "835537ad-1db7-4a9c-ac36-30634fdef8f3", "comment": "Malware payload", "value": "48bb77a7a55300ad0acdac1e8d80f3afd68e143cd5bb6512c7e6f71a554544bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773956161, "uuid": "ec1c136b-0c4a-4159-8831-c9b22b93d685", "comment": "Malware payload", "value": "17bae92be1f945f1b131f8c48010acfc651d18c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773956161, "uuid": "c7ce2188-0d82-4c06-9a78-5fc7ed708d7f", "comment": "Malware payload", "value": "ed6f1989b60517ceef57ef38f20c771d8a4d94355d53f9ab4b8162b30f57f83029c966b0c044c2151a3db80b3ba4e2e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773956161, "uuid": "d21074dd-d487-4c57-b338-83b8773d0756", "value": "T1E9364B5BF85151F8E1ADE270C6665213B6703C881F3223E72B01F3E52A36BD45E797A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773956161, "uuid": "254718df-6463-463c-a795-1ade22cfaa29", "value": "49152:kB41BZmv9rb/TnvO90d7HjmAFd4A64nsfJ+RH8deEkYig14qFHksjB2/KqxnR5W0:VKb1g1FI/qEBxV9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773956161, "uuid": "61621125-ae01-40be-a323-eda52e15f4f4", "value": 5259264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773956161, "uuid": "633f5f71-827d-4586-b347-d4cb3b9f07e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773956161, "uuid": "bdbd1dd7-b85f-4fe9-aa44-a6cf1cbebb5d", "value": "linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35afde88-2395-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773925918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925918, "uuid": "66c038a6-56c4-4678-9d18-73d98de82734", "comment": "Malware payload", "value": "068cbff8878b033b4927c0206315cf33", "object_relation": "md5", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925918, "uuid": "8c0c68b7-11da-4098-97a4-5005b9895fdc", "comment": "Malware payload", "value": "48ddf92836e5dccc416bf7f0f869ee38ec9b113707b8d84cbb21d7eab49e5458", "object_relation": "sha256", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925918, "uuid": "850010a1-ccde-4239-aa70-c9d21b7c4f35", "comment": "Malware payload", "value": "d3fa5bcb78dfd173d676652a027a82ca7f54e21c", "object_relation": "sha1", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925918, "uuid": "2e7d7e3b-c705-46e7-a74f-a197a8063707", "comment": "Malware payload", "value": "69162413fe42dbe78c42575ebc3d14362ede7b5fb1292143aaed6ab642e8d4c2e7c7e96bf7a3dddc8236495e6a86d4b2", "object_relation": "sha3-384", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925918, "uuid": "e804a5b1-0e2a-40c8-9686-0d4c0a50c4cc", "value": "T121B6D021779EC036D26F0171993ADB5BD638BD210B3192CB73D479A91A327C2173AB27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925918, "uuid": "92d0125c-d35c-498d-8005-907755f14600", "value": "98304:QiI/uKL8gfAhSnqFozxY/XuFoF6xRwAMHlu89rpqaQIzvLx8Lo0+POq/5:5KhAEnqiMueF6xeBHU89rsaQLo0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773925918, "uuid": "b7e82611-acbd-4db2-811c-be8864436065", "value": 11104256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773925918, "uuid": "69a1398c-53d8-45c6-ac41-dd0445665c1c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925918, "uuid": "a5b3b38f-b12a-492d-94fa-1b10890548c0", "value": "48ddf92836e5dccc416bf7f0f869ee38ec9b113707b8d84cbb21d7eab49e5458", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "314b05b9-2395-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773925910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925910, "uuid": "7cb66c27-15d6-46de-a74e-340e281f80bd", "comment": "Malware payload", "value": "57e6ab3534779a2c42521ae77e04aef8", "object_relation": "md5", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925910, "uuid": "0ec0bf1c-6152-4184-8d13-6b9ef5d1ae18", "comment": "Malware payload", "value": "49c85ce1674caf82057582ba820cd1955fb8099f72a6f65038ae0896c2c88762", "object_relation": "sha256", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925910, "uuid": "ff454be9-e305-4985-8f39-279630b56137", "comment": "Malware payload", "value": "9edbe8bdc1589ba3c64a36f77b5d73dc9edc7187", "object_relation": "sha1", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925910, "uuid": "ba10c98c-92a6-4699-ace8-bfd7565927f7", "comment": "Malware payload", "value": "686c547ce34bbf99e4753db0e99634874172b8eea7d67b11d8dbdf9a067f1fd2c140f8a11bbc06f367a0d194b978d1bb", "object_relation": "sha3-384", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925910, "uuid": "4a3e4411-4e4f-4c7a-9242-9a134289abc2", "value": "T1CED6BF21B79AC036C56F0175992AE74BD638BD210B3196CB76C87D6A1F32AC2173B713", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925910, "uuid": "5ef472d1-c277-4d56-9c03-1e193babc25e", "value": "196608:kKhADnqiMupF6xeBH489rjaahDuZSGELvL:kxn+upF6OH489vdusHvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773925910, "uuid": "b8dd2ba0-2e26-45f7-aa93-b4f939cf2800", "value": 13524480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773925910, "uuid": "f4f56456-dd87-4537-b548-ee709fcdc0f8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925910, "uuid": "ea799b98-ac4c-4b52-9213-b160269b1d9a", "value": "49c85ce1674caf82057582ba820cd1955fb8099f72a6f65038ae0896c2c88762", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eaf4c46-2368-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773906713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773906713, "uuid": "a56fc9c1-869e-4575-99c2-2a9c74e39257", "comment": "Malware payload (Mirai)", "value": "f722535da38eb501f14cae8b50ffc19c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773906713, "uuid": "a0813091-4b30-445b-ae01-87d4aa13262e", "comment": "Malware payload (Mirai)", "value": "49cc85523f6117a6453636656046c78fcb1aff7380e6a72c9d78987af6a31d86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773906713, "uuid": "bfddc99a-31df-41da-a7e1-19feb162d927", "comment": "Malware payload (Mirai)", "value": "b786883c81b43cb5132f879eb4c47713781a649c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773906713, "uuid": "1b06dfe3-20d5-4ae4-b5fb-951362378202", "comment": "Malware payload (Mirai)", "value": "c9c46b50f5eca9b38b89865572602ad284d59f324869a04c399853326e97413b64a00d357f2d20e74b98478ee0a959a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773906713, "uuid": "eac60d12-fa07-435f-ae60-19ca9748e5a9", "value": "T11383174BB34259FDC056C4348B7FA423E63170AD15327A6F6B94AF342D62E341F26E26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773906713, "uuid": "fe8e12cc-a36f-441e-9f8a-bebbf585b758", "value": "1536:Wy0i1uYQpBn0UuFTwxz52eqTGvieOxxcHFktkmfhobb+Jb9X9gZE3HL:Wy0sLSBn0HTwxz52eIGvieOxxXkoon+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773906713, "uuid": "3f095558-5d5c-4d81-a936-8836fada99fe", "value": 84136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773906713, "uuid": "edafcb68-4adb-4c75-9ab6-019c149e1010", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773906713, "uuid": "06390530-4701-4edc-b780-47cf3e25c95e", "value": "x86-64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda9106b-23b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773940829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940829, "uuid": "b2eadcaa-7048-461a-a3a4-c35c2e790ca4", "comment": "Malware payload", "value": "46cc27f62258a19ea86c0052170aa09e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940829, "uuid": "58cdc7d9-5f27-4aa8-8335-089fce5d314d", "comment": "Malware payload", "value": "49edc91f39fb1e977a05054cbdd1748ac8c98110acfdbf049f9eb2f645526f66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940829, "uuid": "56d04219-e2d2-448b-8f0b-873376c50e49", "comment": "Malware payload", "value": "f258bf0752a60afd60b813833c49db3cb6b284b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940829, "uuid": "2cb60039-5b19-4acd-98f2-fc7b31a9b98d", "comment": "Malware payload", "value": "a3401bdc56670d349d0025039dd0076505e4b66b7361f766d03031d502543e76da175a145590be4c6aef8ea68507fc16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940829, "uuid": "645ab2be-69ed-4030-9a43-a20f594d6aea", "value": "T1A4173343F794CFC7C0DDFE79A0E0095699E34C74AAAD430ABD2DB5BBADA22402C95354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940829, "uuid": "4b28bbc2-7e90-4511-8c74-583831c271a4", "value": "393216:EbZmOQ2oScn1PXnB2LFU0IJ78oExxVJ0ANLm3RNBfc4fKWFhCd:WQ2oSa3B25U0MyVJncBkOFhCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773940829, "uuid": "57898753-e170-462a-a9fd-c5835f78a25c", "value": 19047632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773940829, "uuid": "2625def4-8461-484d-8300-8d62237a7732", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940829, "uuid": "f6818d81-36af-45ff-b04a-c1fc89a2c2f0", "value": "49edc91f39fb1e977a05054cbdd1748ac8c98110acfdbf049f9eb2f645526f66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "572a15e3-23aa-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1773934993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934993, "uuid": "dabdc7ee-0a46-4470-b0e2-c371fd028dfc", "comment": "Malware payload (NetSupport)", "value": "28f86763e6d5f3e7ed4b18845b186fe2", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "freegaten-com", "colour": "#D4EE1C", "exportable": true, "hide_tag": false }, { "name": "freegaten-info", "colour": "#AE56C3", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934993, "uuid": "68224013-6301-4dca-8810-03d2fb2bb2fd", "comment": "Malware payload (NetSupport)", "value": "4a318e1063c641c0585f8adf87a379165026ffa03f09cc4cdc2e766cb378e71f", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "freegaten-com", "colour": "#D4EE1C", "exportable": true, "hide_tag": false }, { "name": "freegaten-info", "colour": "#AE56C3", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934993, "uuid": "65faa107-e41e-424a-94c3-afdb694c2c97", "comment": "Malware payload (NetSupport)", "value": "bb363d9dd0cc4080aa33a73cbe27c366bbc5fd1f", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "freegaten-com", "colour": "#D4EE1C", "exportable": true, "hide_tag": false }, { "name": "freegaten-info", "colour": "#AE56C3", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934993, "uuid": "9e9aef18-259b-490b-a2c8-c3021e8f8aaf", "comment": "Malware payload (NetSupport)", "value": "61b2486c181653b36be3a695f36c15ba3649391543eabd673490176ef209f6d116629b0e0bb468faf23426057a5c89e9", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "freegaten-com", "colour": "#D4EE1C", "exportable": true, "hide_tag": false }, { "name": "freegaten-info", "colour": "#AE56C3", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934993, "uuid": "29a93edb-36be-43a7-b7ee-665a0727486d", "value": "T1FCA2E1C59C387603E00AC77B637497831766BC9A474F4779FAEFB7506C120689FAA405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934993, "uuid": "1efde9d3-2eb7-495e-9eae-6f7b26a4574c", "value": "384:EPCdRaScOps9u2j2UlY1Zi9pVL/0+Y3Ga7q749prswcOmrOR68bvELtP1:jBcOp6u26UlSZEV/x3a7VlmrKM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773934993, "uuid": "16c1019c-366e-46b7-a508-1f692367c13d", "value": 22131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773934993, "uuid": "e0c80812-d34d-476a-9852-0701e6991e37", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934993, "uuid": "7f17968c-000b-4c29-b53d-35d5734e0126", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a5351a-23c2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773945386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945386, "uuid": "f77493a9-a4c1-4ab9-bf45-01a94010a46b", "comment": "Malware payload", "value": "9cadca852c0d2414cf401028628f8e52", "object_relation": "md5", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945386, "uuid": "9f6f8eee-3170-47ee-8c0b-e40720e6d13c", "comment": "Malware payload", "value": "4a4db2eb2b015025be9ca2ca26433cb2f6fb40eea69bf9035e3668fdfdf4ea25", "object_relation": "sha256", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945386, "uuid": "480d78c9-8421-4b6e-9466-00f823eaa042", "comment": "Malware payload", "value": "c788594fc5ffcd566ed8c0b1d3890e406466fe3c", "object_relation": "sha1", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945386, "uuid": "7cc9e414-eecd-44fd-b24b-bd09e938ac84", "comment": "Malware payload", "value": "8aa4214d2cfde6ef4152c5dc073b51a17b532acfb1a600a93f356cf58250f2a1df6a863443286d0ed6c1322b1b8b9667", "object_relation": "sha3-384", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945386, "uuid": "0b682145-bf04-4f17-a57e-ff6d636b5755", "value": "T13C71DD1687E8466BF4BB0738AFF7475367B0F8508E73973D0980521DACA1AA84D31BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945386, "uuid": "3170dff7-1639-4a28-b08e-ef162e16bb1d", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945386, "uuid": "9173a476-ab1c-4822-8ad7-1f675e956c2d", "value": "24:etGStsh2WEMqlB3luyq4usdrj2UNtkZf9aoh7DzGWI+ycuZhN2qakSJbPNnq:6kHqjl9tuZJ9ayfzN1ulza3vq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773945386, "uuid": "f14fed22-7d14-4175-a70c-44ac06cc4b9a", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773945386, "uuid": "bc2ba73d-f7e4-42fd-b0e8-1a549e19e9a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945386, "uuid": "159b6be9-30c6-4209-986c-637dbe9c39f5", "value": "bgisvff0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b88a819-2342-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773890226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890226, "uuid": "a3db6811-d42c-46d5-9e71-3b87a51cf4dd", "comment": "Malware payload (Mirai)", "value": "0b4bed7ac3f0fd26c34189b128d27e56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890226, "uuid": "57465997-3378-4426-bfb0-e656aa75a5e3", "comment": "Malware payload (Mirai)", "value": "4a5e1a0553590a2e95cb18e803fcf04c93db6cf25039a8bc87e9cf1379ae57fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890226, "uuid": "a727bad4-30af-4c7a-acc6-8cad68dbfb08", "comment": "Malware payload (Mirai)", "value": "d70a9a08a93e6556b5e70d15c5f27cf839ca437d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890226, "uuid": "4191b9c2-7ed8-4044-a9df-99e75f233ff2", "comment": "Malware payload (Mirai)", "value": "3a5ad39f055f2fb2de6997d82811c1d6c800fc36ec68cb9816ea63dc2d4cfe79a3cb7a4082a5a6a89f26e2ac720046bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773890226, "uuid": "8865612b-c2e3-4d43-9735-69894b7a811e", "value": "T106B33982BC419A22C6C2127BFF6F418D371653A8D3EA3203CD195F2577CA91B0E7B646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773890226, "uuid": "850f40e9-9509-42d1-baf3-9781edce6669", "value": "3072:DD1etwmgRjDOUH7KJdl+9gDnQhcjTZY9:DD1et9UOJboMnQa+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773890226, "uuid": "bbacaf91-4063-486c-885a-467a4d2a7bc3", "value": 107776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773890226, "uuid": "ef3e78af-57d4-44a4-bdc7-f09df9d755f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773890226, "uuid": "60e10956-d22e-4ad5-a391-7a35f6f8a9f6", "value": "tux.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee4ed640-234d-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1773895304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773895304, "uuid": "af4ac95c-9a0a-48df-9248-1d9409cabcdb", "comment": "Malware payload (GuLoader)", "value": "1f0351dada7cc8e1c9d0710c877ec76f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773895304, "uuid": "209f62ad-e5d8-4144-b712-f6a8d326704e", "comment": "Malware payload (GuLoader)", "value": "4b12139f0bc6a7ef12a930d35de53113a07a63895519d9836cbe33ff17b70eaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773895304, "uuid": "f1999cda-c232-4d36-99f3-f08c5ba80985", "comment": "Malware payload (GuLoader)", "value": "940c129d57a8ede58eddbf27a90aad06bc9c624e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773895304, "uuid": "cabc46a8-b09d-433f-95be-ced8fe3695bc", "comment": "Malware payload (GuLoader)", "value": "5ffe719ba488bb42ba5c87ae17afb3a8828f64ab6fc7f95dd16a474308c0e61cb088ff93056baa388c6eea1bfff03cb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773895304, "uuid": "59372f03-267e-404c-a505-6e95467ca7e6", "value": "T115A4F103FA50A266C165033158B78B3C1737AE645BB15B0F235CFE353AB72D65A8738A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773895304, "uuid": "71776e3d-7ef8-400f-9e1d-c7ff69464833", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773895304, "uuid": "57679edd-55cd-4410-b41d-69b91119a6e5", "value": "6144:ghRMPAEwuZ0NTcIonakh9gjQ+2aONKWChHP1Y2blH33Jaa3LjLacI1/s+X/YHrob:GAAwYJoNh9ge7IW2BHXLjLaxUAgLwnH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773895304, "uuid": "f1722934-dfd0-49e9-ad3c-9e973c470f09", "value": 474416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773895304, "uuid": "f753afff-13e9-401e-ba13-a1d927001f7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773895304, "uuid": "ca3db3b2-476e-47cd-8749-f85fe74498ec", "value": "Vekselrytteres.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8241b531-2393-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773925187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925187, "uuid": "5eae4263-039a-4f1f-88a6-5e870fdad706", "comment": "Malware payload (CountLoader)", "value": "162c490d339b803276cbdc7676212f4c", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925187, "uuid": "a73e3171-7f7c-4993-a0d5-007c70bb1077", "comment": "Malware payload (CountLoader)", "value": "4b17c00505528921e9bd7f44ff2bac3195256129023971487c3ae3131a4d2624", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925187, "uuid": "74f4e6ae-87b3-4326-8c08-e83da23b52ab", "comment": "Malware payload (CountLoader)", "value": "449ec0642eee142db4283406309d4b4773f27df1", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925187, "uuid": "c0f5eb2a-0231-4116-975b-12effa797c79", "comment": "Malware payload (CountLoader)", "value": "0856ec2d46d307258b7dff48ef4a498ced366b88e8a9173c2552cb491420df0961bf64e49b82d279b994488cc1d40eb5", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925187, "uuid": "7dfd93c7-797f-4c6c-b05d-382279127140", "value": "T129A495CA3E1AC4E2EB358B319146C5715A167AF3BF91704A73C0EB484F369A5721CA37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925187, "uuid": "9d77bd50-59d3-41e2-a1e5-d260375dfdb4", "value": "11bcbfd6370c1d9c6ba34d863b0f8743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925187, "uuid": "bd33b0b9-b316-40d5-8464-6bd8d9ac15d6", "value": "3072:ax+tK0SiuKonWVYqjxMGOcbb5pAqBk/7CtmKCRFwLuCuLwUpYpQm0/DjlQ6QljDD:4KK6uWV9jxMGjA0uQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773925187, "uuid": "1f945097-dc65-4390-93ed-f4f37585bb59", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773925187, "uuid": "22799607-954a-4995-b8b7-b953038334dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925187, "uuid": "8963eb27-d0a0-4811-b454-6886ad73a416", "value": "162c490d339b803276cbdc7676212f4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db1c440-2348-11f1-a769-42010a9c0008", "comment": "Malware payload (NetWire)", "timestamp": 1773892941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892941, "uuid": "ed8f0555-0d79-4c35-9550-b20f173c6aac", "comment": "Malware payload (NetWire)", "value": "8e890fd142f61443a8786c382bb7ee03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892941, "uuid": "10afd99e-c56b-480d-9355-738f855ded01", "comment": "Malware payload (NetWire)", "value": "4b93ccba6c66148196b17b5cf1793677e1219ff72979cdad2cc5fea8b5ed96ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892941, "uuid": "95a13c07-0570-4b9f-844d-4fc1954311c1", "comment": "Malware payload (NetWire)", "value": "f665c005fc9c44b0689fbefac3f55bed7e585864", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892941, "uuid": "62739493-33d2-44b8-988d-ed99099411bb", "comment": "Malware payload (NetWire)", "value": "ef7006ecf7534738f6f2b6eeb44359162488b18e896775a21de7d69902b6c5c5fbc708adb65bfa357b82e57ecec3f283", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892941, "uuid": "ff687bc6-b39f-4a8a-b4d1-2f816b26f12a", "value": "T18755BF52E39EC2F0DE165172BA7DF71A2F3F3C254530B956AFC52D3AAD21021112DAA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892941, "uuid": "e514f674-bfe2-4aea-aad9-7ff24d03885c", "value": "649f6ed9a4d576c154bbc0357156a4a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892941, "uuid": "3bd0fe89-2d21-438d-a954-cb4abf75a6d0", "value": "24576:Ku6J33O0c+JY5UZ+XC0kGso6Fa720W4njUprvVcC1f2o5RRfgUWYA:8u0c++OCvkGs9Fa+rd1f26RaYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773892941, "uuid": "5c3b7860-68ab-4ba2-b323-c1e5e0bec045", "value": 1390216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773892941, "uuid": "3b79062a-fa92-4fa6-80fa-1526126250ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892941, "uuid": "0b37f869-15de-4e55-88af-f16adb05533a", "value": "RtDCpl64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c2c36b-2341-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773890161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890161, "uuid": "9adc52bf-ee9c-4e5c-9a8a-a8eb720d56ab", "comment": "Malware payload (Mirai)", "value": "675cb15382fe9e3958ece9eec1f7471c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890161, "uuid": "291c843e-8ab6-4e12-9dcc-273aa41d9baf", "comment": "Malware payload (Mirai)", "value": "4c4e68e8e4545367bdd686c5ecea87d87a10b27e4b7d4e5229d66b58269e7ffa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890161, "uuid": "b165b5e1-9bc4-47ad-8cc3-65c8e75e9ef0", "comment": "Malware payload (Mirai)", "value": "d6f92c6601ea621b45a5f516ce1bbd809250ca2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890161, "uuid": "42968bea-05d9-4449-9b75-2bebe75887bb", "comment": "Malware payload (Mirai)", "value": "8c8ba5810de9b252a1eeb60ffbd64645a08543225457ed6cd9d5839a86c7a5ad7a7f51f9bee5cac75f6b3c35a8823825", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773890161, "uuid": "d4f3aea2-a8b8-415c-aabc-3b44f201a359", "value": "T1B7A35CDBF800ED7CF84AD77644634A06B531A3A14A930B377267FD67BD320A54827E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773890161, "uuid": "b3163dfd-5913-4689-abd1-56909facbe78", "value": "3072:rz3MMz4s3LB4EbgyghZUk4PSsqXVHgARk:v82a+gygrUkkStHzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773890161, "uuid": "d701e56a-3952-4b56-8631-eab0ab9b0fa1", "value": 98584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773890161, "uuid": "b07bfc1b-28d3-4ad6-a2c1-5bb46c1ebe60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773890161, "uuid": "3442b969-dbe3-4c87-8b70-ad818badcf83", "value": "tuxnokill.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f21f61c-2355-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1773898473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773898473, "uuid": "7c18f0ed-4558-41c1-b5fa-79fe5e9830e9", "comment": "Malware payload (SnakeKeylogger)", "value": "6348efa3f5632512594dcd3a0bc53c5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773898473, "uuid": "ca48df0b-e3cc-4917-897e-4145f242d3a4", "comment": "Malware payload (SnakeKeylogger)", "value": "4e42b7943ef7edb20e482685f3662e46c405330b790ee8aeebf75e8a87e2b33e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773898473, "uuid": "38abfe11-e319-4d0a-8a13-1744e9a500e0", "comment": "Malware payload (SnakeKeylogger)", "value": "839042bbaf76f8ce69e1b5f1f0edb639c4cb66d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773898473, "uuid": "6b20b58e-2b0a-4a6b-a173-2e05123d372c", "comment": "Malware payload (SnakeKeylogger)", "value": "f5170b9422726a77f2cc17e1c9c02fc0fadb109d6ce942c51943cb597d78cad6ce023242a28057bcdb77cfea3c8db787", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773898473, "uuid": "ab5c915f-0167-4427-ac98-b8bd7f914d25", "value": "T19F65E0B1E34588A6E807127C4977EE321327BEADA470C55F54DF392B7A7335210A6E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773898473, "uuid": "dbbd2710-1fb9-46b3-a941-96e5393a8a12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773898473, "uuid": "81809847-4976-4ba9-ae2a-67d784b78a74", "value": "24576:UnMJOJJYc9yzINTFG48KxEYDC+xo+MQKkffhvjj9IqbFhs/A:iMJYUzIlFDpe+xopCfhvjuq4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773898473, "uuid": "34c1c133-50d5-402b-9ac5-e1077eb491b2", "value": 1413120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773898473, "uuid": "5eb9dfbb-71d7-49ae-926a-ea1b1bdf6388", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773898473, "uuid": "838a6941-ddff-48d7-9c71-8257cc379eb4", "value": "RFQ- HARADH & WUDAYHI PROJECT8635263587.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e60f36ba-23b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773940817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940817, "uuid": "b6a46b38-94be-4e46-b51b-575b49f60edb", "comment": "Malware payload", "value": "11edf61eb36bb5bb908e71fdfc0e1133", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940817, "uuid": "fa470631-6ced-4412-a6a8-1510bfe86300", "comment": "Malware payload", "value": "4ed12571df78e99c6e9daabc893766ab059036f9ce65ffc9eef450c5a5a1f3e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940817, "uuid": "f5871ca2-5e7c-43be-ba3c-8ddf2c2db6b2", "comment": "Malware payload", "value": "2dc3a87106778100ea216421fabdf020e84ff8fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940817, "uuid": "fb869870-892f-4045-8f6c-6188cbebe69f", "comment": "Malware payload", "value": "faf94e8d72cd77d88c34b519194dc6263a487c1f25024c6d977389afdfdc3e0b3ccbbcddc0701fbf1b08df3325a87f35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940817, "uuid": "81aae0aa-4330-4427-a783-247eab338746", "value": "T1D7173343F794CFC7C0DDFE79A0E0095699E34C74A9AD430ABD2DB6BBADA22402C95354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940817, "uuid": "a1962d91-0106-4a21-b4fa-2b6186b463a2", "value": "393216:CbZmOQ2oScn1PXnB2LFU0IJ78oExxVJ0ANLm3RNBfc4fKWFhC:EQ2oSa3B25U0MyVJncBkOFhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773940817, "uuid": "5bcce4a3-975b-4bf8-ac78-bebf7b5352d1", "value": 19047640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773940817, "uuid": "2a648779-22ea-4d93-8026-36c89b085120", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940817, "uuid": "8873daa1-6eb9-4ad4-b4d8-1c683956b909", "value": "4ed12571df78e99c6e9daabc893766ab059036f9ce65ffc9eef450c5a5a1f3e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e8cd56-2344-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773891268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773891268, "uuid": "eef4dd7a-d317-41d4-9eca-33075d498adb", "comment": "Malware payload", "value": "3dc1c84471eeef64254ff2b2f807df7d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773891268, "uuid": "e6e137e4-158d-40e7-bfa8-ba2b6498a187", "comment": "Malware payload", "value": "4f613b5fd6c49018b629c30ac4c21f8e5d1a4256500f550497f83b90f62f48c8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773891268, "uuid": "1f7df866-56bc-473e-b985-589392e16841", "comment": "Malware payload", "value": "ca9ffced730e326a045867cc98341ae321fab8c6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773891268, "uuid": "675e86bc-ab3c-483f-9f2e-a4f862cc0032", "comment": "Malware payload", "value": "e65b912b62c4a9a3e12f07795f11c602732d8a80df59cdb174be69b2fcf32eaaaaf9a1d74dc9bbc5c692d2c5b519de51", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773891268, "uuid": "f5dcf46c-1d73-4cad-8df7-1d59f6139e14", "value": "T1D3924CB512896C79FBD1CE399F3C6F49ADE8C2C42124A3ACBA0F39205A1166DC70535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773891268, "uuid": "ac46f4e4-77c8-4488-89c0-e9eeaaa2cd4c", "value": "384:61bcuQpWx+BL0SWL0gnn7zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:61b8i+BL0SI0wzsP4cbddr7zsP4cbddo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773891268, "uuid": "d18c18d6-ebea-450e-8d17-54a426426dc1", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773891268, "uuid": "a0fa8b4e-a513-44c0-97b1-edbaa8a6d098", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773891268, "uuid": "46571cad-8eb6-477a-b53d-a83c1702217b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b5ec6e-23ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773936383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773936383, "uuid": "4431a623-5806-4d25-b20a-0200349e61d9", "comment": "Malware payload", "value": "54631cf0af27ee5f0532a4df1ceb25c0", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773936383, "uuid": "c84c1b73-9090-4f59-a18e-fdf4edd95eb8", "comment": "Malware payload", "value": "50b70fb7ed85ce2a514482f6826124eab3d5d8b0facd8a3729be9d8b0ad7a789", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773936383, "uuid": "a8c67c05-c403-4dd3-a6fd-2cda855745b9", "comment": "Malware payload", "value": "cb38e0513fd842a6c5dbb3c39021ed520c70c655", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773936383, "uuid": "5776d329-af50-4033-b5a6-93cbf9eb7f0a", "comment": "Malware payload", "value": "19880d193b1f6c5e164898a4ab7e2ccaa258ca8ff6f802c06bc90a5f67d87bf4362dddcd449928a4c68905930be826be", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773936383, "uuid": "2e400172-72d2-41a4-8052-e54351866353", "value": "T1A0B3EECB0ACEC4EC861FA855415E5D07CB9F111B891DC1907EEEBFA83FA1DB860969D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773936383, "uuid": "5d3471b8-9670-4178-9286-1064666ff07b", "value": "1536:VJXZXMnwZumty/a6HKN2YjV4PeIkeXmz+g2JggG6jlaFD8fW:VJJX+m96HK94WIkeXmz+g2Jgg3c5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773936383, "uuid": "47430b74-47de-463b-86d7-3304dfc77a6c", "value": 118084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773936383, "uuid": "03695964-fd8c-47f5-b76f-b9018eb32113", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773936383, "uuid": "df22577a-8714-40d5-bdf3-0f5166f8a409", "value": "Testing_Edge_Audio_442.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b818a9-2370-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773910328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773910328, "uuid": "d160640e-b942-4292-a1ec-ac614184b12e", "comment": "Malware payload (AsyncRAT)", "value": "95ab8862ea0c39b801345344ef7c4fb5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773910328, "uuid": "75efcc01-c948-4054-ab9d-956be21a371d", "comment": "Malware payload (AsyncRAT)", "value": "51287de81cc5f8e5edd0ed54009cf9c68f3ed74b5a7192a704e8076c4141df55", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773910328, "uuid": "faa82629-1db7-4249-b825-ee9aeacc9407", "comment": "Malware payload (AsyncRAT)", "value": "5bb0d22e92d6eb7e9a8d4312f843b5d7cced804b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773910328, "uuid": "6b161788-bcb2-4b26-8608-a2a10435da8a", "comment": "Malware payload (AsyncRAT)", "value": "53c006842fb7bb39599b1985516fbee023489d0013ef797177107c9918eddbecf05767266f2dc0ff8b76f9da8865fe5c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773910328, "uuid": "34b8025b-152a-4e44-8fe8-71641833fb8a", "value": "T196E22B4877E44712D6FEAFF129F262061670D517D813EF9E0CE485EA2B67AC047407E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773910328, "uuid": "505a66ba-e887-40f1-948b-2010539f29bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773910328, "uuid": "0253c0a5-4250-4acc-a8a4-0fe88ff04ddc", "value": "768:FRPD9OQhx/BV3Tw49FzVFE9jYiOjhYb/:Fd9OW/V3U49HFE9jYiOjub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773910328, "uuid": "b698d99b-9384-4a61-a9b3-9d9ec01ce285", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773910328, "uuid": "df6dd3d6-e664-4e33-8213-c422c18cbe47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773910328, "uuid": "850e7ca6-1365-4df6-b2db-e9663bd5522f", "value": "XClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "635ac4bc-23c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773946181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773946181, "uuid": "b5114b45-071b-49f0-b617-6c7db6dcc776", "comment": "Malware payload", "value": "dc2d90b769cb5761d0c8f9321b131f2e", "object_relation": "md5", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773946181, "uuid": "98dd3159-93f1-4f1f-a6f0-88348868d1fc", "comment": "Malware payload", "value": "518305c46011c61a65763430383565c8c4e50a2f4a22116e67c682b2b5ed7ccd", "object_relation": "sha256", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773946181, "uuid": "4df2d1d7-9a23-4bbf-b7da-a7f513fab60e", "comment": "Malware payload", "value": "d443a775f0543ef0ac291fc664b9a0707356e69a", "object_relation": "sha1", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773946181, "uuid": "e7b67b8f-47dd-4e0e-ba00-c1119610471e", "comment": "Malware payload", "value": "2576bebcbbf83b21662076657ab5b70dfdbb82c2870a5afaffe184e26c67a099ed3e42d77dd926c950bfbcccc4c19d77", "object_relation": "sha3-384", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773946181, "uuid": "1bc33cb7-a92a-449c-8846-e5c75f55da00", "value": "T12BE068604C49C9DDB0B270E214BE688D429493547074AE0803C4E1B94040B568C07084", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773946181, "uuid": "539cf901-4968-48f3-a4d9-bb3c66042041", "value": "6:qzx/X7shryX84GRZCZJh1uQpvQPBnaZ5SuH1mQ9GWjKIwQFHTYuB96I:kx/X4raFhN0aHSuVz9pjKN4TYPI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773946181, "uuid": "3fdba7f1-889e-4718-948c-c1439a301107", "value": 350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773946181, "uuid": "d9293403-5f94-4e5f-acb9-6d98d3505721", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773946181, "uuid": "a1db4869-4da0-4cf7-b701-d60038d3d9e0", "value": "tVdEpzEW.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6439b90-2353-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773897894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897894, "uuid": "6da2fb88-d10a-47c4-8010-27a261d87224", "comment": "Malware payload (Vidar)", "value": "bd65d402f2065cd7ad972151b2df5c9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897894, "uuid": "55227b0f-1502-47ac-af40-4954c8b213a1", "comment": "Malware payload (Vidar)", "value": "550edba01a629b9f1ac133c0dfb1bd40fcde8e06e3560c1dfef664fe62f0045e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897894, "uuid": "9f9e8ddc-f807-4ad6-a16d-ddb94b282775", "comment": "Malware payload (Vidar)", "value": "b2df23f1f9c73c743b375dd4d5a38d59b02a9f67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897894, "uuid": "4c809cd7-b0e8-4691-8c0f-d4f44a590005", "comment": "Malware payload (Vidar)", "value": "7e077bcce23094ab8a3b3117289443a507fb9ee7931f0de7782d6c3372ebc604590ff6bc30592e630beca500906a7321", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897894, "uuid": "6ad3bcd9-2ab9-4f25-8475-7a15867413aa", "value": "T180958B03BCD421B9D4A9D23289B111A27B30F85A0B3037C72E55A6B93FBB7D45E35399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897894, "uuid": "981b292c-8707-47c0-8e5e-0fc0e2fc10d2", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897894, "uuid": "930358a6-7795-492b-b9e4-13c1e83dc806", "value": "49152:U7P5WnG5IcEJq4QoNM6MtYVfhtMYgtMHK1:qqdNM6Meh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773897894, "uuid": "58d8f838-6d69-4d63-be75-6e6a0735c536", "value": 2008064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773897894, "uuid": "31130027-cf52-4c77-bc08-92bb778651dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897894, "uuid": "dfaa4b1d-62b9-47f0-bea7-59fb1111f90c", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76bbd940-23b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773937623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773937623, "uuid": "688846ab-84d4-462d-8fd5-68445232df74", "comment": "Malware payload", "value": "c21a8aa423673c3967e145fcb9ce40a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773937623, "uuid": "1484d36b-098c-4c28-9f55-c5caae7f7a62", "comment": "Malware payload", "value": "55a152c47c4c90eb5640496f4584f7f8fdaede33c06902507094c31355a3e55d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773937623, "uuid": "72c41209-2bc6-48ac-bc1e-97fb880010b3", "comment": "Malware payload", "value": "7676a5d78e009c064116b699eb9bed661cdd1977", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773937623, "uuid": "1f8545aa-3f71-449f-b965-93b2aad86c88", "comment": "Malware payload", "value": "0b9b72f48077ec6dfeff69b11828d0a1c999f856bfb1bb9b7ce06a96e76441467fa94b44123bd28a01e3832a24026c4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773937623, "uuid": "cf793fef-ca02-4c3c-b7e0-4ae38b764719", "value": "T1BD85AEAFBB88366FC64099FA9E11050ED9C48E900D7087713F635B52F26E594C239EED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773937623, "uuid": "ef9c7b15-ce6f-4202-bce1-952e3c5f66b4", "value": "4a66de3e8d132708eb41ffa0ee63c649", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773937623, "uuid": "2b16af46-780b-4458-ac5d-ba51456c6cb8", "value": "24576:BBQJo49k+U4jINgvSaRdw4/AjPqqeguEKwu36dVlqR0pXGTZJSJ97:3QJk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773937623, "uuid": "5809b774-9549-42c9-a56d-8d473666d713", "value": 1804472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773937623, "uuid": "70820ea3-e560-4b6e-82c9-699ec605ee63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773937623, "uuid": "caf59c55-5223-4d82-ad6a-072180bdc23c", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18dbe978-239a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773928017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773928017, "uuid": "d631609d-f03c-4f1d-bb96-b8273b651b34", "comment": "Malware payload", "value": "74a584e5c63a94f36cc58b50a95c8c53", "object_relation": "md5", "Tag": [ { "name": "ForceMemo", "colour": "#5C7A4F", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773928017, "uuid": "e4199f88-d767-4dba-94a1-7e711601d250", "comment": "Malware payload", "value": "566bb30ad42762b4584c55267158ea901602fc149fb2e0911107e49432de1249", "object_relation": "sha256", "Tag": [ { "name": "ForceMemo", "colour": "#5C7A4F", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773928017, "uuid": "dbff66ea-2bd4-4c5e-8539-e97dee973d3c", "comment": "Malware payload", "value": "b806621dfe9d1e9982e22b5f50ffa16b9707c7d0", "object_relation": "sha1", "Tag": [ { "name": "ForceMemo", "colour": "#5C7A4F", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773928017, "uuid": "f85f4d30-deed-4c50-83b1-d2b4cb7a73a2", "comment": "Malware payload", "value": "3f9d2d3b6ec9eac425fdd46f4c2339e2067d7522c8f6e9582695f56b901c31dc4efebe924ca84d23d196304910ed3c7a", "object_relation": "sha3-384", "Tag": [ { "name": "ForceMemo", "colour": "#5C7A4F", "exportable": true, "hide_tag": false }, { "name": "github", "colour": "#778252", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773928017, "uuid": "4843b2e3-ff8d-4217-9d50-e8caf19d34cd", "value": "T18FD1AFA6243F0C1FA298B71C411959E5EF432D68E5B4B99CE6A41F9178B7721C86380D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773928017, "uuid": "8b763d16-e764-446d-ad41-b0779741a6f6", "value": "96:+FpTadqMrwbBufYU19Qj2+O+pXF1UZTKqJoupe0C+6JAtGkG/Bl+3c2AVCLZ1FTq:+FpuwbBCYczA7zIoKD8/rsLfFTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773928017, "uuid": "5af1bd14-20c3-41b0-b737-36c838c9cc6a", "value": 6582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773928017, "uuid": "1567488a-fb87-4d2c-8f5a-3e260ee19ec9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773928017, "uuid": "c7843843-aabb-4b34-a2b4-8d711688f430", "value": "forcememo_payload_obfuscated.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd0ecc58-2353-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1773897906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897906, "uuid": "4e2c9be3-bd55-4489-bf25-82bf3e149da1", "comment": "Malware payload (SalatStealer)", "value": "8978c2a0f508008a766e107a0ed8b915", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897906, "uuid": "c766b76e-822a-4b82-b2d3-f4bf2a16837d", "comment": "Malware payload (SalatStealer)", "value": "56c6d2dfa0bb29c0d46e2ab4912d8539e33a856f0ad43ebbaa37e02356a5ec37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897906, "uuid": "3c772a32-de12-492f-adf2-3200915e0b9e", "comment": "Malware payload (SalatStealer)", "value": "2a79edb01faea74fce40c8626d2b430bf8bc94c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897906, "uuid": "c4dd46fe-aa35-4291-9370-521492fcd672", "comment": "Malware payload (SalatStealer)", "value": "5af227102457df468cb016600cc7127a1d4f53270fc7d74c434be98a0f5c6b657f658b63f9a26259c72e212c49c54c77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897906, "uuid": "d8864fd3-f139-42de-9119-13e19a8e0414", "value": "T173D66C41FD8B56F6E903583240BBB23F63316D058B24DBDBEB083A6AFC776911876215", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897906, "uuid": "fb3c213c-662b-4ff9-9d68-5efe8480bc79", "value": "49152:GRv6EzVGJ2LCJNLE2AsABix4qeJp96LE/X7MiBCSdEJhIy3+E3duVmQbmbTKv5QG:y66Vx2AZAuqc9dPsKBQKxi4X3HX+uE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773897906, "uuid": "092b5f52-4292-4e30-abad-5be63e1aa8db", "value": 12920832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773897906, "uuid": "bcfb90bc-b419-4ffb-a65f-79475257b945", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897906, "uuid": "d55e2196-1c7d-414c-89c9-6c8fc18a50cb", "value": "ilgw9l.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f4ec18-2398-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773927180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927180, "uuid": "8371440f-59d7-45cc-90f0-c68896e13c3b", "comment": "Malware payload", "value": "abc716641edcaa11208cc440f3cbb2eb", "object_relation": "md5", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927180, "uuid": "8a30b41f-245c-456d-8630-e400536f0504", "comment": "Malware payload", "value": "56ca3e95b210cb97c06913c8a55be890a9a49f0bbbe9ece1260f624d23ed56fa", "object_relation": "sha256", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927180, "uuid": "3e9e7c78-0db3-4a74-a6db-0d3d56160155", "comment": "Malware payload", "value": "67e1bac81bbec191dd2c432bc4030dc09fd038d4", "object_relation": "sha1", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927180, "uuid": "b50510f1-9f45-4ec5-bc17-2933976344b0", "comment": "Malware payload", "value": "0ea34d425e5b16d682c578f6c5bac7f2967e9e42809c1ca36073128466c26a6e0924ebc2b83d87789d04b459507a492a", "object_relation": "sha3-384", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927180, "uuid": "2901973b-033a-4501-91a4-1de61d256280", "value": "T1450833C3431A19FDC59BE4F8B1A5CA0EDBAE6ACD907CCA4A02317158EDB3772D099D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927180, "uuid": "fc431baf-158f-4896-9517-a5e7d7a9c1f1", "value": "1572864:lTr+reZSuqX61M4lVfdxeJeyN4woluw1hVgEKw1yd8jQTtBU:lTroeuK1M4bf2JLNyLKEKzTBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773927180, "uuid": "6e4a0991-5890-4b89-84b3-dd24a2e46f98", "value": 80332584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773927180, "uuid": "824e7e2d-07e7-440c-94f5-97cd48aa50bb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927180, "uuid": "f1fffaac-15af-47a3-bb4d-cada2fa3488d", "value": "Cyrex.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f37004f-23c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773946174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773946174, "uuid": "61931f0e-6cf2-4d01-a72b-88dd278e8baf", "comment": "Malware payload", "value": "f7fce913d3bd0c001b926c54285becde", "object_relation": "md5", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773946174, "uuid": "adbb32e1-24ae-4300-ba90-8af6acaf748b", "comment": "Malware payload", "value": "57105a90e5e31454a355fb7d97d800f3645b151fe4ae207f76485f1105b9c18f", "object_relation": "sha256", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773946174, "uuid": "c3fd15b9-c76d-456b-b95e-1180e4ed426d", "comment": "Malware payload", "value": "a45ce82670b21ebaa9a205bbe4b5690481b01690", "object_relation": "sha1", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773946174, "uuid": "9187fd44-eb63-4a78-bbfe-5a039eac69c4", "comment": "Malware payload", "value": "db5af22e8405e88d39cb90763e0111b095071311628320ac4aaa801140665e65259a11ffe958076a18abf453fee17689", "object_relation": "sha3-384", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773946174, "uuid": "8114e2c0-b099-4d0d-8fb7-9a07c9ddfe24", "value": "T18F71FF0683E8466BF4B70738AFF743526770F8509E73937D0980521DAC616684D31FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773946174, "uuid": "daf8454e-b800-431e-9d9d-35a54f0b62b2", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773946174, "uuid": "5141c73a-1140-4625-8db4-57df649f64fe", "value": "24:etGSDsh2WEMqlB3luyq4usdrj2INtkZfJaoFDzGWI+ycuZhNCYakSFNPNnq:6uHqjl9tudJJa8zN1ulCYa3FXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773946174, "uuid": "89fd6469-57f7-4cce-8008-ffe9cb5d1407", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773946174, "uuid": "ef98e1b6-df16-4880-a609-163b53f76d15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773946174, "uuid": "6d7c4394-3859-4016-a330-371ad6b69bf2", "value": "5eyabrbi.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bb3b092-2398-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773927270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927270, "uuid": "d2632950-c25e-42de-bde7-9c4f447bfb7c", "comment": "Malware payload", "value": "142764d908b013880c77cb002b1ef75e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Liansitong-Technology-Co-Ltd", "colour": "#A420A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927270, "uuid": "0b6174f4-d692-4dc0-ba41-c690a8330388", "comment": "Malware payload", "value": "585fa35accbca6bdcb5eba6732d4e0bce575e2d356183a0cdf2f0f33f1723f78", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Liansitong-Technology-Co-Ltd", "colour": "#A420A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927270, "uuid": "ac724d6b-b085-41d2-b54c-06b11826d161", "comment": "Malware payload", "value": "8e7ac99697fb0a422660faff111f23c97e137fb3", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Liansitong-Technology-Co-Ltd", "colour": "#A420A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927270, "uuid": "ea5a3820-14cd-4962-8840-e3467730ed59", "comment": "Malware payload", "value": "b34ec1728af31a07f9ed4d49b17b819906256668200196fb20ff0119df0c370a2b0f8743036241c0287bf024e3a62c93", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Liansitong-Technology-Co-Ltd", "colour": "#A420A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927270, "uuid": "aa54e7e3-36b8-46ee-9fb1-caca5b39d278", "value": "T104B6C0217BDEC036D26F0171993ADB5BD63CBD210B3196CB63D4B9A919326C21736B23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927270, "uuid": "45465398-9290-4975-a6a4-216dfbf445c7", "value": "98304:ziI/uKL8gfAuSnqFozxY/XuFkf6xRwAM74u89rjqaV25zOLx8LeSDFAe:QKhAHnqiMu+f6xeB7F89rGamL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773927270, "uuid": "618a3145-cc47-4e3c-8503-ba1d426130e1", "value": 10424320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773927270, "uuid": "05112301-9743-40ff-b228-867b7c6462b6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927270, "uuid": "5a51bff1-5ee3-4e2b-8d3c-8e5dfac30c00", "value": "585fa35accbca6bdcb5eba6732d4e0bce575e2d356183a0cdf2f0f33f1723f78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf548761-23b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773940752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940752, "uuid": "2c9693e8-796b-4892-9c1c-69634f18a617", "comment": "Malware payload", "value": "3bc309bd48ad6363bf5798baf350a64a", "object_relation": "md5", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940752, "uuid": "587e5284-11a1-4704-a28a-7dafbe601ff7", "comment": "Malware payload", "value": "58fa05f20d8eb34a2bf4117ccce6328cd4cb6cf8714f00df5e55c282a16beeec", "object_relation": "sha256", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940752, "uuid": "3e1b9090-1675-4e2c-963a-a7863a5ca678", "comment": "Malware payload", "value": "3f6b73a725d5957c93a50f419d59895a47d60256", "object_relation": "sha1", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940752, "uuid": "66f4bd33-b090-446b-a4dc-883e9e5515ec", "comment": "Malware payload", "value": "608d406a374b0baeb6c348eb347c176123dcf923666e3070d1e38df55b77a3355547f9f647b499d45582879448cf3e0a", "object_relation": "sha3-384", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940752, "uuid": "783acfe2-b1cb-495b-ab3c-0fba495e2915", "value": "T105D3D08777785A65CADF0B7464B501414B77A2DBB9E1C78EA89CB18C7C0BB420A133E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940752, "uuid": "0453f4ef-385f-40de-b15e-f490ef2176ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940752, "uuid": "74da659b-4911-4cb3-b276-376e9ae3355c", "value": "3072:44SiJCus1L2Un8L2GqaU3d/xDIP2ULvdw8Vx:7XI10s5GHkBNIP2iK8Vx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773940752, "uuid": "922d1d61-2e5a-4d07-951b-e2f64321dbcf", "value": 139464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773940752, "uuid": "85efd7d9-8d7d-4b2c-8559-fcbb2d20045c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940752, "uuid": "a4ee8d32-94a8-4e42-852e-afaed85aff8c", "value": "58fa05f20d8eb34a2bf4117ccce6328cd4cb6cf8714f00df5e55c282a16beeec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdae2727-2394-11f1-a769-42010a9c0008", "comment": "Malware payload (GlassWorm)", "timestamp": 1773925824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925824, "uuid": "3d546139-1e1e-4865-88af-eacf7130a862", "comment": "Malware payload (GlassWorm)", "value": "6ae0f066e7167adc4c209a5335cb6e46", "object_relation": "md5", "Tag": [ { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "react-native", "colour": "#37C2CA", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925824, "uuid": "756b70ae-8b59-418d-a794-3a3c244b62f1", "comment": "Malware payload (GlassWorm)", "value": "59221aa9623d86c930357dba7e3f54138c7ccbd0daa9c483d766cd8ce1b6ad26", "object_relation": "sha256", "Tag": [ { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "react-native", "colour": "#37C2CA", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925824, "uuid": "9dd8990c-28b1-4bb7-8841-8d9a139feb69", "comment": "Malware payload (GlassWorm)", "value": "1170e32290de22770e58fa655fc6ba74145820a3", "object_relation": "sha1", "Tag": [ { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "react-native", "colour": "#37C2CA", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925824, "uuid": "d9cb0ce9-a234-453f-90bb-b5408d5d90d1", "comment": "Malware payload (GlassWorm)", "value": "1096ff97e4e3e4bef6089dc4e97b340471278fa67b45567fd00cc2b225493a4c88e7a586d016ce6b73275acbcde312fe", "object_relation": "sha3-384", "Tag": [ { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "react-native", "colour": "#37C2CA", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925824, "uuid": "a7e3fc69-91ae-42f9-9481-65a9f064ac25", "value": "T1BF82747A02F72952C603BA3B961ED49199161E6B4E04B50ABD9E7000FFCF53CD6F0A76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925824, "uuid": "93b4e951-920d-4705-8e17-8bbbd4af6192", "value": "384:ANTPv2LHikhwQKlsD9nYu84lIdsiIwZbt:mm9YuTlwsiISt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773925824, "uuid": "f394d35c-9bd1-4dc4-b55d-954ab86180e9", "value": 18886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773925824, "uuid": "997d730a-c247-49f3-b09a-9466f2b9d356", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925824, "uuid": "b5e01a90-5674-473e-ad53-b9bf72a6d1a6", "value": "rn_international_phone_install_v0118.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c78e877-238a-11f1-a769-42010a9c0008", "comment": "Malware payload (RedTigerStealer)", "timestamp": 1773921124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773921124, "uuid": "80ebf23c-0e98-4ed0-93ce-0f94b18e64d8", "comment": "Malware payload (RedTigerStealer)", "value": "53aa04b74dc5488f56e7c74da1ba7077", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedTigerStealer", "colour": "#85B9EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773921124, "uuid": "3a672c79-7fa1-400b-8895-d1c49046e1a1", "comment": "Malware payload (RedTigerStealer)", "value": "5a23a9c1b296927477974132755e38cca656ecf96dd4fdc2a2788a794e133b4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedTigerStealer", "colour": "#85B9EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773921124, "uuid": "cf0c51ad-ed67-4490-90b8-42fe0a1ed2f1", "comment": "Malware payload (RedTigerStealer)", "value": "5e536d88c93fdc37c77864d18af1b19d30228a33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedTigerStealer", "colour": "#85B9EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773921124, "uuid": "68933029-1bbf-42ed-96f5-074755b29cb8", "comment": "Malware payload (RedTigerStealer)", "value": "c19a5b8c54d948380ef2d59eb74b08083eb74742b5edcbd75eeb5dd41e45d910aaf5b4eefd68b5bee0c7c9b26c9f8ff5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedTigerStealer", "colour": "#85B9EB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773921124, "uuid": "3f5f6e71-77e0-4c15-b55a-e1c4ddc71cce", "value": "T11D97339905D3056BF96FA239817A8572D2B2B99417314DEF1F800A643E772D7CC3BAE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773921124, "uuid": "dcc6e285-29bf-429e-8e6d-237f624d1764", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773921124, "uuid": "89037e21-4bdf-491b-9a48-b1fcb420c870", "value": "786432:kruznxv2JLdl3k0HrxDm16x8kOZY7y1U3Ug14XVEgjEvzgodH0q8da:tndyTHrw16xV7UUdFgYkodH0q8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773921124, "uuid": "19912398-98cc-4654-8ead-f52589b53fe2", "value": 41765650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773921124, "uuid": "47515567-e342-47ac-890b-57c77cd53eae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773921124, "uuid": "b192d7a2-365f-4c36-b2c9-cd4ddde68727", "value": "Vyre bot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8caa6880-2329-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1773879678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773879678, "uuid": "006f58d0-ce8c-4685-b526-bf724e40396c", "comment": "Malware payload (SalatStealer)", "value": "8d7f799bfc50300519bd520652dd1942", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773879678, "uuid": "6cf82e2d-7f41-4da4-9b34-d15cdb72e8ca", "comment": "Malware payload (SalatStealer)", "value": "5a70ef3bb64fe744c747b58d69a476293dbfc3e0823b61d16345d9f8830a2f5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773879678, "uuid": "1229b967-f131-42df-9e80-979c5c60ade2", "comment": "Malware payload (SalatStealer)", "value": "7edf57af9012b461cbdfdfa64e7377806791b82c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773879678, "uuid": "81425baa-bab8-48af-966b-7a36cc88707e", "comment": "Malware payload (SalatStealer)", "value": "7607ded99cb53fc4d6f646928b7e4c72ba8f1ddb24b64b3ff049bfbc39725b64cd21a712ea622b1ea816b2250b05d647", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773879678, "uuid": "4312af3f-a417-4f05-83da-c85020f94958", "value": "T1B2C65B51FA8B54F5E9031831416BB23F23315E048B68DBEBFB547F6AFC7B681192A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773879678, "uuid": "cd9ce901-9af2-4282-8c63-43ee13bd99d5", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773879678, "uuid": "f01fc684-3876-46fe-ac4e-ffea5a5b3aef", "value": "49152:ktxktkFkPWLDl01NLE1UcQpYjS6x167Du0jKKDDcv0YJNo+CeOr0HPQoqJdW9wP3:cCtkFllZflv0R+C3eqvigpmVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773879678, "uuid": "d2afb75d-c75a-4895-a9e0-198318c52b3a", "value": 11670528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773879678, "uuid": "6f662182-e693-4396-b722-d45f12661f74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773879678, "uuid": "fe0e5326-1b52-45c4-ac13-9978211dcd9d", "value": "vpn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2878b097-23de-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773957249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773957249, "uuid": "3535ff2d-5cbb-4edc-b2ef-234b17aeb888", "comment": "Malware payload", "value": "c5a7a736ba390d1414df250b355face6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773957249, "uuid": "3ba9b6ba-823e-4810-9d8f-6e63abf95b8d", "comment": "Malware payload", "value": "5b3ead35a73cf214b6b0063fecb647871deb5b0fe83984b3fcbcccd59222e416", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773957249, "uuid": "63af5d2d-bc06-4fbf-a0c7-b2eea9939145", "comment": "Malware payload", "value": "1b4aa3b0948554c9f41d906ed821b151ef4a539c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773957249, "uuid": "764a7f0d-3a1f-4bdd-9ee3-a2734a665e0b", "comment": "Malware payload", "value": "6e097782b1adcbdce1bd3d85f241eb3e303633e0ac00156437a9c4dc238a125252e4a75c5ea308db9930fdf728d0798f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773957249, "uuid": "7c475532-53b3-44da-8cdb-54cfb3158af2", "value": "T1D2925CB412896D79FBD1CE39AF3C7F4DADE8C2C42124A3ACBA4F39215A1166DC705349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773957249, "uuid": "53cd48fc-4f71-4cea-8830-8daf888fd518", "value": "384:6rcuQpWx+BL0SWL0g0zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:6r8i+BL0SI0PzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773957249, "uuid": "bee78c11-c632-4c99-95f2-5a09e9b9fbc7", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773957249, "uuid": "21437480-7316-48d4-a8c6-30090bd604ba", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773957249, "uuid": "db76f8f1-ca9e-488c-883e-a0c4b646dbee", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f921304f-23c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773946432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773946432, "uuid": "d547e149-912e-4349-aeef-cc2347d78c18", "comment": "Malware payload", "value": "a92697918309d9e881ab98b354b7c4ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773946432, "uuid": "3e9c0a2a-7ffe-410e-8b72-a3808f33b053", "comment": "Malware payload", "value": "5b6430e115eb28e10d4e38f3cf311fd9fd39b358ab0dcd6d7ff49bf9d01dab3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773946432, "uuid": "e718d197-16b9-496b-86c2-36df009637e1", "comment": "Malware payload", "value": "633a5f42d571f8e226d074ceb986cd81b42171cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773946432, "uuid": "cab1e41c-ec8c-4478-967e-c8959c7c023c", "comment": "Malware payload", "value": "ca33ff17ba7524f513d3cdea3da85720d4735a141e09e6a53198458389894453bcfdb1c982acf929ab4f805e73445f68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773946432, "uuid": "b1951c65-63d5-4219-ab30-a69a2370e18b", "value": "T1C634225E47D118BDE5A36F39E48E0F9B4D4CF6AC042620A613ED24CD0B5A242BED77D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773946432, "uuid": "2760cdf7-fbc7-497a-941a-dbe3f14925a6", "value": "08ce7667a22ad20f6a28b3b7cd649253", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773946432, "uuid": "a98a4315-0c5f-4c68-b3df-73fbe907e55e", "value": "3072:Jh09TuK9ps1SzcOCFXmPXSt/Ji7n739w69bjWKszmPsgQrSZSaYyG7zJolDJhOeg:vw9CCcHmPX2JN69WvzmTQuYzzJFeg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773946432, "uuid": "02307287-9b00-45d2-b389-73685210a233", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773946432, "uuid": "2fa9c4f6-b107-435d-9ae0-6da97b5942c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773946432, "uuid": "d3199329-5a54-4c85-a404-ec00c4cf45ee", "value": "5b6430e115eb28e10d4e38f3cf311fd9fd39b358ab0dcd6d7ff49bf9d01dab3a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5761be3f-2392-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773924686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924686, "uuid": "97212009-4d87-4714-8385-09b9cb428c19", "comment": "Malware payload (Vidar)", "value": "f40616553ea13c55d8265367268f7ec7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924686, "uuid": "bfbec313-701b-4088-be25-54af5cd2303c", "comment": "Malware payload (Vidar)", "value": "5b6d04b2feccd0400fb437337fc37602def12217d91de55195ef2d09eaf37de7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924686, "uuid": "e7ed487e-d9b8-4770-b50c-ef3a04e2ee93", "comment": "Malware payload (Vidar)", "value": "bb18627532d426bd6011f75fdbb8b5abf61bdf03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924686, "uuid": "7a03e324-9e15-4abe-882a-cdb4928ad441", "comment": "Malware payload (Vidar)", "value": "27216ad1749228c047087e472d387642531ab53ecb585b6d198034944eebceed0c9d53682b13b8200c75dcf593d7d0d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924686, "uuid": "7f2eaa76-727f-4e36-870f-3655efd32e9f", "value": "T1D5959C07BCC061B5D1A9D2328AB512A17730F85A0B3133C76F45A6B93EBB3D85E35798", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924686, "uuid": "cec79253-0f22-40e4-ba23-2c5e144ebb8d", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924686, "uuid": "a30ba1f2-5430-4ee0-9a08-04b943585b72", "value": "49152://qLh1s+F/9eUwoot1ftju5vZ7vEMYgtIBK1:wRoftM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773924686, "uuid": "25a8e8fa-d822-4924-8022-28431fd6b874", "value": 2012160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773924686, "uuid": "1512dcf8-3b01-4cdc-b0f0-b2f4fb9d502b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924686, "uuid": "b1819400-42d6-4086-a898-987cc4dbbf25", "value": "x5b6d04b2feccd0400fb437337fc37602def12217d91de55195ef2d09eaf37de7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5284a485-23c3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773945723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945723, "uuid": "16e87168-fce0-4e67-9dfc-0524af833bd1", "comment": "Malware payload", "value": "e6bbd8e2c62dcfe8506bf3c417428b32", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945723, "uuid": "8aa993ba-cd03-471b-bd37-5ecfdcb7d3b6", "comment": "Malware payload", "value": "5d19ae63e0e62828f57e197b327fbb71d5827bce0557dee7ef1b1aa31df700bc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945723, "uuid": "d03a8408-4577-4683-84da-5d66db71c268", "comment": "Malware payload", "value": "e9d31d4d7e2c6f30410ac7ab5288e6c718b898f9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945723, "uuid": "7360a76b-bcaa-4278-9f3c-bcdcd939009e", "comment": "Malware payload", "value": "73fb80d26ee8bea3a2fa1085d896c8f119a784d58a8a9e36bdb94ae9c15a8dbf4eab85a477adc5dda77960636ccdbd2b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945723, "uuid": "0c66aa2c-7728-4007-8fe6-3731e55c88cc", "value": "T19216D042FB4395F1E1CA01FC61BAB77F493E0965132885D3E7F168695CB00D226BA39E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945723, "uuid": "21899f01-0f6a-4bbd-b7ee-d1f7f63ab837", "value": "138a377d80fb8a4aef9fdade00e086aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945723, "uuid": "ec614f92-1ce9-486a-bf92-649b57dfdfcb", "value": "49152:xWS48ehaSIr/m+W5xj2UtBNBAtSbnd0XeUGXIOY5D2bJIQSPjDjnT4eoIE913Z8M:xWS4MlS+WPjlnKtSbaG4O++R0Djq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773945723, "uuid": "cc1f29fc-1344-41d7-9551-1f105d58cfbd", "value": 4153856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773945723, "uuid": "67bd99e6-f46a-41f3-9f48-5e5179fb01a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945723, "uuid": "3468acd8-5ac8-4f8f-9b13-58d0fd8caea1", "value": "5d19ae63e0e62828f57e197b327fbb71d5827bce0557dee7ef1b1aa31df700bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02018222-2354-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1773897914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897914, "uuid": "e3e2bff5-ff25-4f35-96ea-1d323f0fed01", "comment": "Malware payload (Phorpiex)", "value": "89e62daeee818e067b011bd5273cb038", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897914, "uuid": "5975c20b-dc6f-4fb4-b562-f4075435b26a", "comment": "Malware payload (Phorpiex)", "value": "5dbc4fd7e09aa43c155a0b408857cb2029ebffac19d007949f4079c6edbadee0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897914, "uuid": "0954eb82-006d-4b01-bd67-60e06bf51952", "comment": "Malware payload (Phorpiex)", "value": "34973307bb72140ba52b9aff110368517c8c5a70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897914, "uuid": "052332c2-f512-4890-9c5f-830434a7cec3", "comment": "Malware payload (Phorpiex)", "value": "6f62054827708c9c29254bcd362c94b1e00eac2749932b7a0c00f899c9fdeba7ac479251ea2e54916bebf652cdffc7e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897914, "uuid": "6c050dd4-0d00-493d-a2a7-57f283879265", "value": "T101A39E117AA1D072D4A201300768DB536E3FBA775E78C48377D8579D1EB07C2AB1A3AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897914, "uuid": "abca127f-b540-4b65-a28d-7cf2c3eef666", "value": "32de3c7f405429e673d2a440e61f9432", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897914, "uuid": "2a6ba378-09a1-472c-bc3d-b78392d04182", "value": "1536:ZYfvPrUU0WHXJNq4aWm/M+8BkfdONrj+A0rtM9:GXECi4eERkVUj+vy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773897914, "uuid": "37989f55-b425-4aa9-a636-28f9b59ba923", "value": 104416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773897914, "uuid": "3dccabe6-e646-42b3-ad35-5cdd5e3fa30f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897914, "uuid": "c9ae72a1-d256-4024-a1d4-a6d719ea1fbc", "value": "vwl8i6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb40cd3-2387-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773920158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773920158, "uuid": "419b8d7a-a26c-4d1f-971a-76a893c6a186", "comment": "Malware payload", "value": "3719428137329a37c6dcfd9a7b3b637e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Jianzhuohong-Technology-Co-Ltd", "colour": "#EA53C4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773920158, "uuid": "5e1c155a-e1b5-4b42-bea1-4e47b1f6a0a1", "comment": "Malware payload", "value": "603e3c39f005b3d1b924cee22074cb5e93c5330795cca92da39c5f8d7063879f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Jianzhuohong-Technology-Co-Ltd", "colour": "#EA53C4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773920158, "uuid": "46e8648d-1232-4f6a-a442-15454c0ae2bd", "comment": "Malware payload", "value": "e357a28816b0ca24b75f44097517ba2f58561bd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Jianzhuohong-Technology-Co-Ltd", "colour": "#EA53C4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773920158, "uuid": "b8615626-89f7-4ded-88fd-74af9d2a6c94", "comment": "Malware payload", "value": "6b1d2ded817d99fe398a1905e735e87c0cffbfbb7b05c6c0675a7e8700be295b71216be4bbf264635d3362f5cbf4f16f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Jianzhuohong-Technology-Co-Ltd", "colour": "#EA53C4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773920158, "uuid": "e18ad134-f58a-456d-ac04-d115890b00c2", "value": "T19107336071EBC935C55574779C6AE3EA2C7CA4554B205DEF3B892AFEC9600E28B31E03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773920158, "uuid": "182c0d54-d53b-4025-a161-be8347510777", "value": "be6d2f61f457dcc8133cd7c4b4b3d6a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773920158, "uuid": "2a84642d-8206-4bf1-acd6-af085052687e", "value": "393216:TIIDKxsKnJgmj9kForATH3788sG/1YnafqnqcDLvSydaeDr0QAtBp:hDKdGmQl35s0SapAbLd70rp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773920158, "uuid": "c1325dc5-205d-4eff-8b71-31c46f284692", "value": 18206920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773920158, "uuid": "e6adb2d6-8e98-48c9-a58d-5d919d378507", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773920158, "uuid": "bd42d6ff-70f5-411f-9717-a6b27b39bcfd", "value": "letsvpn-latest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d3dbf4-232c-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773880745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773880745, "uuid": "bdf6fc65-03ea-4a2b-bd41-3776f3ca14c3", "comment": "Malware payload (Vidar)", "value": "94f556b9bf5861129a6099c79b1f4048", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773880745, "uuid": "3e2d9664-bdf4-4fc2-a306-5a20eb1a4c05", "comment": "Malware payload (Vidar)", "value": "60428142ee546dad6bc866e6e3d0ab00e8a25f32091e08ee874c7b750bed96b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773880745, "uuid": "9a5b2de9-3d5f-4535-b532-7e5464ba7835", "comment": "Malware payload (Vidar)", "value": "ac8c509d00c747ba0ab8b9b123a7afa0527a9e64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773880745, "uuid": "c0daeea3-c547-4f4b-94ec-b6c8e391d4f0", "comment": "Malware payload (Vidar)", "value": "bd603ad8662c13903c38fcaddb984e558151d04735e641ae5fc443b3c3ef54cd4328180980f566aa5c5eaeaf6ca81ef7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773880745, "uuid": "d03da44d-d392-4c3c-a33f-c541acda7ad4", "value": "T16486077F22A0816BC26AC13EC1978F04F4F371751B37C2E756A103656B7AAD06F3A664", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773880745, "uuid": "ffd3304a-0d2e-4bc6-8491-c1fe9ebf3db1", "value": "c92ff17b9c0cc71aa2a22e9faeb5d1da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773880745, "uuid": "bd9dbb60-4b62-4c0b-af0d-61d1c53f3a2a", "value": "49152:WZZDZ3Rgj02W0et2ZHpGFnRAwfSSTO7dAKYYnqBeId+W0+9Vr9A09ffxocYZHLQs:WPOkz7M4hff8ZrN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773880745, "uuid": "2f26a933-d5fb-4636-b3b6-abaf060c8f7a", "value": 8446976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773880745, "uuid": "321a9e07-817e-4320-8a32-98dbebc7f05c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773880745, "uuid": "b8bbcf18-17b3-49eb-816f-3b6e797d5dfd", "value": "SecuriteInfo.com.Win64.MalwareX-gen.77124559", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ebd88c8-2333-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773883815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773883815, "uuid": "1469b77f-ec4c-44ab-9612-c5f3e7c4084c", "comment": "Malware payload (Mirai)", "value": "b5bc3bb7cba80e549e35e9aaaa410429", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773883815, "uuid": "04255ef9-34ff-4cc7-bda1-ad68f9634cf5", "comment": "Malware payload (Mirai)", "value": "6050b4c3def76eddfe712c0333f181c499848a187580bb845b1c4a0dca93ee30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773883815, "uuid": "9323ce28-3166-47d6-a668-360c6f48d78f", "comment": "Malware payload (Mirai)", "value": "42b1f827a1964042612966e39ddba11058ca7085", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773883815, "uuid": "8c8fd3b2-977f-435a-86af-80cac0c25105", "comment": "Malware payload (Mirai)", "value": "c5ee4e0a8e19f2a5aea36698b7389c6ce4536ec5d6acd26ce4cde738896ee4fbeed161eaedb528b721bffa93fafcd64c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773883815, "uuid": "a283521a-25cc-4819-b0e5-c8e4a9a6781b", "value": "T1C9A32946B981AB21C6C1127BFE2F018E33135768E2DE73128D145F6477CB96B0E7B91A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773883815, "uuid": "497068cb-bab6-406d-b3f6-c280502b5627", "value": "1536:6RnP9hoo0+Y/f1SL8I/PMbNxxHcLaaJW4Kid5iPhfZX1lSMsT7Qd5pYsb:+hF3Y/XWMHkabhfZX1lSMsTMd7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773883815, "uuid": "8ac90828-bd96-47dc-9934-14f9de37f827", "value": 103564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773883815, "uuid": "ac02f2fd-66aa-449d-a83a-02ea10f8ec99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773883815, "uuid": "a78243a4-7356-42fc-885c-4ed2d469af89", "value": "tuxnokill.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e68108f5-23aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773935234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773935234, "uuid": "b958fa34-a7fb-4d06-8ba4-d1edc02bdf06", "comment": "Malware payload", "value": "94a7b9aee458fa180fce92bce29632f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773935234, "uuid": "0c0f16fe-613e-445f-a838-ddf703451f60", "comment": "Malware payload", "value": "60cb82dbd319ab0101068fe86266d10d941f1b0497110bccd368d861ad2e8832", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773935234, "uuid": "dc4b4376-7fa5-4657-9c60-858d8e06c302", "comment": "Malware payload", "value": "57a61e653adb372d4d6935bf08523e43180e8dd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773935234, "uuid": "3dc12999-91c5-4fe1-8e7d-7341f7f155f6", "comment": "Malware payload", "value": "39054577233b4ab9d80284831054ebcbe227bb68982e28d056c075b6f35146e5deeb94a70de1d80b1d09d98c39bb27d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773935234, "uuid": "19011a70-e5b8-4b41-b7bd-58d91a6e8e51", "value": "T1F285A6752B219559B7A9C9A3F8073984CD33A31753734DBEA45A43DA0CDCA843BB6C2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773935234, "uuid": "6f9e46aa-cb37-4a0c-817a-82ca0dc07850", "value": "192:NplwbIHaSlx5k2I2uHHtlrbdCbddiuJmv/S3uZ2hqRh3Z/augIp72sYHXeOARrjz:Nt22NO+kf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773935234, "uuid": "97088a82-ca32-41b1-9eb4-c9677e2d5bbf", "value": 1784375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773935234, "uuid": "a2e42e38-a2f5-4257-b4ce-d4ba73f672ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773935234, "uuid": "7d66628c-19aa-48fa-9215-8fdea49514d0", "value": "LXZ.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5df293-23bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Meterpreter)", "timestamp": 1773943032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773943032, "uuid": "5e66acd5-b42a-49d9-84e0-5a75ef43feb2", "comment": "Malware payload (Meterpreter)", "value": "77c755efa2a1d8954e65de99789f86f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773943032, "uuid": "cf0d32ef-e6df-4666-a443-55bf1aab7eca", "comment": "Malware payload (Meterpreter)", "value": "62ec30d7825d59a79b9806ef522170252aea4bf0244952074b3ec2fa0c00be8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773943032, "uuid": "c064e8bb-2fae-4691-8079-75e03796113c", "comment": "Malware payload (Meterpreter)", "value": "77091d31ca43661c5652769715d936dbddde271d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773943032, "uuid": "1bf61189-a280-498c-9b6c-5aada2a55f6f", "comment": "Malware payload (Meterpreter)", "value": "43ddfc2967ecd26eb3c95ac8bf7ae0acd82e25e7010170e7553a6a940b4975960dff09c37187875c456371bdad37ebde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773943032, "uuid": "30e473af-b7b8-4c0e-b784-05a3fa821dbd", "value": "T1FE347D5A72A01CB5EE77823EC9535A0BD7B2B8120760D7CF0364839AAF1B7D1663D721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773943032, "uuid": "f0567947-696a-4c4a-86ee-80c500056348", "value": "d0bcdc9f60727f3fc39ee397d624e257", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773943032, "uuid": "7dd85a65-9ca2-45ef-8e2b-99eba58a3c96", "value": "6144:wnhrOgb2gTKPkAN4ARWacGSt0M81UjJiEfe:2ce2UKP9uAR9lhajJFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773943032, "uuid": "69f3ebaa-7085-419d-9215-4cb0c679f2f2", "value": 233052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773943032, "uuid": "c53fc8fa-0705-4f37-b040-3167d4dd2009", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773943032, "uuid": "ef42c8a8-1d20-4443-b899-06cae67d679e", "value": "demon.x64.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "629956c6-235a-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1773900653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773900653, "uuid": "a3d58e6f-ed8a-49b0-91ee-e140a01d2ab9", "comment": "Malware payload (LummaStealer)", "value": "c8c833ed296169638b87d7892ea77903", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773900653, "uuid": "34e30618-6e0e-4f77-ad61-7590e9feadfb", "comment": "Malware payload (LummaStealer)", "value": "63066d64377e314bc34b7e2257910324f8ca73dea9ef41586df6be5785ee868a", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773900653, "uuid": "c349cde8-03e7-47e3-8dae-c2dd142bc5ab", "comment": "Malware payload (LummaStealer)", "value": "ce95ce9704be9e340821fd0380140ff14bff9d3f", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773900653, "uuid": "51008802-86e1-443c-96dc-da28781bd47f", "comment": "Malware payload (LummaStealer)", "value": "77261ebf62fc4071e69cda6d439947fe5682e34b97397d3e04db89e7f47b8c103df9df98da5eeab5732c3602bcc93b9e", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773900653, "uuid": "f2f522b0-f7de-4c25-839f-d7598d62b5bc", "value": "T197A523063654D161C87407B4E9F1C1F316723C65CBA436AB32E4BE3F7B721A46A36B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773900653, "uuid": "d0645d92-5e43-44eb-b9c5-6e112715a5c0", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773900653, "uuid": "c96bf55b-3f93-4b8f-b3d1-2854792ae173", "value": "24576:X1+K3zHq53ore3heCycg3M7wFS8kKLlIJxtyKnl9Wx2MREakEY3+Dn/td1fQPiB4:YwHq5YrgjNkWKAxt7n7ADnL1oKBT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773900653, "uuid": "f97f2d18-d68a-46b8-8dbc-03b61f3be99e", "value": 2152960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773900653, "uuid": "84b96282-e9ff-438a-bb54-9f468b2f93f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773900653, "uuid": "fee6848b-ebcd-469c-81b1-f773cadd0cd0", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7478259a-2348-11f1-a769-42010a9c0008", "comment": "Malware payload (NetWire)", "timestamp": 1773892952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892952, "uuid": "e903abd4-9484-4674-a542-673de93f7c97", "comment": "Malware payload (NetWire)", "value": "5c4c1243ef25f5cd09c53f6dc9673d62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892952, "uuid": "09524417-2458-48a3-b2a8-69cecfb141d7", "comment": "Malware payload (NetWire)", "value": "656aa8fd1ead567211a7f881b5ea4d20974fcdf6ee3c830f2ec8dda9eb4fe2f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892952, "uuid": "c4cd5ae1-e0a5-4869-9372-74727e9873da", "comment": "Malware payload (NetWire)", "value": "07c436270028949c47feb33ba6abb408a67e7b88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892952, "uuid": "c804959e-3750-4d1d-b058-bcb851d6b680", "comment": "Malware payload (NetWire)", "value": "e7b0886e294fbb3063a22dc6772130865af86faa1709b8ae0a342f8b84e6c7369454e6d43197ccd177f104394bdbd387", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892952, "uuid": "406d0972-116b-419f-878a-160cfbc951c0", "value": "T14765BF52E39EC2F0DE165172BA7DF73A1E3B3C254530B9566FC5EC3AAD21021112DAA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892952, "uuid": "a446b812-fffe-451e-aab2-2886e00366d5", "value": "dcbf4f6f0a66c4ef804fdb68720c8682", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892952, "uuid": "f96b8dd9-14fd-47b3-808d-d1fa7096f73e", "value": "24576:nu6J3xO0c+JY5UZ+XCHkGsoEAdx20W4njUprvVcC1f2o5RRfgdWYCe:ho0c++OCokGs7Adgrd1f26RNYCe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773892952, "uuid": "65b2456c-0888-4723-bb26-2632a2b7f841", "value": 1460866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773892952, "uuid": "a74c5b50-6eae-4dea-bee0-e893d9dc20f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892952, "uuid": "1a069aad-19cc-4891-849b-50a14b30d90d", "value": "wb5glp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a3f27f-23bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773942858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773942858, "uuid": "a4775433-97c4-452f-95c9-b3b98d906c7b", "comment": "Malware payload", "value": "a31ccbcb18b53e2eea3d3c6c376d83a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773942858, "uuid": "ad2eda60-c155-45c2-8149-40e1791867bb", "comment": "Malware payload", "value": "6735d0470e957e2b19f1905c85262a099665389211d444477a90b4b41b5bdb62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773942858, "uuid": "e777d8d0-12f0-46f0-8846-e198e60d5ded", "comment": "Malware payload", "value": "1172cd482400d4f0f2ad4adcebbf54504b585b73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773942858, "uuid": "30e9205b-c6c2-40b5-97b9-b53577d1860e", "comment": "Malware payload", "value": "bd13bcda7037dc8618111d6a23c8283f1f2f4f36a576ed7cc6d71080aad9e6fed368d297ef5a6baac927a424426d0444", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773942858, "uuid": "9f869b6e-0dba-4f28-a076-c854d392f7cf", "value": "T172F5C05052688A5BCA6F0735C07001829BF09E4BA3D1D6AE6DDD74FEADB774383132A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773942858, "uuid": "a36333e6-f46c-4b7e-9dcd-06c3cc2ce2e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773942858, "uuid": "7e488056-2d9d-48e6-b45c-a6ec9f9baa43", "value": "24576:V6HLca5a3pIK71BlY/PApIK71BlqVPApIK71BlA/PApIK71BlTw7KpIK71BlheeZ:V64a5aWP1PZP37le+veiPX8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773942858, "uuid": "60037d35-9094-47f3-8ba6-72a9ab773bf3", "value": 3577856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773942858, "uuid": "b3e3efab-5bda-46f5-b982-b730742eb053", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773942858, "uuid": "de780954-6f03-408b-838e-85ec353804a2", "value": "RevitSectionBoxTrialInstaller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867690fe-239b-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773928630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773928630, "uuid": "a83aa0a8-b8ed-49f4-b914-cb89f79a5096", "comment": "Malware payload (RemcosRAT)", "value": "1f43e6e96a05d14812b120cb0ef7ea73", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773928630, "uuid": "0224db48-6d57-429a-abe9-55a39b2720bf", "comment": "Malware payload (RemcosRAT)", "value": "687d77fe30bb03ee9ea9b880953e4c2c1c452dca27d3c7953f340c055e299916", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773928630, "uuid": "b659cd39-aaa8-45ed-88a5-33ba1236208c", "comment": "Malware payload (RemcosRAT)", "value": "1a2d620bf64b9b65df80b938d8afa756a8849b27", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773928630, "uuid": "d624f08f-27d4-4454-ba10-24d9b0a4b814", "comment": "Malware payload (RemcosRAT)", "value": "7ba34c10c90253242612753d456cc43dbaf7c5550f9e1e3834b976bdc011d1718c5529bb800003f91a410b152ec9a975", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773928630, "uuid": "d1f9c060-13fa-4a49-b8a1-d81e088e2b80", "value": "T115F288A586040DCE192CFCF0F7F715EAE049794A8A98736875FACBAEA5EDE54400F341", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773928630, "uuid": "ff59098d-27ce-4c7f-ad2d-891820ae6ac7", "value": "384:cv7b/c6RiiTfY7iaXs3xuUoocGvP0YfUoVWhuTx1:qiyfzuGv3fX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773928630, "uuid": "c7fd8966-b089-4154-947a-8cff4dd75d10", "value": 35431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773928630, "uuid": "3257d36b-6953-4a3e-8d5b-669c3eddae8b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773928630, "uuid": "9d55e227-e3fa-474c-a296-5ede03a588ac", "value": "Goodthingsforbetterthignswithmebettergoodforme.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "120d78a2-2370-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773909967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773909967, "uuid": "eef0112b-8ada-4894-99e1-1f3141413f0a", "comment": "Malware payload", "value": "d26585bba5183aaf58a229796d82ea61", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773909967, "uuid": "7d404632-37a8-4b15-818d-64399072c3f4", "comment": "Malware payload", "value": "6887cfa51d87a3cc2393531076c5b7f2a0a2cd06d2fe9705c7b262e90fc26715", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773909967, "uuid": "13afa469-e204-42a4-ba47-3cbc02e725f6", "comment": "Malware payload", "value": "3a54be4ae839ecc9158062ffd3f539f575398705", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773909967, "uuid": "3a31bb5a-f90e-430c-9cec-a6b40e6c0277", "comment": "Malware payload", "value": "258e2324fd02217e8b5afbd7ab00480b233767c9b8d82b8b8ccb6c0dd18a4d94b18a91164ebd7c87d39566bbae98ffcc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773909967, "uuid": "10d80f29-abd3-46c2-9a31-5795b1de8425", "value": "T1241181DD7169643DAC119F4174928D60A104F2D75DAB9F89AC8C4D71F48B7B4303AF89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773909967, "uuid": "673128c5-cbfd-47f0-829c-33bf9e61a14a", "value": "12:GzFEIUfEE9KNI5rE+3cKrEj+kafaE+EDI/D7HFIsnIqNedIIeIJc/wWIl6I7XU:ENIGKrkAGEUb7SsIoEpc/ZGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773909967, "uuid": "4df9ba82-89b7-4e99-82bf-7f7bb7e1bb87", "value": 943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773909967, "uuid": "93a59aba-e2be-4ab4-8b09-4ff95029dbb7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773909967, "uuid": "33a3d19c-3e75-4426-846b-296b5699d63d", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b803847-23d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773955187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955187, "uuid": "edea4a0a-6575-4d7c-9194-6e73d3f50a87", "comment": "Malware payload", "value": "3a347a1d70838d885b0f5870ede0987f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955187, "uuid": "c085fbc3-753d-459c-a27d-175f38af1a27", "comment": "Malware payload", "value": "693804fcbbb4d97efbeb03d2b30f858de871460f58cfbb90e36d9042a20953ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955187, "uuid": "88cfebf1-ab23-4d9c-abb3-2014e7e6896a", "comment": "Malware payload", "value": "c491729f291b0e70ebd847b1c3acd37fd2d535b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955187, "uuid": "bee72621-c250-4b32-a7a9-0e95c708bfad", "comment": "Malware payload", "value": "c9436d4729f67af73d5c00ad2e023b77e59dbb4f2e93a5fa08c14f34389760c9bc6921c34c2fc95b98a55b71f00e504b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955187, "uuid": "62c058f5-554c-4d71-a76e-a6182ecbbd5a", "value": "T1E8165B80B708D26AD99B0A368D270B7473542D42C6F4892F430EFB5F06B16EB5A1FED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955187, "uuid": "88563958-06d7-4c7d-8e3b-7e4502ec8149", "value": "49152:4hhPlcoJwP1683e2bBlLLUNKpdv3DqtHDcSV:4HPlcoJwP16LNUf2ZIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773955187, "uuid": "89274dae-de1d-4947-9dee-dc038c160962", "value": 4194304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773955187, "uuid": "b73ab04e-a196-4b32-a893-b11a5369717d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955187, "uuid": "9034b8c3-7bab-466f-aeb8-ccbcacf613cf", "value": "linux_ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac0224c-23b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773940663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940663, "uuid": "336777a2-db26-40dd-9b16-a2d9a64f9d63", "comment": "Malware payload", "value": "004618024f447c0e452da053d6e5f5fe", "object_relation": "md5", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940663, "uuid": "46625674-fa2a-470a-bd57-35e5fc7c6189", "comment": "Malware payload", "value": "6968840ce1b13d50d13f7f0320a2e5d66bfd97073f325231edc58ec85e694b6b", "object_relation": "sha256", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940663, "uuid": "be890108-0ac7-48b9-bd67-53a21dabaa57", "comment": "Malware payload", "value": "36c70caaf924c848a1414e749eb3dba5e1680fc1", "object_relation": "sha1", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940663, "uuid": "b82bdfd4-64b4-4d7f-ac7b-9e721ef3bd31", "comment": "Malware payload", "value": "df802b89a644971ec6180667d813f66a413095b4268378c4b88c1b083ab616c89feb251cd3830dd1246ff4f5648a9c2e", "object_relation": "sha3-384", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940663, "uuid": "2671b75a-41a4-42ac-a210-b573c3bfb60f", "value": "T1CEE5F13FB28B753EE06E5A363A76E210593B766165138C0696F4C48CCF251B02E3E797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940663, "uuid": "fe3a437e-ef3f-4739-bdc9-1260ac47f5a8", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940663, "uuid": "d564e0ab-5d4a-465a-a083-52a6e206b27d", "value": "49152:8uI2hr90idpAxxpj6u81fv+OhZqqb0O5InGZmDV628y8YVK:85OSidyxHCfvnbt0O5InmmySVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773940663, "uuid": "0b5bcc17-dd87-4d83-95af-f2654af03ff7", "value": 3264224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773940663, "uuid": "d15d4d30-f18e-4a8d-bd7c-471ce67fa30c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940663, "uuid": "4460431b-8190-4d68-a758-b4e499c5c2a6", "value": "6968840ce1b13d50d13f7f0320a2e5d66bfd97073f325231edc58ec85e694b6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ec16eb-2379-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773913807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773913807, "uuid": "b6eb4e1f-16d8-4d33-bd04-924a3d36215a", "comment": "Malware payload", "value": "70258d8f13b735fef2306773ee501fcd", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773913807, "uuid": "d30c96fe-182a-4bb6-b310-c9ee8db3b6b4", "comment": "Malware payload", "value": "6a906991bdce2b745a5d5eb9fc7c98e9e3637472e3f5520a76c4a7ee41b160c3", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773913807, "uuid": "e6817a32-be76-4899-8c3b-0cb0a32350bd", "comment": "Malware payload", "value": "24f12722d3ecf0438d203b9291b6d103cc9271fb", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773913807, "uuid": "3acfe50e-e1fe-4080-a7aa-d90b7a2ae098", "comment": "Malware payload", "value": "2091b7ab02f439b86e773278d7300b607bdbb71c4ad00e92e704e36476f0511f969876db6deca47aabd8f5999f09bf06", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773913807, "uuid": "05354fb2-af13-45a6-9d66-4a55616ce741", "value": "T1CBB3FE8B698EC5ED8FEF7058452E9E02D6AF5302051DC5A03A5EAE443F22CF772B85D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773913807, "uuid": "56f9fbd7-ffc9-40eb-ae51-3ae33e620b4f", "value": "1536:a37Ezfj3xjTEMCRT+6+n+3Mb7ITAd6dScUdi:3iRyh+KITb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773913807, "uuid": "f0f4a517-787b-4861-804a-9d8eee6a46bc", "value": 114616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773913807, "uuid": "af678297-786a-4214-b366-56c9b2d9fd6f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773913807, "uuid": "6536ed04-0e15-4695-8f72-ebcd2b0d9acb", "value": "Session_Primary_v3.9.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "079b96a7-2354-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773897923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897923, "uuid": "92d9b676-15b8-4243-8e16-bde99f1f2a1b", "comment": "Malware payload (Vidar)", "value": "416eb2fea925ab037bfa7b66a3e0b097", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897923, "uuid": "d554c86b-25bc-41b2-bd07-24bdb51447eb", "comment": "Malware payload (Vidar)", "value": "6abef4b0de5a7a2168ec4bb1b923c1961a8e90777ab6932883750f46c11d8f99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897923, "uuid": "172fab56-093d-43bc-ad95-5922b483935e", "comment": "Malware payload (Vidar)", "value": "55f20ada3fc75d51567c7b58dd49f7e7ff911674", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897923, "uuid": "abbdaead-85ec-48d2-9ba1-0b40a69260b1", "comment": "Malware payload (Vidar)", "value": "3d5651fb3ff2eb68d606ed888537dd67c32643fdf8f148fde89f2c553a0f8d5402f251b0d305f18c01bc4f7359dfc677", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897923, "uuid": "92f7c863-3edf-4859-9f3b-b4c2d7f634aa", "value": "T1EC959C07BCD460B9D5A9D23689B452A1BB30F85E0B3037C32F95A7B92E7A3C46E35354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897923, "uuid": "7653f4f9-eaeb-4e56-b37a-95483e47f6ec", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897923, "uuid": "a7ddc6b3-0feb-4fed-9791-a795483f7a7d", "value": "49152:McG9+a9FhKG2dWtVooqJ2FJh7E0r9n4afbKMYgt7yK1Y:Qlh7E0rCaf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773897923, "uuid": "a555cade-052a-46b6-9c9c-6bd5b23e0946", "value": 2031616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773897923, "uuid": "b48de10c-8907-4f7d-9e65-3113d2386d3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897923, "uuid": "2716c3b2-7b0c-43bc-8ae6-56d95c46898f", "value": "Bootstapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa964baa-2395-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773926248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926248, "uuid": "07f732f0-9748-4be9-84c3-7617a68eb00e", "comment": "Malware payload", "value": "c43220b3981d1136f9863ad25f931708", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926248, "uuid": "09844399-04ce-43ce-be4c-9fc06dd47563", "comment": "Malware payload", "value": "6cbc61d7a057cfde41285baed5d13ee98eeae188113b6e35023432c4ee8a03f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926248, "uuid": "38be7809-42ef-45ab-b371-67fc9d42ec70", "comment": "Malware payload", "value": "b4f545b7c122c21c5c9663268ff47e84fdcdd52b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926248, "uuid": "74f48b1b-8f58-4b01-ba1d-0f9189b80a8f", "comment": "Malware payload", "value": "b9eec920c82d9aa3c99f97ee8e5fff20899afb7f2131ee3e4a9cbb1f9fd6cfa4b10a5840e318c70a678c9e4539d42e07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926248, "uuid": "64685c7e-d203-405f-98c3-1186f58c7421", "value": "T19CA3D60E6BB2E0B8D6A3E075CE675A4BC3B0F4F52737759BA7700D452F2AB50522DA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926248, "uuid": "8750c0ba-ccea-4f64-96a5-87f61c6149cf", "value": "1536:YweNCIYml3VcA0j3Yu4ISfZa/ZVmuFdjzH3aT1LaiNO6x5Jup0xw4x5HNb:6/FAnFuUVm2XUac5JPw4xL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773926248, "uuid": "1893a9a1-660d-4bf6-9c05-32d15ea6300b", "value": 103996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773926248, "uuid": "e610d965-38e8-47a1-861f-f8e5aacdf11e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926248, "uuid": "d61b8f9f-9663-40bb-8d1c-9b04468dfd3d", "value": "c43220b3981d1136f9863ad25f931708.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d05024-2388-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1773920657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773920657, "uuid": "83666aef-5d0b-4f97-a98d-f501bc7511fc", "comment": "Malware payload (RustyStealer)", "value": "bfa4e9f01c50d45a5b9f8afed82d62da", "object_relation": "md5", "Tag": [ { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773920657, "uuid": "370ea4b7-c59d-43ec-a953-851fc7c09c83", "comment": "Malware payload (RustyStealer)", "value": "6cdf8b25ab5a52efcbcf21d026ca0114515aec69de1cbc3a142f2a96782c4461", "object_relation": "sha256", "Tag": [ { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773920657, "uuid": "8978af3f-1ee7-483b-b803-d65ef65db86a", "comment": "Malware payload (RustyStealer)", "value": "47eb8f5992daf4947c7c330cc71696c1cf21f84d", "object_relation": "sha1", "Tag": [ { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773920657, "uuid": "5af36e9a-e7dc-4f41-a864-3900a9c7cfce", "comment": "Malware payload (RustyStealer)", "value": "f9f1c163ad38e2b276a940d69e99b926d08207a7c04c2896163434be5e636e56b1fab4e9ec31d76640e6eb1f4e812c76", "object_relation": "sha3-384", "Tag": [ { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773920657, "uuid": "5eb29123-6f26-44c5-b70d-22c2c98fca3a", "value": "T17367336FC5BDCF628034F278AC618AD7B4667892798F4B77734B068846142338977E1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773920657, "uuid": "8620fe2e-7c48-4ae3-a07b-e84b376edbd3", "value": "393216:CEtWUT4yvKrpimwiibxcJxNl5VES0CzVsGeiBz6NqIX+nWWDL5aEJO1z1AtSldN9:CyFxcJ7l5qzAfWSn1DlE1UC+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773920657, "uuid": "c46f0e26-40fb-4553-8475-7e70b3af4676", "value": 30399248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773920657, "uuid": "0d0bed25-2fc0-48a9-901b-bbde368f4d82", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773920657, "uuid": "75849a64-144c-45c0-a746-502a1e1b842e", "value": "binfolder.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7715d74e-2373-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773911425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911425, "uuid": "2028bbfb-db28-4163-bc97-c126754f1001", "comment": "Malware payload", "value": "61a614cfd58c0363b05138fdcec766ea", "object_relation": "md5", "Tag": [ { "name": "Chrono-Orion-LTD", "colour": "#D76FE9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911425, "uuid": "42e3aac0-4b16-4397-a99c-63a85cf209d6", "comment": "Malware payload", "value": "6ce7e2b638a01cea1bb78d754ad5a66bac5e8f78b103aad720db8cc34cd62d6c", "object_relation": "sha256", "Tag": [ { "name": "Chrono-Orion-LTD", "colour": "#D76FE9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911425, "uuid": "5053c94c-1df9-4ab2-8414-bace7e8476b0", "comment": "Malware payload", "value": "4e7afdaaa8884d5fc6c3b5a2e5144ef1df683038", "object_relation": "sha1", "Tag": [ { "name": "Chrono-Orion-LTD", "colour": "#D76FE9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911425, "uuid": "f3b41327-af06-4644-a827-c8d2fbdbb86e", "comment": "Malware payload", "value": "8aca7710300552f344ef93e0c53c4629559b5ece2e691f309d5cd77faacef1ee2f22513e9d88f946b99d84a4b8308a5a", "object_relation": "sha3-384", "Tag": [ { "name": "Chrono-Orion-LTD", "colour": "#D76FE9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773911425, "uuid": "593ce5c8-0df5-4156-b3f6-e7988efe5615", "value": "T1C3636C513A600630C7270DB474A6CA3B19B2BE11A9909F4864DD3C4DFEB3B459B637BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773911425, "uuid": "4302bcc4-69a6-4762-9315-7518e407e8bc", "value": "1536:FmSo5Vw6N57RFZBjA4U7Ns3+Bj5PRVwMpqiV+:FmSoB7RFgfs3CPRVwGqiV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773911425, "uuid": "7547008e-97b1-464e-a7a0-f7cc6b808697", "value": 72408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773911425, "uuid": "5a4df7ca-5eec-46e5-80c5-3aa0b25b7666", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773911425, "uuid": "b15c193b-77b7-45d4-bd17-5e494d7b1357", "value": "ZipSphere.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9fabbbd-23b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773940716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940716, "uuid": "1d52144e-09a6-49f6-975e-5765c30b0336", "comment": "Malware payload", "value": "3ea6097b467a1089feacc0c1315ca98f", "object_relation": "md5", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940716, "uuid": "cba76868-bba0-420c-8492-6bb9e32e4c8e", "comment": "Malware payload", "value": "6d9cbd7fbf5a266760ff49defe0d47546b035fe1a31ebb134e28a3364b82a84e", "object_relation": "sha256", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940716, "uuid": "1dc199f2-4e29-4dfa-b423-e11bef83cb3d", "comment": "Malware payload", "value": "fd8ba5166b7fd87b17e8348bb2b998aadfa4dbd5", "object_relation": "sha1", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940716, "uuid": "2534603c-8092-4965-9b57-a6a222e6a524", "comment": "Malware payload", "value": "3673a8fa9ebca3390023b237f99bc8d1be713601759ac6a0140dd56db6504556e046ac0c95cacbb99310d1d48c8e9e90", "object_relation": "sha3-384", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940716, "uuid": "cb241405-3c9a-4afb-afdb-e0ef86b6a028", "value": "T13FB5E03FB28B653EE06E1A3679B2E210593B766165128C5697F4C84CCF250B02E3F797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940716, "uuid": "af469862-3189-450a-8530-b0435bb90f0f", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940716, "uuid": "39ec8af9-a8ff-4181-beec-9278bb9cad92", "value": "49152:+uI5hH3ILdFM6OZBxsJ3W6myN7fZVNKttwwo2:+5/H4cXaRW6myN7f3NKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773940716, "uuid": "ea898be7-36dc-49fe-9f6b-cb1abb25f10c", "value": 2396032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773940716, "uuid": "c001da0b-0011-4965-8a9d-b5b6549b8cad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940716, "uuid": "ea88f32e-1d1c-4376-8a3f-86752140103e", "value": "6d9cbd7fbf5a266760ff49defe0d47546b035fe1a31ebb134e28a3364b82a84e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a7a661c-23a5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773932744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773932744, "uuid": "94d01394-e85b-48d0-934a-ae4725dc47e8", "comment": "Malware payload", "value": "0ab22abd7d9cb56a9ceaec15e29f3bb9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773932744, "uuid": "3156ffb0-beca-4aef-9f1c-9e84452b633b", "comment": "Malware payload", "value": "6e3c2366dba38e30a74c7d1a8790b55aea70c7da252e12fbf9d7d055911ac036", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773932744, "uuid": "bf73b6fc-21a5-455d-9842-0947f2c685c5", "comment": "Malware payload", "value": "5047fb8b07221fe7323b7b382b1e3e7307bdbfb3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773932744, "uuid": "eb4d3ac8-4329-4159-8891-50e15372145b", "comment": "Malware payload", "value": "3532bcb5f4bd56960fa2f3c229e3f7d1b33b682d1952bf08631aeb340ac374f940662391608d6426e3cd912d2703cec3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773932744, "uuid": "164f8c85-8a0c-4cad-b3a5-f6b938f5974a", "value": "T170F6BD23F6056996C9D6A235F1E3279136301E540793A279170FF02AFDF25CECA66EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773932744, "uuid": "3e6eff06-e0d4-4540-bab5-14411637813a", "value": "196608:yqNsdyBLhySLvT19YWDvpaanz4jN8aqBu8/EriR2l1UrW0q9EWSWf/HmIJK3KSs:3Ns8hrL719fxaanzrR/2/gBq9EWfx83M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773932744, "uuid": "96219b22-098e-4460-aa27-638ee6f4b74c", "value": 15861309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773932744, "uuid": "7c2841e7-ea1b-4c3c-b02f-8850bc19de57", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773932744, "uuid": "4e270adb-a844-4f90-ab24-cde1d69f8964", "value": "malware-1773932618999-993385229.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac7f7b1b-23ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773936855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773936855, "uuid": "30a9b5b5-9220-4201-a69a-bb4b885096e7", "comment": "Malware payload (Vidar)", "value": "bac25a3663212a1fee3c1ad6841ea3fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773936855, "uuid": "e4c87d56-578e-4002-9f00-e64e2347f7ea", "comment": "Malware payload (Vidar)", "value": "6edd176ef62e59a551e81077789a35f2fffcf407c9471d8c6bc5a689c0d3b7ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773936855, "uuid": "15813a48-01f4-4ff6-9fb9-36b35c9dbc3d", "comment": "Malware payload (Vidar)", "value": "f3b8add234898157996fbb972375c5419b57ade2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773936855, "uuid": "9642b2c9-0786-4d60-b8db-36a90c536b8b", "comment": "Malware payload (Vidar)", "value": "1beafb4bbcda0372dfde823ead506862e013c286e560d5655f05ce7628693fa48ce52171b9e1dc5feb9b41f3281fd92e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773936855, "uuid": "95f13e3e-e71d-4faa-942f-01d5db238a94", "value": "T17E958C07BCC061B5E5A9D3318AB512A17730F85E0B3137C72F55AAB92EBA7D45E38384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773936855, "uuid": "f42d7651-ea7f-4812-a51d-6f55926f5d1a", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773936855, "uuid": "dad922db-62ea-421f-92f8-e325e0c84e2d", "value": "49152:tHNLNPVoBTNXYabjFbGQWpj3WYyWV97MYgtddK1:sTkWYya9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773936855, "uuid": "981cdcfa-1f8d-4c5a-960c-076eb5bafca9", "value": 2015232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773936855, "uuid": "b19d5ad6-0157-478d-ba73-a3d36bab2804", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773936855, "uuid": "c8b45c45-883e-45b0-b5c2-42c326524e29", "value": "Mod Menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f8f7ac-23ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773936392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773936392, "uuid": "3d2459b1-448a-489f-9a2d-289acfc2053e", "comment": "Malware payload", "value": "d33f7ad3bf556a379c645165b0510fbc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773936392, "uuid": "a103740c-6351-4935-a69e-23c060d66671", "comment": "Malware payload", "value": "70ac98c82b585a84c91afde9fb1199d74776639575b998db7d97f83758be6821", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773936392, "uuid": "3f9c15a8-d0e0-4439-ab40-f7d399cc1dbf", "comment": "Malware payload", "value": "57913c514d635735c58debba54465fbd5dbccd49", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773936392, "uuid": "959c5f5a-9893-4722-af2e-378cf5da779a", "comment": "Malware payload", "value": "75517f38c5501f6ff4821da552c2fc6394ae5c51c13e9df749139e9980ea922bc5e745d07cdaf3d2f71d94b09d9e5395", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773936392, "uuid": "62f61880-713a-4aa2-a3af-6125e5a2eeb2", "value": "T123925BA916496C79BBC0CE799F3C7F0CADE8C1C02218A39CBA4F39714A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773936392, "uuid": "8786937a-a144-4f3f-90a7-99b0ca3195df", "value": "384:+50M3vgRjGlsaq76zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:+5mjfezsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773936392, "uuid": "2af52126-5c8d-4e50-8aa4-b1b0e00b612f", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773936392, "uuid": "bb05ffa4-ef32-43e0-bebe-8613f74efb67", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773936392, "uuid": "712df36a-79db-4dc0-b811-2f94a2f65206", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ac0692-23a8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773934083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934083, "uuid": "8b03d044-8eb6-4eb3-a464-f1ca1b8d9afc", "comment": "Malware payload", "value": "3c553b52c0e537a88cc3f0be1a9447a7", "object_relation": "md5", "Tag": [ { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934083, "uuid": "47e21496-4fd8-4c1d-bf00-8f0e0012140a", "comment": "Malware payload", "value": "70e6b03474eef49b86b7b70efe1e2ae8e69ec4227b10ef7f74f72bc98f1d0312", "object_relation": "sha256", "Tag": [ { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934083, "uuid": "c204fc11-16d4-49e9-a6b1-b20c317ccb65", "comment": "Malware payload", "value": "10b51960f7533db0ef66f005e36fa842d1f9e63a", "object_relation": "sha1", "Tag": [ { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934083, "uuid": "5671c29e-7ca1-4849-ab75-a6b09e0778cd", "comment": "Malware payload", "value": "29993a6c91faae53895ac95b7ea6a6537e7d04ff9d2bab46107f8629c9c42bde6a9240ebf4fa19454197d90746222af9", "object_relation": "sha3-384", "Tag": [ { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934083, "uuid": "7dbfdd23-7ccd-442f-9677-a043d840cd9a", "value": "T161636242ED69B8158397D97A8813E5432A1A7D47460D1C38BBFCA1686F0833987F5EFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934083, "uuid": "a8086de7-227d-4dc3-a1ae-e40e14ac434c", "value": "768:164lz3kW4GKW5lS0dlx7w7UV2DsW0DTN+ZQTr2ox4oRVCnB1:1xbcRW5lSgx78rDsW0DrTr2ACn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773934083, "uuid": "570b71d0-c90f-4b5e-b648-518071ec34af", "value": 72455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773934083, "uuid": "c8e87d53-4f5a-4899-9af3-35c7083b8968", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934083, "uuid": "32ad0a13-95d8-4a33-95f5-3d2feaf1a372", "value": "liushen3.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe55352-2395-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773925962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925962, "uuid": "9e37c19a-9b90-4189-81a0-33e575fffb49", "comment": "Malware payload", "value": "121cf5b43a3bda615bd142169d5df6f1", "object_relation": "md5", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925962, "uuid": "4fa97204-10b8-4a58-bc81-311cdfb94bfa", "comment": "Malware payload", "value": "719d6e90d36b098e650cb8bd6c617ac929613705b49b34935bac74f0298cedfb", "object_relation": "sha256", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925962, "uuid": "76dc67d2-f055-42ad-9f4c-ce173a98f5f4", "comment": "Malware payload", "value": "08e8ab926e82d81904f2193b5e833e8153bc845e", "object_relation": "sha1", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925962, "uuid": "118ea432-1795-4a6c-b696-a072dbfb018e", "comment": "Malware payload", "value": "98512910bef04f24f503bff09542729846455baa76787aeb3923ed86ba18f98d2d35d46fe815e5ee22d365e34cc891e9", "object_relation": "sha3-384", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925962, "uuid": "5f5ffd4a-1287-4e23-866a-277d20804352", "value": "T13C544C0627F42102EDBBCD791CB191330A38B16A8E21E5D538AD505C4FB3B57963A6EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925962, "uuid": "da7958af-7f1d-408e-ad69-848e2bd2fa9e", "value": "768:o8fzw0GGXbW7Eu8p9RjQrE52U2fr0DnJEFr15ZfKIqJjjiK6SMtiViBdqTRNrtYh:o4XbW+9mg2U2jin0WvyhMLmYBltrpvs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773925962, "uuid": "0e332a2b-6b6c-4197-8bec-41192bfbfb5f", "value": 297176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773925962, "uuid": "25669b6a-4478-425e-bc03-acaad5fff64b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925962, "uuid": "525b5909-455a-43fc-a1b0-a22364b4e858", "value": "719d6e90d36b098e650cb8bd6c617ac929613705b49b34935bac74f0298cedfb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "961164e4-23b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773940682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940682, "uuid": "8a02e849-11c5-4d97-b27a-71ce3c1982bf", "comment": "Malware payload", "value": "c13e2b5f31a1c7acd208adc27edb2690", "object_relation": "md5", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940682, "uuid": "d2d92315-294b-4f96-becb-bdfaa06de523", "comment": "Malware payload", "value": "71f7f0e2f384415cef81e600040bcb40aca574c873c813e8b35589a44f6ab6e8", "object_relation": "sha256", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940682, "uuid": "0c391ee8-6a26-4bd3-b556-d0b7a782ef29", "comment": "Malware payload", "value": "50561b1e7833a60a73aeb9eb444b47cf66a728e4", "object_relation": "sha1", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940682, "uuid": "51b38059-aeb0-4039-b35e-c098fcc5e858", "comment": "Malware payload", "value": "e2bedfa9b1860acc9a5dfca7efb0b1edc66500c12b1b0191934e34ae494afc7aa084a8c6af6c4866c6d76e7c40462cab", "object_relation": "sha3-384", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940682, "uuid": "69903e71-aab3-4c78-852c-07678cee0309", "value": "T156B5E13FB28B653EE06E5A3A7972E210583B7A61A5174C5696F4C44CCF250B01E3FB87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940682, "uuid": "e86e5891-91bc-46f1-8009-e3d2e1f4fb38", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940682, "uuid": "2e4a56be-8b05-4452-93f5-6b90c717f776", "value": "49152:tuI5hHGmvWEtJ9cC7zRbj1lnVwlw3YojwZrnP:t5/HGmvWEz99nXnVwKONP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773940682, "uuid": "2d9930a8-29cd-416b-a38a-cf5a38e9ecdf", "value": 2397824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773940682, "uuid": "e427a5bc-cad5-409c-a117-3080695b2978", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940682, "uuid": "e42fa260-3797-4f0e-8aa6-d76852c7ffd0", "value": "71f7f0e2f384415cef81e600040bcb40aca574c873c813e8b35589a44f6ab6e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d5f89d-23c3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773945616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945616, "uuid": "708d9a75-878a-4439-b723-3c468c137c31", "comment": "Malware payload", "value": "bd1be1405c91d5341b16543d8a9df96a", "object_relation": "md5", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945616, "uuid": "470149ba-bd75-42ba-962d-9d924f4103b6", "comment": "Malware payload", "value": "7381168897d8d09b8570c8cd2efbf7f4209d1bfd4935360d6deecf77b562a7fa", "object_relation": "sha256", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945616, "uuid": "95f836cd-b020-4264-b040-529ca7cb8169", "comment": "Malware payload", "value": "1e38587e69d033a0e7ba265b5b89ac351a672774", "object_relation": "sha1", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945616, "uuid": "d80289bb-d3ed-4607-822b-823d09453645", "comment": "Malware payload", "value": "1b2c3e1b594578d5a06333c501e20012e2a2afd45743ff2c54f8daa3592f9d43d2ad336bbb2f3cf37d8b8f46090143c0", "object_relation": "sha3-384", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945616, "uuid": "3eada1cb-3b5c-4f27-b90e-c49d34384be6", "value": "T15251ED0A97E80A6BE8A70730AEF3475627B4FC515F72536E09C00229AC617945A72FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945616, "uuid": "b899ede6-a29e-4af2-89a0-6c38274ff33e", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945616, "uuid": "ba221ff9-70f0-4d7e-9113-781ef27dc329", "value": "24:etGS4fB2JuwALu8zigklnlKeoUg2tkZfA5zI3LEWI+ycuZhN7qakSQbPNnq:6nMwARziLltNEJA5zI7n1ulea3Kq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773945616, "uuid": "b83a28a7-1fb2-4ab8-93e1-e3658b7a1e27", "value": 3072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773945616, "uuid": "1598feb6-870a-428f-baf2-45b45809b434", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945616, "uuid": "4ee2103d-7712-4c67-9cd9-a783b0c4eb17", "value": "zhx2mtun.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f01435-2373-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773911502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911502, "uuid": "1070026a-4c8c-4e9c-89e3-d3f9721c64c4", "comment": "Malware payload (AgentTesla)", "value": "daf5ca401a8e354b37b82110d9e63908", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911502, "uuid": "702753a5-5e1e-4335-8b57-38260f4af0f1", "comment": "Malware payload (AgentTesla)", "value": "7405451ae98a7a3268b37e7cf8dca5ff70c3bb2f48dfc4e6d023a3079b4df7dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911502, "uuid": "bafcc7dd-2260-466f-af0c-2fb506c5af73", "comment": "Malware payload (AgentTesla)", "value": "58a156c13c01a9ab4104bc42bbc00806177f3670", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911502, "uuid": "d365f3de-91a6-4667-b275-b5802fea19d4", "comment": "Malware payload (AgentTesla)", "value": "c051c581264843a0a76b1661bad51eda45a10cbc01feb397db1353b4736932424e6207fa4bab9a8ea26fd55768423636", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773911502, "uuid": "0299f44e-8de1-4cda-bc15-512d4d3d96f4", "value": "T181163B88F48886447C176D71BB50F0E146E626DB7D86B503E42F66B1FBB71E2F821227", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773911502, "uuid": "24bed68e-629d-488d-bf03-3c00eff80d2b", "value": "98304:XQsGDI8Jf0yfreUXXPdR/EwBr+JBPydBG0hJ56sQwxj9pa4dkfYCNi7drUkCmejL:XPMlreUXFRDrcBOG0hJ56sQwxZIcG7ND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773911502, "uuid": "7cdd8e67-b687-4de5-a878-8cae8342a6ad", "value": 4183709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773911502, "uuid": "fc3c121e-59a5-4d7f-afce-aed982f76b3f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773911502, "uuid": "50ab9c8e-0b02-408a-98e4-17a85e3f8929", "value": "MINUTA DE PEDIDO BL.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "485db4b9-23d6-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1773953866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773953866, "uuid": "87f03794-f19b-4046-ae9b-f2a9b53c2820", "comment": "Malware payload (a310Logger)", "value": "c75d8f2e260e4352763d6b14a4ec7ce1", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773953866, "uuid": "e43e4535-1ce4-4ca2-9575-c5e603edd1e8", "comment": "Malware payload (a310Logger)", "value": "7453b269f3a38abda3d9e99702036f5f546ceb83108371693f3f62780e07ae5d", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773953866, "uuid": "f19537cf-bd62-47f2-a2df-18372b2ee192", "comment": "Malware payload (a310Logger)", "value": "af43799de6b10109f99789cfd2e719db6d091f2d", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773953866, "uuid": "52814b42-4c3e-4b4b-93e1-cb2dd2b7686e", "comment": "Malware payload (a310Logger)", "value": "c9b4d13e0f4fad855c515ad445eb87ecb34c7351958d3bd1817b6d96deb27d82c3eb80eaae9fbeaef18c6a6047a22a4d", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773953866, "uuid": "71baed09-803c-48b9-8973-2a8a0728f6d1", "value": "T1C9B5BFA7ADC02FBD5BF9052905DBE60E47D05A9CA036B89AFBB31A46E712D071F0704D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773953866, "uuid": "d4107dfe-c270-4e8f-b208-55ad6cb1a2a2", "value": "24576:GfG+hN0O/YEo8c5ID8gUrsiQkWV4i1CXG+7iMWCTDKm+PXQXFy0m0aEUbAvyUujq:QpXOsi9hM83x1ylD+mmWQDVxq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773953866, "uuid": "68460705-417c-45a2-9d58-a12f57889d06", "value": 2453647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773953866, "uuid": "24a0f1a9-c3d0-4b58-8a9f-91f754510f2f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773953866, "uuid": "a93b5c87-e747-4d34-bfd3-1f0dc8c86d25", "value": "Error en los detalles del pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ade66f-2396-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773926352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926352, "uuid": "b031c364-0c33-41c4-b75c-0a9333d253c9", "comment": "Malware payload (ACRStealer)", "value": "a42531b020a3f5f1adac3a962e9e92b0", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926352, "uuid": "efcbbdcb-29e0-4d56-9204-26d6d31bed6f", "comment": "Malware payload (ACRStealer)", "value": "7504898b17a9ce05eb9209128bcd0fb67d675a70c8c64f6f624d08b47b2fe3af", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926352, "uuid": "be6490be-31ba-441d-ad80-8f9bfc7b3bf5", "comment": "Malware payload (ACRStealer)", "value": "a8018c33a9c7cc594f6fa44c33ee83df804e6b6d", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926352, "uuid": "57c77ce6-3bd6-4317-98d3-92f50fba3799", "comment": "Malware payload (ACRStealer)", "value": "e401a3a22b700b99e58c3e440431ec6ed32a2800126881306fbd1cf410bf11956c2d46b0903f340d20a9b87fea635422", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926352, "uuid": "9018a0e9-f5f8-48dc-827a-d0a847970935", "value": "T1A395E59972C57E2382A3017748ABF48ABE351A63101A9C2430ED7D5B7F7F8A563FB051", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926352, "uuid": "b458b9e4-4f58-4c9a-9629-e27de7d0cd34", "value": "1ae8142a82e1327fa8af7223c40e667a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926352, "uuid": "68dcd697-ce67-4321-ab67-efb588245369", "value": "12288:OMH+TGNFGwiVYwJEab9J+QNC73bkFxRADziFV9s+eAzv7jrtqeqMIrfCeO6pkpi/:ZHIGQVt+1bkdFV9s+jz7IeeO1p0OkwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773926352, "uuid": "d102dfc7-e860-4df2-b3e8-1e812c348c0d", "value": 1952256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773926352, "uuid": "c829c69e-ea26-449d-baf2-0176d3e455a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926352, "uuid": "f867b363-1958-44c8-ae63-58613040a1e6", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25d0a54-233e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773888761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773888761, "uuid": "d9c04048-1442-4b3a-ab59-de6109e954c9", "comment": "Malware payload (Mirai)", "value": "0be19cbb03ba099bcb9844d7b9844ce9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773888761, "uuid": "f8240490-20bd-4b9e-a5e2-e03a73f529e1", "comment": "Malware payload (Mirai)", "value": "7654d7047ed0d45af986d7a83857fdee4b6f4531a6b43672f9381f723ffb3e27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773888761, "uuid": "8ccc84f6-f46c-443c-89ab-72d368d54419", "comment": "Malware payload (Mirai)", "value": "6b058fd093c47d1a6703edcd969bdb4cb42a6c84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773888761, "uuid": "68e1813d-65f0-4a62-b58b-828be926b9c9", "comment": "Malware payload (Mirai)", "value": "8a622d47f7f0c9bfd7447ba3977b7cfc372876918aa2d37c0f75a171241284776751b9b3d90a4d3803548aab1ce6a235", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773888761, "uuid": "c3290e9b-6d97-4b4e-826e-31958d2cfae4", "value": "T1E1A33A82BC819A22C6C15277FF6F418D371613BCD2EA32179D295F6177CB81B0E6B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773888761, "uuid": "3bbd6583-1343-423a-928d-114553a9bd3c", "value": "1536:CQsxPosSIzq5zZUS/4EGvSxDxJykgBdnhLR+fZt5xKBWHx6GO+GY+3fOza1js/gk:CQsxAsLUv4nc1JGpnctT9x6n+G1E/0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773888761, "uuid": "55a93743-e163-4808-be7a-23125ca9cdba", "value": 103668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773888761, "uuid": "b072bed4-5ad2-4c23-b608-37bba5c8de5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773888761, "uuid": "09a50edd-ff74-4932-b103-2a2d97fda9d5", "value": "tux.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df33c4e1-2341-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1773890124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890124, "uuid": "e6109355-2cb4-470b-a04f-324535d63132", "comment": "Malware payload (njrat)", "value": "0d97687f06051fc7900c77e67d394832", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890124, "uuid": "68d2a373-6426-4674-bfdb-cd9d3b1df378", "comment": "Malware payload (njrat)", "value": "7664f463cfd7031ca968874e15d96434423652884530be895d5e813d85002656", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890124, "uuid": "a9b11b22-7ad5-46c1-817f-8546ea6eb083", "comment": "Malware payload (njrat)", "value": "c9d9ed8113ca450af92aab20c391286995a68b08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890124, "uuid": "382cf032-8318-4889-8735-924c9707344b", "comment": "Malware payload (njrat)", "value": "0444b2b5d48a65b213404657fc9379cb0762a69f0592d53ee978b307ff7e4bc8d4962aa4a1111cd0fc6946894aa9249b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773890124, "uuid": "cf6ee654-8068-4417-9d7c-2867afc5f91f", "value": "T15A033B4D7FE18168C5FE457B06B2D01207BAE04F6E23D91E8EE5649A37636C48B50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773890124, "uuid": "7683812e-798b-4b3a-ac76-8a71a18fad3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773890124, "uuid": "fbf91a05-b957-4490-aa22-5fc9fd795542", "value": "384:B/uAbsiDtT95hL5YyUvrZvZO64aiTPlrAF+rMRTyN/0L+EcoinblneHQM3epzXkf:zBv5zUvrZj1iblrM+rMRa8NuaFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773890124, "uuid": "522611c9-71fe-4c13-a92f-2af686052fcf", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773890124, "uuid": "932dde27-949b-450c-8be4-a7b9a2b8a5e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773890124, "uuid": "2056d2c7-e762-41e0-a342-485b123a0737", "value": "0d97687f06051fc7900c77e67d394832.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58401748-2395-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773925976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925976, "uuid": "437b307b-3e26-44d6-aae7-9f8f96c8c17a", "comment": "Malware payload", "value": "53cc148127e339266528e19626648c38", "object_relation": "md5", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925976, "uuid": "5d196de1-17f5-488a-a0cf-eeaf4783b0a8", "comment": "Malware payload", "value": "7683705d0a9f000d8e14bb3214361f860484309c9f5bf2fad2f08df42ff9cb45", "object_relation": "sha256", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925976, "uuid": "ea52101f-41c1-4931-a8dd-0c1ae1d1ee49", "comment": "Malware payload", "value": "8833c8a7c440a183d44843bcfc00c93c9c62ce87", "object_relation": "sha1", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925976, "uuid": "3c2d7cd3-f418-4a30-bff5-5d9e28f016e9", "comment": "Malware payload", "value": "133bd2dd61a17241dfdccb40ea323cb2a89d1912b2a5301537d9c4985ac3ccca4be8f7174c41e9482d98c346c3fd3723", "object_relation": "sha3-384", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925976, "uuid": "c61103c1-435f-4b94-9872-868b014d8a89", "value": "T157541B0777B41002FDB7CE791CA190320E3BB19A8E36E19538AD505D4FF3696522A7AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925976, "uuid": "b4770ed8-4261-41d0-a5a8-1bc3fc4e2165", "value": "768:RL4i/EuwL8C9h6opjvr0DnJEFr15ZfKIqJjjiK6SMtiViBdqT6LtYcFmYB6KFrjo:b/HoOoRin0WvyhzrmYBlFrpvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773925976, "uuid": "a196f518-b9b8-48bd-9d69-dc3aa6b8fe88", "value": 294616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773925976, "uuid": "c79417d3-39c2-42d0-8a9b-c8565161b964", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925976, "uuid": "4d955b78-114e-433f-8717-2d5b89f80cc1", "value": "7683705d0a9f000d8e14bb3214361f860484309c9f5bf2fad2f08df42ff9cb45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb33aba9-23df-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773958032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773958032, "uuid": "aad8f6db-9c80-4f43-b9ed-4d84a05489c7", "comment": "Malware payload (ACRStealer)", "value": "7a18f7efaf0b41f9d6c965f90804bc8a", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773958032, "uuid": "771939f6-84a6-4a70-8943-f9bbaa3c409e", "comment": "Malware payload (ACRStealer)", "value": "76b4bbae58a2d240553c01fa0ae950527fb3009f983aceaaaa71649b4cdb4a7c", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773958032, "uuid": "a2a863af-069c-4828-acf1-7b97f09bb5a7", "comment": "Malware payload (ACRStealer)", "value": "74362cebf0d0273deb88271e995f2a26e4da2d2d", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773958032, "uuid": "5b636030-f0bc-4405-9bc3-4e69da9d2323", "comment": "Malware payload (ACRStealer)", "value": "ad04ffb2455e28098afcc0cb4c14069c8f4f3a4388a4cfdd2e307eb283d316e78e0d8cc725dab12c9fdb62bd304b84f0", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773958032, "uuid": "a4064352-dd10-4a3e-a506-8811d33fc4cf", "value": "T1B495A312ACC58C92CB760D7ABA693C026A3ED9F702996DD970DC3A4F1D7385419F70E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773958032, "uuid": "afd34132-a79c-45a3-835a-225a7f9c8093", "value": "908c5e23d919d3969baddfd089009e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773958032, "uuid": "3379c0b0-044f-4955-ac5b-2becbc3dd291", "value": "12288:YaBEvdnfjWRzB1m6z84+yAp5LeX+lDlTnZO2HeO6IckTvOFZvnoVlxORV4mkZEAj:V0wBc6SjeXRmTWvV4mkZEAb+o/gqE5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773958032, "uuid": "bb402686-0c61-40aa-804d-179e2ec73ce7", "value": 1946112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773958032, "uuid": "6c4d79af-e0d0-4b67-9510-ba1edabdd5bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773958032, "uuid": "879a374b-c26f-449f-9bae-fa308430413f", "value": "SecuriteInfo.com.FileRepMalware.34186585", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac286282-23c2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773945444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945444, "uuid": "6feb6b68-285d-4f93-a568-0811c34cb81d", "comment": "Malware payload", "value": "006a0eb2ae8fa181c7a7ac972055f03f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945444, "uuid": "907ec29d-666b-40ce-9da7-053d348abe76", "comment": "Malware payload", "value": "779272fd234deb25d4275715eb9e72e58492a149ed48c8ab1819b710864d29ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945444, "uuid": "4ab55af4-6c2c-478a-b3e4-6b72bbb09f4b", "comment": "Malware payload", "value": "4a25be29237146390145bb619395f1def438ad86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945444, "uuid": "99a41470-bb90-4ca6-98f1-c629a101dba1", "comment": "Malware payload", "value": "c52bfb00b69bb3b4b5d84a7bbee135d494abadadbea604343bf5db2db2d655db914550d4e3f80eca1e30742bce411655", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945444, "uuid": "5f3e225c-3c86-4e74-8c46-1547cde52140", "value": "T1558428E1E2C084A9EC64673A94778D3B057BAD78AEB0A5AF925D70716F732C30035D1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945444, "uuid": "de40d8fa-9557-433b-af7e-de3d77a27918", "value": "241b8881dbab565ef2e6f36d40ed0540", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945444, "uuid": "90614674-3a0c-4e48-8cfc-b0be5cdee9ba", "value": "6144:y0aqWhyrjzax+IiF/wFi5uCn0obVRPBRxrfsBqxUa:9aqWhyrFw6Zp1Ffaq2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773945444, "uuid": "a49d1adb-0e8d-4d52-864b-5ddd07bfa0ca", "value": 398800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773945444, "uuid": "6a074a9b-1464-4126-8454-336bc5a3c551", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945444, "uuid": "d3acf535-15ff-446e-b2d8-31a29139ea2e", "value": "2fa_login.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da90fd1d-2340-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773889687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773889687, "uuid": "fc5ecee5-5cae-466b-9979-6511d88741f2", "comment": "Malware payload (Mirai)", "value": "5dde7ab8dd120ba27e9023fa38c2adef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773889687, "uuid": "5d32efb1-a164-4a38-908b-20acaf90d4eb", "comment": "Malware payload (Mirai)", "value": "7792f5c1d5c6c6415732ba0f63328549e19cc9c182c258c17b97b77fdb5541b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773889687, "uuid": "2fddd5eb-b4de-4669-81ab-66857b166661", "comment": "Malware payload (Mirai)", "value": "31909285a827665f19f263e4e972fc6d14045383", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773889687, "uuid": "d0c91ba2-31cb-4335-844a-2b9a6a554dce", "comment": "Malware payload (Mirai)", "value": "e6b840eab0e869aa6605978d94e7c6535413e5f7557373fd673297e9203fcdade55cbefe318041e4a805177e5292e8c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773889687, "uuid": "22c2a78f-c20e-4486-ab18-6a157a9fd8b5", "value": "T1CEC3D506BF551FF7E8AFDD3749E9170628CC560A22A87B397A34D818F24B24B45E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773889687, "uuid": "4ebd9ca1-316e-4af3-8efd-15d7cb827cd2", "value": "1536:PxfDycfd98tkYGfNBAuGwX6YnshMlaLTEpQP9M9l3+JocJw1oxWoM:RDycfdYcLsLTT9rJzjjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773889687, "uuid": "7fea0abf-0fcc-4201-964b-739deb38bb9c", "value": 121392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773889687, "uuid": "7473df60-057b-499a-8b9b-0db90100b3ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773889687, "uuid": "ae022cd0-5ed7-4b75-a18d-57260aad8724", "value": "tuxnokill.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c6d3f13-23b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773940639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940639, "uuid": "2b944976-8a1f-4674-8e8f-e2ffd4769ab9", "comment": "Malware payload", "value": "b2219220b34ecbd10bea6cfe137a134a", "object_relation": "md5", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940639, "uuid": "521f1390-2ef5-4eec-90e9-099d85ba1851", "comment": "Malware payload", "value": "7795e19e10eebc2ec3f72a51b4e452e7ec39ac7bda9cf775fe688cfe5c5394ad", "object_relation": "sha256", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940639, "uuid": "2e751bff-b61d-4e7d-a108-0214ea9be86f", "comment": "Malware payload", "value": "1bbe3794d510093ed93ce696a7d12eab912bcd5c", "object_relation": "sha1", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940639, "uuid": "ef5a1121-be06-466d-b7c2-7d06c514a252", "comment": "Malware payload", "value": "137c1bba9856b2fcd844cfaba42bc7bff5a348127b955e577e1959a06da507bdf138ec007580b2eff45d87809bdecd53", "object_relation": "sha3-384", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940639, "uuid": "b659939f-38eb-4687-8707-c9c8f25dbb98", "value": "T17A168F03B388753EE4571A3A583FA284983F7A213A26CD4F6BF40D5C8F396416D2A757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940639, "uuid": "7d4869bb-0173-4489-bacf-839f941836ee", "value": "4f3a70412c909e6e8f69020f0bee4f39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940639, "uuid": "79713e68-ca0e-4a09-bb16-3e29cec52236", "value": "98304:TYU5hnuOajWwMPdCpepI3GrwrA+Jm333q:NxuHjWfZIzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773940639, "uuid": "2a778efd-f4dc-4337-97fe-cd334206f549", "value": 4366024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773940639, "uuid": "bd009abd-6665-4d87-a2f3-878809e16bf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940639, "uuid": "728ac447-7d0d-4744-9ab6-232f39c5c0a6", "value": "7795e19e10eebc2ec3f72a51b4e452e7ec39ac7bda9cf775fe688cfe5c5394ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a4c596-2353-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1773897841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897841, "uuid": "9e6f6763-a24d-4e15-8391-fbc25f753e8d", "comment": "Malware payload (njrat)", "value": "07555e387ac32cdfd3d069d2bd81057c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897841, "uuid": "9c32ca3f-cd1e-400f-b464-f960030b8c07", "comment": "Malware payload (njrat)", "value": "77ca49ef48eeb6646e96010d1e9bfd04b0687bbd44a7e11caceab81926aa80c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897841, "uuid": "56e65940-b8bb-453a-8aed-186fa959c30b", "comment": "Malware payload (njrat)", "value": "bb2b009c8684b426fb9ce8d7ec5ec664ba08d57d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897841, "uuid": "df217fd4-210a-42f8-935f-b28c4ccc3c4a", "comment": "Malware payload (njrat)", "value": "e76707ce6c078e9ed3d1aa87a8a32a0f098a76ecaf182ef3df505fcf92bbcbd8187c5277bce34dc1c56970061b8f6f99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897841, "uuid": "2e6f32fd-004d-4344-a1be-44b20f7c8ca7", "value": "T117B34B0DF7424A44C13D0F7385EB580C42E9D8B76667F77F18D89EE28E668C88D8B991", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897841, "uuid": "46ee37bd-8dc9-4eba-90f0-4c5116e8e588", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897841, "uuid": "a88f539f-cf6d-4b3d-96a6-3826b4903213", "value": "3072:xYuX9M2o39/2jOkLUjDLRPV0XNiXARSZAbgCoJM:xYGjqbHsulZAbg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773897841, "uuid": "590c3231-f04d-4e29-8cda-e1b8d1263caa", "value": 117248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773897841, "uuid": "f31ed21c-d8d3-420d-ad9c-0cbf016c85ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897841, "uuid": "b949d378-4f78-4636-83cd-ff9a2519c649", "value": "XWormClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a73038be-2394-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773925679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925679, "uuid": "fab6e318-a71d-4887-b382-e55c94b8e829", "comment": "Malware payload (Vidar)", "value": "afea42126aa92e22741e32f5eeea82de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925679, "uuid": "fd1ba59f-a523-4067-968b-d4c71c15baff", "comment": "Malware payload (Vidar)", "value": "78dd07fa38d37791723759b861f03917ec00a02bd68440bf5fb34a48136bce1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925679, "uuid": "16e56a57-89e5-44b8-b3fa-34acf05ca8df", "comment": "Malware payload (Vidar)", "value": "ce25344367b88c14832c4a0632e8ee77e01d9e0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925679, "uuid": "df6dc749-05fd-48e3-a9f6-18a2607b7373", "comment": "Malware payload (Vidar)", "value": "8e893ecf9d5a1941fe53385095eb7d74a027f701b25ad7799655e67ad7c8266655ddce3c9b432feff60d0d3d861f7c9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925679, "uuid": "004ef2e8-ecc5-4338-a252-bf8c58823f08", "value": "T152A57D43BC91A1B6C5D9E2318975A1A17B30B8481B3133D32F51BBBA2F727D45E3A358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925679, "uuid": "ff4834e3-6a0b-4097-970c-95d9db95617d", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925679, "uuid": "bb38ad19-67d8-4166-af2a-16c975a0cd5d", "value": "49152:9lQhY/CYkcD2SS6SSqMGYazykj/zgZW8bK1pr:TVKYkcD2SS6XqMGYULj/fV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773925679, "uuid": "d9791c9e-88c0-4a4c-8188-f4fddf426ec1", "value": 2115208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773925679, "uuid": "03165362-39ab-4c7c-a535-427e2becee57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925679, "uuid": "8f56d6cb-3769-41e9-83b2-5f8ba0f4ad33", "value": "\u0412ootstapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d7d9c5-2395-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773925968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925968, "uuid": "fee2316a-67f1-4208-ae8c-0acd769059ae", "comment": "Malware payload", "value": "6e27f5bf91ee6f72f0d31eb589ed6d6f", "object_relation": "md5", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925968, "uuid": "2e5c5db8-a759-4aa5-9c22-c693f3683bcb", "comment": "Malware payload", "value": "79300c6dab9ca099f074c3b35ee42db500c971942a375aa6b90f0b7c3dfeb57e", "object_relation": "sha256", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925968, "uuid": "8aa1fd8e-aaa6-46db-8519-006b406eca01", "comment": "Malware payload", "value": "f831a5d605eaf8402f982ca758d94b0bfb645924", "object_relation": "sha1", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925968, "uuid": "af8cd863-438f-4678-a6ae-5ef72f68d325", "comment": "Malware payload", "value": "04aca855764d2f07b63dd97b006c1d1745c4e80056115f347eac2d311ccea5f9db3b81aeb2730f6009c13e5d0040f434", "object_relation": "sha3-384", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925968, "uuid": "a6f7efae-9ec2-4987-9ffd-fc525adb195e", "value": "T1C9544C0627F42102EDBBCD791CB191330A38B16A8E21E5D538AD505C4FB3B57963A6EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925968, "uuid": "55527612-3cec-4d66-bcbf-6388a350ce67", "value": "768:O8fzw0GGXbW7Eu8p9RjQrE52U2fr0DnJEFr15ZfKIqJjjiK6SMtiViBdqTRNrtYW:O4XbW+9mg2U2jin0WvyhMLmYBltrWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773925968, "uuid": "a3e2e207-fcb5-4705-ac54-6dce72273f97", "value": 297176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773925968, "uuid": "19b3bea5-568b-4a18-b1b4-4f6739110ddb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925968, "uuid": "b716137f-d2fc-4dc5-87a8-22e3a24b5f7b", "value": "79300c6dab9ca099f074c3b35ee42db500c971942a375aa6b90f0b7c3dfeb57e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c02021a-2360-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1773903138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773903138, "uuid": "6ba99390-b412-4cba-840c-e8bbd0685503", "comment": "Malware payload (GuLoader)", "value": "4b65f3f010db2f40dd8734a3a808cc25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773903138, "uuid": "7c3f5bda-182a-4286-a427-fe4bca0694fb", "comment": "Malware payload (GuLoader)", "value": "79f1e92b005e6dfd5e46140a69672b6fd74b6500673bad61fcecbf560d56e09c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773903138, "uuid": "69482e19-b52d-4649-a4ba-6e0417194225", "comment": "Malware payload (GuLoader)", "value": "1c27f76094541cfb83afb24d99ed83bfd0df05a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773903138, "uuid": "027305d4-afd0-4a1c-a118-47759988e8d4", "comment": "Malware payload (GuLoader)", "value": "8678bdef7885d555724201a33853272a9a2aa559a8e2bc420fad96ca8386401441eb2f6dfb17840eb0945ae18288623b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773903138, "uuid": "f54142f7-961e-4826-9d40-e6f5ab207261", "value": "T172B4F043F2409562C1750331A97B8B7D1337AFA46B71570F239CFE3939BB2A21A4725A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773903138, "uuid": "df2af7cb-7215-48ef-afe9-0f9658dd1659", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773903138, "uuid": "986ae859-ccd4-4df4-a157-5d087379c2ed", "value": "6144:LhRMPAEwuZ0NTcIobPv8ZTJ7EIGv/0NYg+R7kfOa3mhwsFAA3rsoH0uymMA5xETY:1AAwYJobv8Zq0hSk2MEDN0upMiEfijx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773903138, "uuid": "ca359057-7082-4f00-adcf-bf8cd38352fe", "value": 521576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773903138, "uuid": "06000199-3e73-4de6-be2a-ba599f370501", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773903138, "uuid": "18486e38-18c7-4039-b72a-7cd931b90d1a", "value": "Account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "453e508d-23d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773955150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955150, "uuid": "2246c4d8-ea8c-49d7-b8d9-120cc71b00f2", "comment": "Malware payload", "value": "d0547ed4c19ac6224d863fb06b2fe487", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955150, "uuid": "8a4aacc8-c53a-450b-b7c1-5ea78456003f", "comment": "Malware payload", "value": "7b45e5dc85e06ce7d05fef0596066df3a584200b25d9808051253152e886a963", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955150, "uuid": "751f138c-fe97-4994-a27a-9ad7171288c3", "comment": "Malware payload", "value": "2e4a440f025450fc63748bf27d242c0f53e693d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955150, "uuid": "b96bea83-ec35-496d-ad25-bbbc1e709285", "comment": "Malware payload", "value": "04760bbf0b421211ab58cd730e5e9bd019633973c61f312c5519c8e11e07aed673dc464f4983afc568139ee46d4b970d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955150, "uuid": "36f2a5c1-4b1d-49c5-ad8c-29312f4e0daa", "value": "T1D4161857B8914682C0E4367ABCBE81C432A70FBD9B9A135B6D05FE383BBE1990D35714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955150, "uuid": "394c5da8-67c9-43a7-90a0-2e9406d69582", "value": "49152:qhZGX0VR2cie1wqdlFb4t8lCuYMgZz11:qhZGX0v2vivdlFlsu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773955150, "uuid": "9281be90-f056-423b-af9e-61d5491b58e6", "value": 4259840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773955150, "uuid": "f43a9ea8-0746-45b7-b5ba-771af4fd9090", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955150, "uuid": "f887f9ed-b0d1-48d0-833a-4f9d383840b9", "value": "linux_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00c233b-23de-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773957530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773957530, "uuid": "49ba5125-1bec-4dc7-b059-626b08c1c7ce", "comment": "Malware payload", "value": "720075a0b2de6e6e3e2a9775c42975af", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773957530, "uuid": "044d03a5-5dc4-49a6-86b9-5b05fae9b6c4", "comment": "Malware payload", "value": "7bf2a7a60f0f5ca2c6bb99af6d59f3a41681ec4ab9b8229fba457f5bb626f0ae", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773957530, "uuid": "e6dae83e-ebda-4f5e-929a-60a4cc749d5f", "comment": "Malware payload", "value": "19186aad5df574ebd837d658197845761108256f", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773957530, "uuid": "19f8f644-a512-4671-8e59-7aa429d4480c", "comment": "Malware payload", "value": "f21043f42864f19c7660dbc589faad38995bde13decfbc03adb6005e3bae5d58010da409d9f60cb025c0bf34fec55694", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773957530, "uuid": "500550b1-cb8a-4a6c-ae36-2c2eddef7148", "value": "T1ACB30E8B0A8E84FE974B6014865F1D0BDA9A5613071EC8407BEFED593F63C6560EF9C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773957530, "uuid": "9a5a9cfb-d8ed-4d35-9451-9c6b6ee0fa4a", "value": "768:vKC1bWCQO5La9STv4+5LzC0dyhoVu0XY0UyQJQIS4QtrXMWgSZgED8VGuCA+0EQt:vaAv4X4NQJQPJD8VGXiZ3ob5BV4X9LzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773957530, "uuid": "a9f992ed-6a0a-43ea-9407-fb21ce924375", "value": 113205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773957530, "uuid": "4d90c940-6fee-48e5-a25a-09724001e881", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773957530, "uuid": "4c868e49-1ab1-4b2e-beb5-ef4b8f9ce52d", "value": "UK_Data_Clean_380.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "338d4767-23d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773955120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955120, "uuid": "9077d62c-bead-41d7-a21f-3b6209805584", "comment": "Malware payload", "value": "236b0dfc03740eb8be1bda22e013b117", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955120, "uuid": "66f7eaf0-16e1-4275-83d6-e55ba56a510e", "comment": "Malware payload", "value": "7c00939422d1e1c2c1720e3322ca50ca660de227730b48694d28b841a572f1f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955120, "uuid": "3816e9db-fd4a-468c-9d6c-b9ac4cd019c5", "comment": "Malware payload", "value": "1fe2c7d7178582195c6f37643e290c10952f0a24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955120, "uuid": "f97b1b85-5763-4868-b287-73b10aafb4fd", "comment": "Malware payload", "value": "99447a400cd4d50a354bf46856889d7846739fd9b30c12d945e6e5510b1db6601c00113a95468a14ed0317aed9b881de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955120, "uuid": "6b6b026e-4db6-4bb5-a8ee-06c670ca19c1", "value": "T1D3163A06BA042EA8C865483785F74E9137A27ED52F319743E748F6BF69B33024F15E98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955120, "uuid": "0d484520-f365-4de7-b303-189db5ee150f", "value": "49152:mpIwWQgwyJjTEDHOsh1u5ElEmy3yU0Yj1V:mpIwWQgwyJjT+HOsQEsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773955120, "uuid": "4947475f-b496-4de3-9c31-67acffb8b69c", "value": 4325376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773955120, "uuid": "436d4c63-d4c5-4fe7-8853-0eb7a0633c36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955120, "uuid": "1d241150-595e-48e4-81d4-9384fa4ee919", "value": "linux_ppc64el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6067bdf-23b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773940709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940709, "uuid": "07f2b80e-328d-46cf-9a95-fc3828cb2da1", "comment": "Malware payload", "value": "e38288ffeab7bedd35dad5107b690269", "object_relation": "md5", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940709, "uuid": "8c393796-c855-4ea8-96c4-99a6208cf2ab", "comment": "Malware payload", "value": "7d08506b0181a809ec11a4f4d341f3ac0cea2301fafe31a96f3ab5ba360d5bce", "object_relation": "sha256", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940709, "uuid": "d193927b-096a-4a59-a352-c51d1eab9f95", "comment": "Malware payload", "value": "0fb836132c496b15b4b216e48a133c4ad84fed53", "object_relation": "sha1", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940709, "uuid": "2ba8d505-5ea9-4fb8-a954-f697e3d02763", "comment": "Malware payload", "value": "0b2a1fde01c2cc675d74b515090d3244f9a285dee1f8bbbe4cf3340cb1805574d581deaf2ddf93887e225bfb2a0d1b41", "object_relation": "sha3-384", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940709, "uuid": "13c96aef-8b8a-4a97-9e62-33abe4d050f6", "value": "T16DB5E03FB28B653EE06E5A367A72E210583B7661A5124C56D6F4C84CCF290B01E3F797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940709, "uuid": "3b101fee-0ecc-4f27-a6f3-5db56efd665f", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940709, "uuid": "2ce51a26-432c-4a38-b3b1-79851e629fe9", "value": "24576:/XNrSLScusMmOkKIhzvLvnBmAIILaL+U+eeRXf2bEKCap5mqN2m+dKo4zd0+qydS:0uI5hHcILddlfQ8+5nv+MNPtN5/WHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773940709, "uuid": "b776bae2-dc1d-4a24-86a6-ee3bcd2d5026", "value": 2396192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773940709, "uuid": "bbc9d57c-fc51-4f2c-ac91-eae4874ee637", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940709, "uuid": "50f8375f-6563-4c80-baa9-21fa8b3a3dba", "value": "7d08506b0181a809ec11a4f4d341f3ac0cea2301fafe31a96f3ab5ba360d5bce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9eefbf-23ab-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773935539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773935539, "uuid": "e3717abd-3c59-4ff0-a3a1-93ad0cef58ba", "comment": "Malware payload", "value": "59c59b72f565e451a42429d8042f164e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773935539, "uuid": "024922c5-a3e6-429b-9683-6f3dd5e0be2c", "comment": "Malware payload", "value": "7e4223b18715851c848394b43f871179e9f58f6f34ad32c0b90c7db54da33a4c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773935539, "uuid": "094b9dea-67d7-4cbd-989d-1d61f68260f9", "comment": "Malware payload", "value": "c99f3ab6e6879b4086a48711ece925e56c035525", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773935539, "uuid": "8dd5c016-53de-4031-a65d-f303401ada1d", "comment": "Malware payload", "value": "864c4dd031c204a7aeb11c94706e2cf8738bc1fcf9dac0f3c1db8f032756939cc4f58b3b7e54ec5cd2268b8eaac11a0a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773935539, "uuid": "3fc750eb-9cf6-4963-8125-1679a3af3fd3", "value": "T159925DB512896C79FBD1CE399F3C7F4DADE8C2C42124A3ACBA4F39215A1166DCB05349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773935539, "uuid": "53dfff41-95a8-415f-b0c3-c4348079bbb7", "value": "384:DFcuQpWx+BL0SWL0gTzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:DF8i+BL0SI0MzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773935539, "uuid": "2f8a45f9-e3cf-46cb-8ea2-9e6d7b1f4623", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773935539, "uuid": "c58bec51-517f-418d-8c27-0003741146f3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773935539, "uuid": "9fca79a4-b17d-4de9-bb53-decfd311340e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24cbc772-2354-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773897972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897972, "uuid": "15a23a93-6b3b-4297-9633-d534b396b1c6", "comment": "Malware payload (AgentTesla)", "value": "cfdded19d5379fc49cf4ab473b168123", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897972, "uuid": "5faaa0e6-d992-4d85-86b3-96a23fb72d36", "comment": "Malware payload (AgentTesla)", "value": "7f6738ab82a912c87f59894f9f6bf3a7c69d4ca5d888b4ab8950467bdd327c70", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897972, "uuid": "225bbf90-5359-47a8-8562-02760a7c3c7a", "comment": "Malware payload (AgentTesla)", "value": "66b5cf72c8f85b7f7ff2f8d7801b3830d5704343", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897972, "uuid": "a63ebbce-3312-43f3-8e22-cddd22c92fcd", "comment": "Malware payload (AgentTesla)", "value": "c3f0f91080678cd3d1a2e7264a655f5491f62d7d2c2b99c6c4cb9d8da2a77638cb2629d9aee667820670c01f064dd677", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897972, "uuid": "ff51d2b4-3785-4992-b8cf-ede72de53567", "value": "T1F0F5339933BC59A2C17D8B72A9D9028157B49393AA3BA74F8DC736EC1CE5BC0550370B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897972, "uuid": "6fc660b0-2f80-4a38-a0a8-88d86844353e", "value": "98304:vF4hX9TRnpdSiFln8oEct2AgGQ9GrBQ2DeRbxVER:t4xnzSalnQctYqS2q1QR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773897972, "uuid": "0a21fd7b-88b6-4e12-b655-711de9672b10", "value": 3348992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773897972, "uuid": "0c68dbc4-2a5c-47d8-a641-9757f8bdb239", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897972, "uuid": "92560603-cfe1-49ba-b33d-dc9d80d1c85d", "value": "xrick premium.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfee016b-2353-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1773897803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897803, "uuid": "6896efa0-a9ae-4ca1-8058-82c48b568e7e", "comment": "Malware payload (njrat)", "value": "7d550c361c96b5a5a44f51c3a8e01ae8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897803, "uuid": "22a0764b-edf6-4ad6-b723-ab7eb2f842eb", "comment": "Malware payload (njrat)", "value": "81eca6f09f33121ddecefd77be81082a22eb2d4ced5de728cc5b287e5ced8b29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897803, "uuid": "aead1240-90be-4f54-bdf5-7310f4f19b2c", "comment": "Malware payload (njrat)", "value": "46e762b62cd3d7cfa7b218854d50db9e0762a789", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897803, "uuid": "3e9aa8b9-3286-4aeb-a7dd-2a9156566709", "comment": "Malware payload (njrat)", "value": "1a6ff80153380308594b30561474d68fa5cdc438310917203568e697394705a3263d096c90ef2dad62cf437cd3e74f98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897803, "uuid": "e9ea25c9-02e8-4cac-9b68-607ba9e36a4f", "value": "T140B36B8EFB41AD44C16D4E778863404842FAC4AB7527FBBF64C49DE59F268988D8F920", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897803, "uuid": "769daed4-b610-4857-901e-eb8e2c174436", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897803, "uuid": "ee1ed50f-04cc-46e2-9dc9-2e691597cda6", "value": "1536:awyZL2IgQOuM+Zj7h0DazsQ6mvfRd2FBV0aIFz8W1MdsI/+cBJl3/9HbPICn:ifOuFh0l6UXai7sIjBVHbPICn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773897803, "uuid": "08f85506-19cf-443e-bbfa-4995ad42ec9c", "value": 112128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773897803, "uuid": "031c4e19-e556-4099-b60f-65a45f1cce9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897803, "uuid": "50f2d685-2e54-4036-90b0-693cc2ee0f79", "value": "MORDe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d0f329e-2354-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773897932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897932, "uuid": "ff67728a-bf8b-42ad-9d87-399fb50f4901", "comment": "Malware payload (RemcosRAT)", "value": "e5b5bd454bf9064ffc26ee17571f80fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897932, "uuid": "e8e340a3-5b8e-40f8-9f4e-de418ef3a481", "comment": "Malware payload (RemcosRAT)", "value": "81f5426df131002c8112c56d9a6907538de6bee78b0dc97c3ab62efa91aed0ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897932, "uuid": "e9876095-2906-4bab-9f30-283010cbccfd", "comment": "Malware payload (RemcosRAT)", "value": "d0402de2f9e2a23bd1e6c79effde2d4db8b2b682", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897932, "uuid": "e9094118-b653-428b-b0ff-e6131a29b3c5", "comment": "Malware payload (RemcosRAT)", "value": "9237a418661a7876c29d92d5a7fe1f40b39d964fc54def817c856b7469e6c0fce11603f04f188a19663aa59ac179da28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897932, "uuid": "66c98745-0d1e-40eb-b5bd-831a9affb4c5", "value": "T1EC15AF4DF5E260E1ED2184F30F5E97E14A1B731267A61C9722B802044B974FB6F6EB27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897932, "uuid": "87977cf5-096f-4d16-b2d4-f1f2339d4050", "value": "79b51b0b8fa06ebea3a256fd7f7ce2c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897932, "uuid": "487a7b98-4fa1-427a-b46d-41b73a9c54c1", "value": "24576:GayxliIdRwnmIFwFtpdbZXvnFrA/WV+8j:GaYwPFgzBZvFU++o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773897932, "uuid": "23dfb39d-472a-4c78-9034-7625cd4ff735", "value": 943104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773897932, "uuid": "9aaf15e1-e8e7-49fd-8ccf-91a8695a87d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897932, "uuid": "2eaee0b5-981a-4674-8e4f-58de1573f9c7", "value": "sx8sv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29deb3d5-2395-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1773925898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925898, "uuid": "33c50fc5-f41f-4f15-a251-4c5313a28555", "comment": "Malware payload (RustyStealer)", "value": "31841e7bf79723c33b3ea32bd62872c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Xisu-Technology-Co-Ltd", "colour": "#1A0A5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925898, "uuid": "df151cd1-05af-47aa-87d9-71f3473657a9", "comment": "Malware payload (RustyStealer)", "value": "83a8fb9eacee7ebd99832fed09a507b4dbd2e8b655bbc40c2bfe72b9870d2708", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Xisu-Technology-Co-Ltd", "colour": "#1A0A5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925898, "uuid": "72fca1e9-c4d6-4a74-943c-f9aca385e13d", "comment": "Malware payload (RustyStealer)", "value": "31be70f62c49215f8c6ac3b87fed087e5c258762", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Xisu-Technology-Co-Ltd", "colour": "#1A0A5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925898, "uuid": "8978b34e-3877-4c63-ab3c-1a3cb6fc6655", "comment": "Malware payload (RustyStealer)", "value": "28d7bbd09e54084fc47f3c397797958f1eb5c0d9eec228562e2b0c19c2cdff0cf094d5c93e6b6fc7517e50a01d1f59c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Xisu-Technology-Co-Ltd", "colour": "#1A0A5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925898, "uuid": "acffa630-a838-4def-9b13-d116bc9c4719", "value": "T135E59D43F29785E8C05DC5709359A937FB36B88A0634B6EBDBE447102E2AF515E2C32D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925898, "uuid": "498a7ca4-3a21-4699-8a1f-d4e30fc9ea99", "value": "3b29c9f3197a1afef321575da37aa6bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925898, "uuid": "01697ca0-156d-4170-81d3-e3e67b6919dd", "value": "49152:EVHE1a2gvE4w1lNCU0X7YOqNpV5hg0Hluo9/+MRZNutWUar:CHEtgCSXDqr3hd9So", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773925898, "uuid": "87596ec9-3f47-495f-93e6-fca88076a75f", "value": 3215584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773925898, "uuid": "4ebca823-3ca9-45b6-80da-4dff5fcbd400", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925898, "uuid": "95aa7617-2afb-4e11-a065-274c31360ac1", "value": "83a8fb9eacee7ebd99832fed09a507b4dbd2e8b655bbc40c2bfe72b9870d2708", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f3cbbb-233c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773887930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773887930, "uuid": "f167beef-66da-4aa9-b66d-ce24fe918e02", "comment": "Malware payload (Mirai)", "value": "d8d89a37beecef599fcaae47564a9c50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773887930, "uuid": "c0c6c5aa-d5d9-4431-9140-842895f598c0", "comment": "Malware payload (Mirai)", "value": "84d2c831165ae2b9d890386755f06cb4028ec477c3e495d247fa1116e05c073b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773887930, "uuid": "d94b34ff-e489-4bd8-9cc1-18b8fdc69a6f", "comment": "Malware payload (Mirai)", "value": "d9df95a6c2da50a22ab56e4b413fde2756097421", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773887930, "uuid": "f1ab9311-886c-48d5-be3e-2281b19e8fa5", "comment": "Malware payload (Mirai)", "value": "fb6c9b008cf05b0cc6ce18cbb15b05445c1ce89b672be24083fa975b194de799ef541b52c6a3782fa7945fbf87e034f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773887930, "uuid": "eaf630e4-a43d-4f6e-a1cc-61c74f989b94", "value": "T137A33C0277080E47E5935EF4393F27E193EED99121F4F6882A1EE7569172E32158BEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773887930, "uuid": "f15aef02-419e-47eb-9953-6852a80bf7a3", "value": "1536:zME1V2oNjRdc22oDjVffRCjZ+53wzhy6BKS+4d9TCY2o26YB01eVH8nTTB+1z:zxT9fmF+tayhlu9y6c00D1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773887930, "uuid": "5168a17d-9b34-4e50-9303-92f11bdd0477", "value": 99672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773887930, "uuid": "f1a14fec-b5a6-4147-ad0c-22e60cdfa23c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773887930, "uuid": "5245c01c-b6e9-4673-adc7-16e9dcdc621d", "value": "tux.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3cc4003-238c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773922237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773922237, "uuid": "393b8c70-6b42-4777-aedb-f203faa29292", "comment": "Malware payload", "value": "26ba16cc0d8c20161e109e104e742d52", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773922237, "uuid": "63768291-591f-4d38-ac1c-3202999a430c", "comment": "Malware payload", "value": "850c7db6dd26e2418ef5fec28df74d6a1ff3328d4948c7b3be56ce0f71c58c17", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773922237, "uuid": "3d5d9943-ab95-44bf-8374-8966533db640", "comment": "Malware payload", "value": "d24403dc38bbd165ef8f6696dbcb3bde898a81fd", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773922237, "uuid": "7ed382e7-1f0f-4b0d-ba2f-e94e35e41ed8", "comment": "Malware payload", "value": "d62f582aa62307a245a14cf6524f356b1862901c1771d4e299ce5c4f89ae84f26efc0ce16a4803d95217ccf377b73143", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773922237, "uuid": "d876e499-c6ea-4ed7-95a7-98932c52aa2a", "value": "T1E16733DFE8B1CA67C43BC135A4F6658519BABE38CA0182275079B37235FBB51A3F9011", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773922237, "uuid": "f6e8c8c1-de27-4602-900f-b658f0808ad1", "value": "786432:2Oq892rYzwGtRsEd0sFNEM/LHW4VaupDgxgyFFTHOKVvSoIWcYCCOw/7X61:2gMr4biE0sEGLUu52tVaokw/D61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773922237, "uuid": "c2080d3f-b7b5-4e08-9fdd-2113cbe09aa7", "value": 29908992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773922237, "uuid": "89017e18-23a1-42c2-8604-7692ddc5bc77", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773922237, "uuid": "ce44af19-9278-4377-bb97-a87c8ba6721e", "value": "Silent V4.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7da1a1-2348-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773892964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892964, "uuid": "17eb73be-15c3-4a75-be16-57c773736702", "comment": "Malware payload (Vidar)", "value": "d302e9331836cd65a58970484498450d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892964, "uuid": "ebce1347-c9f9-49f6-b505-aa13be34b1cc", "comment": "Malware payload (Vidar)", "value": "8799b45837423ed2178e3521ddc524dbfc7cf23a7685c8ec55e2aee6f14df46a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892964, "uuid": "da82220d-fd57-4a0a-b375-d3394dc8c9cb", "comment": "Malware payload (Vidar)", "value": "2f4afc01c3d8f1f7fdbd9e54af1972932ff7adad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892964, "uuid": "c715f4c9-1dc0-4394-89a3-41c5ac318fee", "comment": "Malware payload (Vidar)", "value": "a872704f1a1f7ffbb6ffe3c9085ddfe47fece51534c429226fc0222fac8119762b0bf76fe8a747657406d45aa24f36b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892964, "uuid": "3ea7f4bb-4fc7-4d67-88e7-8fac20c6f897", "value": "T159959C03BCD161B5D5AAD23289B112A17B30F85A0B3137C36F65B6B83EBA7D45E35384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892964, "uuid": "c7395164-c63b-4888-9c93-e316d963d8a1", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892964, "uuid": "79e591fa-c679-46d8-9ddc-656ae3cb461d", "value": "24576:ZQxdKmplIyLAQi4o2UEoenn6NU6O36WC2oOO+OcsYgt+Ej1K1:ZYdKmcyLAQi4qxenOU65+MYgtV1K1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773892964, "uuid": "aad0ba1f-8acc-404b-8605-c7a725743332", "value": 2001920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773892964, "uuid": "2b80e2e9-cbaa-45ca-9dea-3737edda3ae3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892964, "uuid": "b6ef901d-1ad3-4e79-9ec5-5a1266751990", "value": "Bootstapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2864f9d-2368-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773906800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773906800, "uuid": "629c585d-8ec7-4b41-b766-a2653c369dce", "comment": "Malware payload (AsyncRAT)", "value": "0d147b3af4986955940496b380681914", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773906800, "uuid": "11fb317d-1fc9-4c50-9a64-0b4f5a76625f", "comment": "Malware payload (AsyncRAT)", "value": "88e156291d0a765e5c9b60daa6bd53c6ad75022e63ab286effe120aa6c16c222", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773906800, "uuid": "f4a7af74-6f60-4252-b2e5-7db49e0a10ec", "comment": "Malware payload (AsyncRAT)", "value": "edfb258a512bb64414fcb81b55e9b1a5a26ea1c5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773906800, "uuid": "2a649843-6319-49bb-89a2-59c07687625f", "comment": "Malware payload (AsyncRAT)", "value": "2711e6ff49d526d4f4a06e96fb24eb15757d96085c6b1bf9130d79d669eef3544806d06d600339c47d2494265b5c0908", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773906800, "uuid": "ece52f7a-4289-478e-835e-b12003eb9115", "value": "T15615015637A8EB63D8AE27B45664E23413387D2ED852C7176EC07DEB38B6710490B783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773906800, "uuid": "a9a1c14e-03fd-4e9c-94de-74b6cb2e7972", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773906800, "uuid": "8c25d935-0a3a-43de-a0e2-9e6b931dba6a", "value": "12288:YOKGkTYbuch15rimxXYtLD0Fv6eegnb9tt8r9hoAlee7JnM6Thox5Wij8a2k2CX8:Yhch15rXw30xn58hO4M863jH2k2SBMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773906800, "uuid": "1dea061f-5195-45c0-bcd1-fe4508815f3c", "value": 882688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773906800, "uuid": "e71fbe48-d0a9-40ef-b680-6175da42a636", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773906800, "uuid": "515633f4-7390-4a03-b337-38ffe9bd4363", "value": "DRAFT - HBL#TPE26020043 - SO#B891 - \u98db\u98bf 0318 to Laredo, TX via LAX.doc.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be2ba4e8-239b-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773928724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773928724, "uuid": "23a7ffc7-1e7c-428e-923e-505cb8e5b14b", "comment": "Malware payload (XWorm)", "value": "6168a105756bf19e51f199de31a987b2", "object_relation": "md5", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773928724, "uuid": "63f3f9ec-d887-4734-a6a8-e057059ae715", "comment": "Malware payload (XWorm)", "value": "89e0070aef9064b5cf70eeac08cbe05466c98e72be277000e4dde2b3a7859406", "object_relation": "sha256", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773928724, "uuid": "8d010b93-7120-4576-918c-ed72ef52ca57", "comment": "Malware payload (XWorm)", "value": "0504eb7a02880bada9ada9758612c06c7c7a2bc7", "object_relation": "sha1", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773928724, "uuid": "00b508c2-2e29-4d93-a165-f14afa674d94", "comment": "Malware payload (XWorm)", "value": "d541790cafd2382ff4111545afc88f963792efe5f92be57536aa923f28d507b966d8fd937be3dc6f2430474e96740940", "object_relation": "sha3-384", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773928724, "uuid": "a395ef2a-5003-40ec-b348-ab64ea807f0c", "value": "T15B630125239E58F930F1D824B99A9B1CEA3850376C557C59B3E1E3B06FD314631B0E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773928724, "uuid": "82261293-af32-4820-b080-ef673ecc410e", "value": "1536:bWK5Mqlue2FVIanQwEI9Wuxn+sliaZLu0eFT4Tj49Yun:KDqQe2FVjQwL9lTliasdAoYun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773928724, "uuid": "004c8c82-ee48-4bfc-9045-ab293ef2f7bd", "value": 68126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773928724, "uuid": "d270ef1e-58a9-4868-976a-151e50a5a536", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773928724, "uuid": "e1495585-f1b8-4356-9bac-cf8566251e4a", "value": "loader.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9299d262-23b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773940677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940677, "uuid": "7df7c40d-1b99-4393-bb11-abd81cb49461", "comment": "Malware payload", "value": "eb1cee1376691b30df38ba730f5958df", "object_relation": "md5", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940677, "uuid": "5956cb1c-c13a-407f-a110-69e20a6ed2b0", "comment": "Malware payload", "value": "8a5661ae94a67e1e27f4cf155f905d665be74f7ba1ef424eb471a0da215628c8", "object_relation": "sha256", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940677, "uuid": "766ebcf8-4d02-4057-a4e3-ccd0f2362bf3", "comment": "Malware payload", "value": "15a1d1a365e83d0fa8e55af5c71fe9f53fd44497", "object_relation": "sha1", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940677, "uuid": "84d4dd50-1f00-4972-a709-5acaf35cf727", "comment": "Malware payload", "value": "8e660d9b3b5c572019003ec03a92a4452ea5d968927b443cc2877d1b736d479456fc2cc7545f3c8bdfe5dfdf967bfd77", "object_relation": "sha3-384", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940677, "uuid": "35b639cc-5b85-4de2-9b4d-73767ca02b37", "value": "T182E5F13FB28B653EE06E5A3979B6E210583BB661A5138C06D6E4C84CCF251711E3F787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940677, "uuid": "932d9e3d-d5b0-42b5-aa02-c33bb42704bc", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940677, "uuid": "7d35b2b2-33f1-47f5-8568-dc98fc219edf", "value": "49152:1uI2hU90iNyyCxzqmsoNKU2mo6NnPkEejkOX8xwZzGPXEkvbxrOM7vJxJV+:15OtiNy1z/TNK/mBGTliPUU0MFh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773940677, "uuid": "84b3805a-c166-4037-876d-46b08f367fea", "value": 3262592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773940677, "uuid": "fea34f89-f71b-4714-8e92-ff9ee457148a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940677, "uuid": "cb2c099d-740d-4fd7-971d-6bf3a69192a0", "value": "8a5661ae94a67e1e27f4cf155f905d665be74f7ba1ef424eb471a0da215628c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fca2b44-2334-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1773884408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773884408, "uuid": "8e1507e2-883f-4c91-8e22-2467c1dd7bfd", "comment": "Malware payload (RedLineStealer)", "value": "e616afb0830b1456c81909e64d2d5bda", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773884408, "uuid": "f344b708-a414-43ee-a8d3-bcf69130b7ca", "comment": "Malware payload (RedLineStealer)", "value": "8a73495d0ece94c6e883325ad66502b96b3164b0b036bc60f1ba5461a38d245f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773884408, "uuid": "2eed098c-0356-4ee5-9e97-914e8211cfb2", "comment": "Malware payload (RedLineStealer)", "value": "d5f959c50fff13d5042a4b406232ec8eb230c14e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773884408, "uuid": "6473233c-69a9-49d4-93c7-9697bcc424f5", "comment": "Malware payload (RedLineStealer)", "value": "6d6eeb479946acc359bcf2cef336c0b7e3d90772698b01f257abe68c56995c754e8292d75529bfe9a4576b3de667f750", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773884408, "uuid": "8650e876-64c2-4125-b248-29758da16c99", "value": "T1E845D0A05B940FD18659893D21AF8E3F12541BD8084FB20ADF637F45B9D39893B38E5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773884408, "uuid": "fb3b472c-64c0-4ade-82bb-bf59db38d08d", "value": "12288:HxwdcQnmSd6B84qMuS+YFT+8T54Quu/TRCquMUMqzyaBLpft:HiH7d8SM+4pV/91GQaBLpft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773884408, "uuid": "ec303a21-c681-4356-8036-c0e41bcf1f38", "value": 1240820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773884408, "uuid": "a6360e9c-f3bd-40c6-9532-9fec83a54db0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773884408, "uuid": "c1fb8e1e-1cf2-4199-a006-624b818fe325", "value": "Specifications.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7a0283-23a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773934437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934437, "uuid": "99ee35fe-86a6-4e70-9ba9-1b1614e148d7", "comment": "Malware payload", "value": "24b427897f292535009d4be96db5c6e7", "object_relation": "md5", "Tag": [ { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934437, "uuid": "ee08cacc-4818-4867-afeb-25a5b1eadfbc", "comment": "Malware payload", "value": "8afc30c5ba1e4804ee247a2ea773560e24bc448de8d83169e888d29e0e91d700", "object_relation": "sha256", "Tag": [ { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934437, "uuid": "4f9d1818-3e56-4114-8dd8-010f684facf8", "comment": "Malware payload", "value": "143f5edb6bf02eebb1a5bb4bc3d7e7dc6725c389", "object_relation": "sha1", "Tag": [ { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934437, "uuid": "2f3c36a4-fb22-49bc-950b-93f925ede4a4", "comment": "Malware payload", "value": "7e53d20eb0a6072c561d298e5acbe0e2cc0e11ac6ea62d390885aadbe18e7350984d08f5f471ab79abdfb342b34402dd", "object_relation": "sha3-384", "Tag": [ { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934437, "uuid": "3c4487fd-7d9b-42a7-b086-6b8dd8de2986", "value": "T10422B02C69AA13487EAFD4B1F3C49B4C6E55A04EFD7857D67CDCC010D140D6504A6AF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934437, "uuid": "f9a94507-66ba-4b1a-a0f3-9236e4326888", "value": "192:0g1bMQ92/4ADRE76VE4uyc9crNvzoh8tt3NeqpoPkjIEgHC2Z3nv2Ju06:VmQ9vsu76Vnup0vzohst2771vT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773934437, "uuid": "887b2b9d-2255-41be-9ac5-bbc134e08862", "value": 10309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773934437, "uuid": "94358f95-0406-4924-8050-13beb13a15e4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934437, "uuid": "e37b8b66-4c6b-4ff8-9709-6d8be18407d0", "value": "36affc7afbcf01664d0f4a129cf4d98a9434ae00cb92d2e6ef3c0aaf605a3bbb.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d818cf87-233d-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773888395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773888395, "uuid": "5cc21d68-08d8-4ecd-b086-acf70827bdd6", "comment": "Malware payload (AgentTesla)", "value": "a9ac0edc01c1d097344675af8a5fb7e4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773888395, "uuid": "67241d0e-9ee0-4770-8366-efebe87976d1", "comment": "Malware payload (AgentTesla)", "value": "8b012d3d775bd32f503cb84a6889d786c06623eeb8c840bd8c03073971530f52", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773888395, "uuid": "8d286220-d4ef-4857-8e56-044249f86fe7", "comment": "Malware payload (AgentTesla)", "value": "8aed16f8acc5909790dcb9f60afff929b60678e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773888395, "uuid": "f87cb012-9816-43fc-ae8f-6e51ac6febd3", "comment": "Malware payload (AgentTesla)", "value": "61617365e701090ef3762e3fddf81056e6b19e2789073eeec2c3655c2dbad8f4656bd602018dac49af837499887ba227", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773888395, "uuid": "0f60b161-6899-4065-8962-b2e59d644e17", "value": "T1A84522247A59C923E9A3A7F02960F33413B92E5DD542E3939FECACD73866F641209353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773888395, "uuid": "5a086cbd-0004-4934-b4f8-107ae01d9c95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773888395, "uuid": "30afcda3-a020-4b93-9399-d55cd3ae1208", "value": "24576:inMJOJJYc9ySS+DCiy5DyGjNerc2JEqAN5k+VRlyFOxHPejj:4MJYUSlDCvpyGRmc2J83NLxvSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773888395, "uuid": "194a74ea-9e20-434c-9953-e24306bd99b1", "value": 1228800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773888395, "uuid": "3dfff697-0875-4972-8c9c-152816213fa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773888395, "uuid": "97284270-0e7d-488e-b006-f0475d30ffe3", "value": "MT_Eagle_Asia_11_Vsl_Particulars (4).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a53e5c2-23d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773955158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955158, "uuid": "22f6aebe-771f-4416-b523-144640636427", "comment": "Malware payload", "value": "2a3e1518f38be41f1db13701d93c1daf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955158, "uuid": "d4692bd2-f20e-4e2a-8c24-72121937be3f", "comment": "Malware payload", "value": "8c2ebd1990cb95e7ded08c14cf1a273921fb14a941f280f60e8fbcea4a9961e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955158, "uuid": "7f943d75-d4fa-4675-a952-6c0954a40e79", "comment": "Malware payload", "value": "d188c14bd37ca9ad74545ba682f6c64610b6ef4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955158, "uuid": "cf4e7c3f-477c-4099-8c4b-6bc069703641", "comment": "Malware payload", "value": "f93997dbdda8b706063b6794fcf6114482645d1ef2a7b9eb94d3fdf07d391d0c43cf8775ddee1cf7ca3abbbe593b73ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955158, "uuid": "3fc4d1a8-ab27-4268-abe1-0b83f867187a", "value": "T194161B5BB8914A82C0E4367ABC7E41C832A70EBD9B9B13576D05FE3C3ABE1990D35714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955158, "uuid": "8650dffe-cea8-4eee-9349-9d71fa6e96bc", "value": "24576:SIAdfHGb8kCLW5qLCYJktzMDIf760Vfnfsp48IzhAQCeTtvkE7CMwXdCLbqmXvfa:xecSL0TbHeIGyZ9m/gnAn9PULZD11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773955158, "uuid": "075d97fd-e070-4ecf-9e41-e59d80c1697d", "value": 4259840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773955158, "uuid": "8f038fb2-2cac-40a9-a739-1642c6661e91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955158, "uuid": "02072c9d-b192-4847-a300-fc2237d1049c", "value": "linux_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104ca9c2-23b3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773938740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773938740, "uuid": "423e7039-ae4d-4b1c-a3d8-7cc1aaeabdd5", "comment": "Malware payload", "value": "08d04269ee7b47d313734ebe3a1abd2f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773938740, "uuid": "24385a89-67c3-4e4f-80d7-1b664efffba8", "comment": "Malware payload", "value": "8daf2faf492944ab850ceb36450165b3fbb1d0db9d0732bd0a5171ede1f15545", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773938740, "uuid": "04807875-ef61-4be9-b1f7-f8fff81f16aa", "comment": "Malware payload", "value": "85541f6b859998ed5347ddcfcda692cbd5b87053", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773938740, "uuid": "a3124ca2-b726-4325-bac5-7ae95d8577b8", "comment": "Malware payload", "value": "2e1c1e9b13366b2c345f1485ab0fa7699cc3c333c13cdd7f68882de35a9199bc76e52b252ab92ba3743ccf762ada1496", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773938740, "uuid": "d21434f8-9cbf-4a04-b143-f988a7432d4d", "value": "T1A06733ABD8A10A83F07F9A34C575EF855365EF43D5430D7E3A22B6163AF32A03276509", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773938740, "uuid": "d9016ca6-2e0b-4a56-afc0-8fa919080dcd", "value": "786432:6WSi0hVrYwGurCeXRxAJoMJNKSNpUkl6oZSBhgeWpL:6tifuriJZJESNpLMhKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773938740, "uuid": "e6f1f9e7-75d0-438a-93be-86e2eae40f23", "value": 29794304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773938740, "uuid": "12c23c48-b004-41b4-83a8-3b6f48918a68", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773938740, "uuid": "a0777941-ba20-45f3-8b71-aec4a7562a78", "value": "droveqx_menu.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0cdf3b-2353-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773897850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897850, "uuid": "4aa7873c-aa8b-46bb-9ee5-1aaa5a4dfe41", "comment": "Malware payload", "value": "d2d87ea3889a05d1171b5a6c1163aaec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897850, "uuid": "36517398-d1cb-488a-957a-c42ab525893a", "comment": "Malware payload", "value": "8debcb3c77f6066c37073da999b5ab9f201b0fd99ba7b41e48a78b8082eb8f18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897850, "uuid": "8faa7c86-defd-413e-8730-de2714bc10d2", "comment": "Malware payload", "value": "4087a079e060ee5fe982e0793924e3a69f3aa472", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897850, "uuid": "f056e824-d007-4020-986a-25bcfe3b0a5c", "comment": "Malware payload", "value": "c52822dfa8398ae5365b8683cf1194f6e89e5f9d1199264f8c1e7f5161f1e1be13d2973cbf96a48c82c5bbc2f94e869f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897850, "uuid": "82bf00c6-84db-4dfa-963b-0928bfb84e86", "value": "T15A157D52B3C3C1B2EFA215F3D9B557360939BC78133889C7B7D8282DC9A26C06A75359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897850, "uuid": "a2592b1a-a335-44e7-8a34-701cfd43f1cf", "value": "471485476459c716374c5ae96580f71f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897850, "uuid": "c35cd18e-60a3-4b3b-9237-af7b45269aff", "value": "24576:ybi/QhDC8mY93kyw8hC2A5CxLbRpWrzzZyP4UMd69G:d/QMnl5YL7WzZyQRdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773897850, "uuid": "c09154b9-2484-4d2a-b78a-6837404ce68e", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773897850, "uuid": "0e96f56d-3b3e-4c20-acac-760bd13f4d67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897850, "uuid": "c81a835c-fff4-4314-beaa-eaa5cc604047", "value": "Y639757407.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "783762cc-233b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773887375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773887375, "uuid": "c72e91c7-0122-4433-9bd6-93507bb3fce7", "comment": "Malware payload (Mirai)", "value": "ef07b798aff49a321f8aa939b07ca0eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773887375, "uuid": "d0ec251b-1a60-4109-a83c-3241275e036c", "comment": "Malware payload (Mirai)", "value": "8e3fbaf4ec55d76b024caf027583049edd71b9ffef4ebce5e81efd3595f52e36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773887375, "uuid": "0d34d5a3-69a1-4b22-98fb-bca26e4b7a74", "comment": "Malware payload (Mirai)", "value": "1d5bf7d65f559fa63d943e8f502240a447b704f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773887375, "uuid": "619a5c43-e4c6-4e3f-8f77-82c2ab576423", "comment": "Malware payload (Mirai)", "value": "7b344aa39e44c5ada0da4b62fc3c7987a55a147cbedb24e150e410df79af573124eb7a5ebde63848339e91110ed025b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773887375, "uuid": "313b3a16-9586-4b39-b21e-d9f24333a402", "value": "T167837DC6A6C3F8F5DD264579303BAB728AB7F5359028DB87C358A933AC51600E1173AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773887375, "uuid": "d5eea160-efcf-4198-85ee-f22e45359f31", "value": "1536:tnkZgmQNvUXDtj+PgIh6NAZ5KmHg0QtuctaaYravABacufsiTsH1o6ktrv8bo:ZGgf8XDtj0F0NAZJA0QtuHaiaoBbukim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773887375, "uuid": "f0dd778b-260c-4123-bc64-e3652c784f60", "value": 87504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773887375, "uuid": "d628d30d-5432-4a58-90df-03e8c4db8483", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773887375, "uuid": "20f3c6c2-8992-495b-9297-bdfa31b29beb", "value": "tux.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e994255b-23b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773940822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940822, "uuid": "5d907e17-79ee-4546-9c30-829bd9c408e1", "comment": "Malware payload", "value": "aca6e76d9fe7a5f7674f764d81bd73b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940822, "uuid": "bab35ee7-d3be-48e0-90ef-886da3a4020a", "comment": "Malware payload", "value": "8f702e3d4cd80696af17e8e53c0195b96ce52cd3cc311eae587db9561563a88e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940822, "uuid": "2744e187-28d1-419d-8f2b-432a2eab7a8b", "comment": "Malware payload", "value": "603752eb4dfbca58a091fee78df55c2c4aa28d0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940822, "uuid": "40ddf62b-f0af-43f5-9c36-1a7a09caeb70", "comment": "Malware payload", "value": "207c460c792734db0cec522cd6abc0001169c5586189582ced79eb407de0fc9167fa63d7688b01d8349dc702e6a73996", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940822, "uuid": "da50eb96-6d53-4644-9125-02cc148c5d84", "value": "T175173343F794DEC7C0DDFE79A0E0094699E34C74AABD430ABD2DB5BBADA21402C99354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940822, "uuid": "970743f1-09c1-4c5e-bb67-695b396871b2", "value": "393216:obZmOQ2oS9n1PXnB2LFU0IJ78KExxVJ0ANLm3RNBfc4fKWFhCs:iQ2oST3B25U0GyVJncBkOFhCs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773940822, "uuid": "a87646fc-b304-4d36-b4b0-9335e064600d", "value": 19017424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773940822, "uuid": "98db697b-ea0e-497c-8c06-152f95152212", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940822, "uuid": "fe90f92e-c38c-4c50-a022-249d11b3220c", "value": "8f702e3d4cd80696af17e8e53c0195b96ce52cd3cc311eae587db9561563a88e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3297885-2395-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773926128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926128, "uuid": "022f6743-68ac-4286-8329-ba2cb1eb66d5", "comment": "Malware payload (RemcosRAT)", "value": "96555cf8146236bba843b438e8e6b59f", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926128, "uuid": "c3080e00-1cfe-46af-9006-48d866c52370", "comment": "Malware payload (RemcosRAT)", "value": "8fc99d95e5e736e838b5b3237d5d656c4b8de9a75100e01a834e45dd76917dcd", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926128, "uuid": "f6dcc73c-c1b2-4b19-a069-36d17fdd1795", "comment": "Malware payload (RemcosRAT)", "value": "271606735ae10758ffd579105f42a183e57f820d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926128, "uuid": "90983006-7bcf-4d2f-865f-7aa0281fbda3", "comment": "Malware payload (RemcosRAT)", "value": "0ff4cbcc2bfc0816426da11cf65b1146403bd7297c5af2e89afb84fe1dd1d223b6cca6239cc267d589645a6deb711fc3", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926128, "uuid": "de1636b5-760b-4134-900f-57337c782ed8", "value": "T122617C4693861AFF8F036770616FFF491F02DE6B2A63859D92800A19613915B3FAE930", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926128, "uuid": "f026c097-e49c-48e5-9091-1d0165f537c7", "value": "48:noDGu3ipl1G2Y0bpmR1W/VpCQj5CwDBQIgp8qI8NRr2WURj9E9WHtKd:noDPX0bUR0PNJq/Rr2WUh4oo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773926128, "uuid": "6aee8ac2-552a-407d-b6e8-dd90855a2e16", "value": 3229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773926128, "uuid": "4ce9d5aa-2dcd-425d-834a-bdd04d793d92", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926128, "uuid": "3911656d-c51e-431e-b46d-384c55c6ed5b", "value": "docs.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7278c576-2398-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773927308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927308, "uuid": "f1be22dd-d773-4746-a5ea-529788e3cd5e", "comment": "Malware payload", "value": "127215a1d805ca62d7f79eb2aec73af4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Liansitong-Technology-Co-Ltd", "colour": "#A420A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927308, "uuid": "90ff2846-e5db-487d-811f-f25c42a77b10", "comment": "Malware payload", "value": "8fe7ab026b48b478f592f46eb4b8565c15e60531a48dfc1d08ca550c7a2ac076", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Liansitong-Technology-Co-Ltd", "colour": "#A420A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927308, "uuid": "1491fe02-5496-4f35-8419-8c6c4218896e", "comment": "Malware payload", "value": "ef0daae5938e3101e70abe6015a353e3a864740a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Liansitong-Technology-Co-Ltd", "colour": "#A420A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927308, "uuid": "29c03589-8342-4454-955f-8b65d25ba638", "comment": "Malware payload", "value": "fb33a242c74ea33aedf39c7df8a5226b850786343d50738cf0c74099821128b7d50b12da59acf83aaebb98684b15b9af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Liansitong-Technology-Co-Ltd", "colour": "#A420A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927308, "uuid": "d7cd3fa4-1e09-419d-86bf-f61918ac076f", "value": "T12AA3021BAF7C4431CE285EBFB6D6E7628478F3927DDADB463054850E6EAA30104E0766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927308, "uuid": "4a6b597a-fbaf-4f66-bfd5-645367917d20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927308, "uuid": "8799a70d-71ac-4013-845a-f521aac11eb0", "value": "1536:MgUVKbZDpPoMHYbs2TQtmDdLAUu6UplqPjzR2VzNH0HCrrR9Un+CZimP7y2qBzvb:jUVkZo6yQmGpplqPfAVOirVTSP7y2yv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773927308, "uuid": "caad7503-7688-48bc-a74b-ebca52ec8006", "value": 103680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773927308, "uuid": "aad46990-c74f-4031-82b5-04f794c5c0b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927308, "uuid": "d1c506f8-9910-4ca4-958e-6ff0cebee192", "value": "8fe7ab026b48b478f592f46eb4b8565c15e60531a48dfc1d08ca550c7a2ac076", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dfdbbe7-23c3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773945635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945635, "uuid": "26e1480d-0ad4-4809-8df7-3639b142de7b", "comment": "Malware payload", "value": "2cfd3d850821e5567163c9d4a9e64406", "object_relation": "md5", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945635, "uuid": "a66fc72e-1def-4f54-995f-423d8b2cd898", "comment": "Malware payload", "value": "9216bfa394c69fdf21d541439533d4ba43dc08aae1d50062f51cdb4828330469", "object_relation": "sha256", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945635, "uuid": "6a9f9698-9cf2-47dc-9096-0a61267d21d7", "comment": "Malware payload", "value": "b54f2f69e2e0e866facc00dfef49c431f0bc8713", "object_relation": "sha1", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945635, "uuid": "d1596d6d-d7fb-4368-abda-bf972a8426c0", "comment": "Malware payload", "value": "9b537fe088e5456b3b7d151f52d4a8f755ee5b4a058bfde060ec2763d18fe2d38a973b9a11cfa72588a5ac4ba347d46d", "object_relation": "sha3-384", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945635, "uuid": "1aedd5d5-044c-41c6-a243-1f0895b3915b", "value": "T1F3C1A5879BC84366E0A607317CB313522778E8155F7BA79F25F4137A6EBA79048437B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945635, "uuid": "532594c8-77ee-498c-9988-b793d300579a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945635, "uuid": "21dfcc09-92f8-443f-be0d-1b6759a8f26b", "value": "96:sdew7V9rSbZRg8zZgyTy12D8BynqgHlNxiEg7upBK6izNt:svv2tzuyTyaoyqgHjRg7rl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773945635, "uuid": "b14b1c5f-3143-4044-a14d-4a9e8138326d", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773945635, "uuid": "3a67c324-4321-41cf-addd-bf708bd7caf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945635, "uuid": "58c808c3-4ad2-427b-bb39-455f0771c2e7", "value": "explorer_1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694cb778-2395-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773926004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926004, "uuid": "fb41c0ac-3eb6-4d5b-aa8a-7fc6e1ae9d7e", "comment": "Malware payload", "value": "879f3aeaed2b26e05a7b4fda521a3bab", "object_relation": "md5", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926004, "uuid": "d76f9869-80d1-4fa4-ab2f-354fef010ccc", "comment": "Malware payload", "value": "957b0b368d32a836e15e64697dc60cc41023be9a548befb0849477bef8e8853d", "object_relation": "sha256", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926004, "uuid": "f09b7d57-4f9f-4437-a425-fd433e19165d", "comment": "Malware payload", "value": "ddf3bb53409e8206f392e4b9933ae433e9526c26", "object_relation": "sha1", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926004, "uuid": "4fba325b-3d43-4a8c-81b6-d3cb97318abc", "comment": "Malware payload", "value": "f29d3151d6a4a9366e1215841b6426e88130391a8109bf0e2ee50914fe7a3a2a6cbe164cef56abf26d7224ffdad84f6a", "object_relation": "sha3-384", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926004, "uuid": "2a721cda-4d15-44c8-852e-68612450faf5", "value": "T125633C882BEC8463DA7F0FFFA811F06686B1A553F11DE68E6CCC65D82752B41123179B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926004, "uuid": "35e42141-c568-4672-afde-c5b7486644d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926004, "uuid": "f4ac19e7-043f-4920-9533-aab2868fb580", "value": "1536:4bdCHmDf/w2XuFd28KJyEq2EBLrWmMjjFxpsRpBXw1kesC47Xlyw2+VvCFQ40FsT:4bdCHmDf/w2XuFd2LJyEq2EBLrWmMjjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773926004, "uuid": "3b4b1ae0-2fad-4ed6-87ca-2bdd562bcdf6", "value": 67288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773926004, "uuid": "fc19ea3b-2213-4ddf-b844-e9cec5f46c85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926004, "uuid": "19de9376-aef2-4c22-a82c-5a257528ee87", "value": "957b0b368d32a836e15e64697dc60cc41023be9a548befb0849477bef8e8853d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59bb28f-23c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773946426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773946426, "uuid": "14ce475f-56ec-4a53-87bf-a73f34b390f1", "comment": "Malware payload", "value": "3e23eca306af0b1394cebeb7effeb5ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773946426, "uuid": "2a551916-2609-49ce-99f8-a9e9fcba242d", "comment": "Malware payload", "value": "9611dd668b4c8f4b9b4853c3877f724f0cd55a0cc3ab2390c3a826203fe20568", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773946426, "uuid": "9b79db00-fe53-498c-8e97-65dd56c177c2", "comment": "Malware payload", "value": "645d2fc0cce341d2992c794cbb834e8397df4b72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773946426, "uuid": "96ac9b05-91b6-420a-a75e-b758c423d20e", "comment": "Malware payload", "value": "be8dafdef0064b20f373c4ba954fc7c6ea060db47e3425c23b32c29bfb9e829f169609513fa0796fee88cb20058b1bde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773946426, "uuid": "6b70e07c-ce30-4311-8d46-e551424dd1a2", "value": "T1E1355A11BDC570B7C6741E3389666337DB378F070E15AA879FD6DF2CB823240A92616A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773946426, "uuid": "8d8b0e0e-078d-4fb6-82e5-2f794fc54fa4", "value": "2a091e48835d7625af99524447566601", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773946426, "uuid": "0859a855-b499-4511-ac03-94aa2be5cec2", "value": "24576:ncU1F7exXs9rJCiLO71wqWS/lff1RjIRt9RZ+KNaG3vC:nrv7eYJCiLO71bWS/li/+daC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773946426, "uuid": "5e66da8b-91eb-4d04-b57b-b148fb4719f3", "value": 1146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773946426, "uuid": "8e3b99d5-40ad-4f0f-aa93-416fed8a62b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773946426, "uuid": "2d673a46-c840-494b-bf36-3ef2ca77e781", "value": "9611dd668b4c8f4b9b4853c3877f724f0cd55a0cc3ab2390c3a826203fe20568.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67620872-2391-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1773924283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924283, "uuid": "6b3ee133-fa31-4003-89fd-d2c662b6e865", "comment": "Malware payload (MassLogger)", "value": "27be080de9ef48a0079ddabf5d879d32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924283, "uuid": "c8708808-a3ac-4b69-99cf-649a5c8cde18", "comment": "Malware payload (MassLogger)", "value": "9612b142e2991ff8c9b66b283b9727cd8d2b5afff8521e8bb8806d36dcab5c43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924283, "uuid": "95853493-be3f-4d04-a1e2-f485875eac48", "comment": "Malware payload (MassLogger)", "value": "31c8998aeb7d69fe6ce78ec6e73516e0032329e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924283, "uuid": "2929fce2-c88c-4917-b39c-d534a4bf2f43", "comment": "Malware payload (MassLogger)", "value": "022660c0514b6d8b492b2c461de7f1ac44a6ae1cc5e7afc013a7fd85144f561a6cbb4e819e10d5ae71882242413b862b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924283, "uuid": "5213d8a9-6187-46f0-b6e0-64876da16656", "value": "T1CF3512243656C523D9A26BF05AB1F7B903756D9E9D11C3CBCEE86D8B386BF042609343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924283, "uuid": "aa5d6f6c-de60-40ba-8a30-2de5be85af04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924283, "uuid": "36adcadb-7d10-4851-b0f4-bba2205551d5", "value": "12288:M3lzVg5OCxMhv3EzJgafdYyPd/yoh5f92JOK103kl4rrmub1xY0LzTtoIcsH7keo:/nMJOJJYc9yohyJOK0kGX1LHtokvG1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773924283, "uuid": "53e67e43-0300-4f33-907e-e1e3b74ba404", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773924283, "uuid": "40736371-411f-487f-b651-8d14baf23956", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924283, "uuid": "a495a23e-0faa-451b-b4ce-fa6e135c7d47", "value": "SecuriteInfo.com.Trojan.Siggen32.29264.18250.29244", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ad7a53-23c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773946420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773946420, "uuid": "9e759c4d-764d-4fa6-afd8-9201b70103e8", "comment": "Malware payload", "value": "c2c9e12c63cd9cf9a05567e2b90ab57c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773946420, "uuid": "66f8a5a1-cf4b-4040-9e4a-542bc6eefc83", "comment": "Malware payload", "value": "992fc254a18612926413e6317e13654efafc1d80fc670e0ee46ddcb128c49dde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773946420, "uuid": "5043aa13-9ec7-4483-ab8a-8ea72e032c77", "comment": "Malware payload", "value": "2d722d327ccc24c8661b59f2a12a1150796d0722", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773946420, "uuid": "ef1a449e-f73f-453a-9f25-8210b061f077", "comment": "Malware payload", "value": "d9a3d27c3dcf02eace97709afeba93a8d1c84beecb711a933e6342e2ec2d15bf8cb9a3144d81587add77ab78d5eb6902", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773946420, "uuid": "c410c01d-619a-48a0-a60f-7a454f6d797f", "value": "T181C34B1B77D1F732C21689FA2E1942B49069B9310092E80BFB466B1BBB71DD7E630717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773946420, "uuid": "4ff077fa-1958-4ccb-9893-01755b0f3942", "value": "16e6474d270d9eca80c1f676f4d9deec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773946420, "uuid": "4fb94ac2-d406-4547-a26f-70e3c44a16d9", "value": "1536:rlIaOM0dDlBZVeAaBIrJ0ENDRhqIyHyt1rxUJgZfaBhsJlQNAOEz1sEZW6TmD:rlIahMoM20THt1ri0faBhyQTEz1HW2mD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773946420, "uuid": "e01fc548-26e7-49d4-a426-3719490427d6", "value": 122881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773946420, "uuid": "99daebd9-e479-4591-8f15-608a6fa434b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773946420, "uuid": "d775821c-5773-4668-a7ad-36fa9ff988aa", "value": "992fc254a18612926413e6317e13654efafc1d80fc670e0ee46ddcb128c49dde.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b370ccd-23c2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773945415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945415, "uuid": "46ecdb83-1501-4ff5-8778-764798a27cad", "comment": "Malware payload", "value": "659917416922e3979555a265b750a99e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945415, "uuid": "a099ddc7-6292-4916-89d2-74992576a0d4", "comment": "Malware payload", "value": "9a3e12bbfb92c2a002c77aabe3db95b656ca575b67dfcd870eb9f409fa0c494e", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945415, "uuid": "29965d18-987a-4e22-bdc8-6aa9b133cc00", "comment": "Malware payload", "value": "7073a16ff405443b2b71e2b2f2d83362918034b9", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945415, "uuid": "834c86bf-7230-410b-ade3-43211c8f288b", "comment": "Malware payload", "value": "22a2d912d44d0b857b42dcfcc1e30617a9829f793a96070a0c8a8e4edb5ee59ec06a045910709340e1acb055442a92dd", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945415, "uuid": "26d4d762-c044-4109-aea8-de511708b1d1", "value": "T122D5272D2D458722D5EFC370172AC67A05396EE07BF744C762D8BF2A2970DCD5A32A12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945415, "uuid": "8dd7ce60-7a30-410c-86e9-fff05a329d2b", "value": "49152:FEJrMf+7UVZDEFegqYaZrf5jSTUialn4vLNgmUESIEjPMN2lv+oBjYqMV3eVougm:8q+8jSTBI4veHjPMNanYqMV39gASDUzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773945415, "uuid": "9e0b472c-e58e-4ad5-b33d-e74f98cdf2ec", "value": 2933760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773945415, "uuid": "15db2438-2308-4bb7-ac27-634df0754142", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945415, "uuid": "291b83cb-91ad-43bf-8fbf-0bc505fc5526", "value": "resources.assets.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b8abdc-2369-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773907017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773907017, "uuid": "2bd8d04b-9f6d-43b4-bbdf-476420267bba", "comment": "Malware payload", "value": "908541530e2db6f2f60a2a1c7802b457", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773907017, "uuid": "90d6ef98-35eb-4a6e-94e1-b32cfc1aad3f", "comment": "Malware payload", "value": "9adddf4aec898383ac1c244e671e57518da6b047e0db89a371e06bc6ba93b044", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773907017, "uuid": "7156b67a-eb2f-4ffc-b0f9-b23937ad3db3", "comment": "Malware payload", "value": "3ca73b734bc40a771b425e385e056a081c451774", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773907017, "uuid": "f5579afb-97d2-4316-b51b-8f7b66a9d71b", "comment": "Malware payload", "value": "e2efb46580aee692c78b532d479759a45f81eddb60716bfed39b80908c1c6a78ae0003ad908ac563f0aec1454667d3a9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773907017, "uuid": "d3c628ad-4ef0-4888-b1d4-4959f249f05c", "value": "T1CC13B7E83BC6B574820070F3AC16A06AF65D9C887354855ADBE778E8F41D338D6B4B78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773907017, "uuid": "24ec9d6b-7c2d-4955-9143-0429ed480e6e", "value": "768:Ni+XV+h04vVtZSNDa+43MNimD+IIVeVBsbY1VEkM9sRpLfYdtJdAIIr4uQlh:NVkRZs343mDRIVeDsMb2sRpLfYdtJ82r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773907017, "uuid": "b328cd21-35f1-46f1-a323-b8b1063005b8", "value": 41496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773907017, "uuid": "33f06cc4-2c4d-4f39-be27-dd0192da174d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773907017, "uuid": "98e74eb0-ed63-4125-999f-a9aeea7051b7", "value": "DEKONTLAR.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37096078-2398-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773927209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927209, "uuid": "fb3ad171-d59b-4b8a-8182-33786a5772bf", "comment": "Malware payload", "value": "fb9aabbeb798c0c20b5664a6c3f34599", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927209, "uuid": "a8ea815b-f42b-4813-aec5-272f5f934dbe", "comment": "Malware payload", "value": "9b2c2b79aa3ec0b9b77ce7c3f688707a272f6304d72d691d3464e0e7187ca8c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927209, "uuid": "afead0d3-0a67-4a73-bda6-63eb44c813a9", "comment": "Malware payload", "value": "126dd6863e459501f750398131972cabb9f57bc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927209, "uuid": "def4b222-2f3c-4358-a082-787eff1e6bfe", "comment": "Malware payload", "value": "99c001748e5168e720beaec78747be5d4a8e4f2da4759fb26aec5ac173bf262c2273254a92f7578b261d05deff3dfdbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927209, "uuid": "86468fa6-8829-45a6-9a6c-22e10eb92ba4", "value": "T140578C12A3C0F9AEC196E578C7178336D3B2B9DE036791CF1695D60A1E3379D4E2AE10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927209, "uuid": "1b649a79-6e43-48c4-ad78-77ac66dcf6ed", "value": "3880865c4ada4aa23c6d3174f1a65419", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927209, "uuid": "99a59132-33bb-4f42-9744-4b3f9adcbf3f", "value": "98304:ZC/ylhUCwPm3YQwet/G4TZQNnpZ367ls7viQKMsWA4iyYZay:ZC/ylhUC9wZJpV67lYKM6/pay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773927209, "uuid": "37333553-d9d9-429f-97cc-742a727fc140", "value": 29326336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773927209, "uuid": "773b5f62-cc47-41b9-87a4-2e4ad236cccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927209, "uuid": "03c39986-e115-4e8d-92a6-3ffb79440245", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3876791e-2340-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773889415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773889415, "uuid": "8dbfb6e2-ad68-47ef-858b-96681b675678", "comment": "Malware payload (Mirai)", "value": "4e0d2fd7baeb331a8ed845d703e388bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773889415, "uuid": "1e8b2c9c-d419-470c-bed8-6b17f7b26f34", "comment": "Malware payload (Mirai)", "value": "9bb50a9f99a39e885d5ad833275dadd7d70a6a40a23d6284a636b1e41d87e7ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773889415, "uuid": "0cbdd359-80f1-44d1-ad40-26d64cda7504", "comment": "Malware payload (Mirai)", "value": "2d0745a648527ac59b2c51cf5b63d6052d7e4f56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773889415, "uuid": "194a81cc-9031-4799-bc3a-02634e97d316", "comment": "Malware payload (Mirai)", "value": "d62c215f9089d5b49e704eccca248cdab7ed6ce1bb8e69c1ca18f03f44d7d2145c21b708d7412a49c0303b5ffc6cfcd8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773889415, "uuid": "cd6bf328-634c-47e9-8af9-79c5bb4f7f41", "value": "T18DA34B22B9392D2BC1D4A53A21F34365F1F3539E21B88A1E7D710E8DBF24A4036577B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773889415, "uuid": "98efc3de-52f9-46c2-859b-ff6adb189e11", "value": "1536:2qPGMDLvDRK4RTlThuveVzctb27J0XZ6mZ84Nk57vbo5sstYRLb:fPTTJVAtStEZ6mZ84NU7zzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773889415, "uuid": "9e81f25c-f9a8-4eee-919c-fa3cc78ce607", "value": 99476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773889415, "uuid": "0c1b3e51-f32a-4b98-9161-fbaacbd73611", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773889415, "uuid": "3f827130-e7be-4109-a6f2-0e4219492358", "value": "tuxnokill.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893abc24-2372-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773911026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911026, "uuid": "989bce38-b01f-44ad-85bb-70a433246b57", "comment": "Malware payload (AgentTesla)", "value": "79659d4fdbcd5597e8d78363a6a19d41", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8501998229", "colour": "#3CAE2F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911026, "uuid": "6b076ba9-a6ce-4c0e-bfb8-86d021fb3e38", "comment": "Malware payload (AgentTesla)", "value": "9c5ec99bb5acd3c06a8ca4b7abbb070bcfd29699865d85abe5198506ee4b4fd5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8501998229", "colour": "#3CAE2F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911026, "uuid": "4c00efd8-e2c1-4205-9282-a4d142577ccc", "comment": "Malware payload (AgentTesla)", "value": "cbe8af7556190760d51d2c768b3da6fbee96e941", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8501998229", "colour": "#3CAE2F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911026, "uuid": "018f76b1-0c61-4e9e-9561-fe268a1f4161", "comment": "Malware payload (AgentTesla)", "value": "039b373b55f08dad988ddb45d756791b87b3568983a131ddc9e36629fd52dca546f5b457b99af9d37aea9228560a7188", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8501998229", "colour": "#3CAE2F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773911026, "uuid": "3c714389-4009-427b-b529-5e9f48bfe8a9", "value": "T1F895337D807A8A07ADE8B1A61BB4C76ED834DDB61D99010B0FDED21C1143EA23E57F25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773911026, "uuid": "0ab452b9-8fd0-4c70-82da-1135190fab3a", "value": "49152:LevY9tewVDdVMZbV37QvsYl8ULfCh25k4W0ra3EdS3Fw:LQaewVDzqVc36wdWCdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773911026, "uuid": "8e918af7-a09f-447b-8415-281811d1abbb", "value": 1882401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773911026, "uuid": "a0fe9486-cb30-4bd7-b50b-8fcf1f60885d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773911026, "uuid": "6e78234b-603d-43ee-b8a9-6ad220fa91c9", "value": "PO 36222.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e5b60cc-2340-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1773889425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773889425, "uuid": "b888178b-66a3-4fa7-9227-4751b7d1de7a", "comment": "Malware payload (Joker)", "value": "9c33ffd69e2efb85ec1c9cd7887f66a0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773889425, "uuid": "dfbf01b0-fcc5-4580-a247-7ce26cfa657e", "comment": "Malware payload (Joker)", "value": "9c97d3197c004bc0b28561209d29a4d79703812a790a6f5ed6cbd62542b05371", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773889425, "uuid": "556dfdfa-d36d-4e20-9ccf-1fb2e885d889", "comment": "Malware payload (Joker)", "value": "bd176004ab7e74d124f15eca96cb2a0825ef6279", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773889425, "uuid": "89c46912-6094-48b0-b0ed-370fd1a51834", "comment": "Malware payload (Joker)", "value": "9d8a74a4c16724ff74966d1abab831020b79759803fdb1f7948a8e6b6e6e9b49b406411197ca9396d02aca8b5d73c094", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773889425, "uuid": "ed6d7666-2968-42ab-a28f-39f7c23c6e4e", "value": "T147C6239AE36CA02FD57B54324DBB132106574D478D83AB53BA18720C6ABB6C48F5EFC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773889425, "uuid": "15ac59a4-0893-4251-ac6a-74b19d4d7308", "value": "196608:lmaWiwIq5XJmrd9ym/LZz9G3OL4UGCGpcdmCkrAVjai7aMJY3bU3IOMcg/P7nC9S:Q55XJdm/LZ4VKdmCKaH7a2Y3bwgG9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773889425, "uuid": "aaf5ab2d-7083-4316-8463-61860e5a11f4", "value": 11651730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773889425, "uuid": "59cef81b-19db-4b9c-b895-288572d08bdd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773889425, "uuid": "5659dfeb-ed27-49eb-8410-98c31607fe0e", "value": "Smart File Cleaner_1.1.5.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36559b1a-23a8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773934079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934079, "uuid": "f7dcbb80-4a3f-443d-b371-c8e33cf99c70", "comment": "Malware payload", "value": "2e13d262e05d119862026fc0e27ce324", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934079, "uuid": "a702961b-d8da-4104-adb3-940dc2898122", "comment": "Malware payload", "value": "9e5948e8ec3dee70e159ee6129291aca7672d29f3b85ac13901624f886455af3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934079, "uuid": "89194d0e-a527-45c4-98f0-506d6784a35c", "comment": "Malware payload", "value": "4bc126cb9be24b5c42b69b26f67871d13238102d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934079, "uuid": "b8c85d0e-29ee-4142-9057-64312a520158", "comment": "Malware payload", "value": "20858756884a00fac67e75735a8e2bbf5ac902bd1c4009408916c43d987552311f5d91d44a1b08949ec5f905d0ec12fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934079, "uuid": "e921689f-f359-47bf-887e-76e9d5143364", "value": "T153C2D0847611EF12E61104732D9C9AAC497BE75A0BBF31618CE5FD8DC34A55B188F385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934079, "uuid": "30c845a9-f03b-40cc-b4dd-df0a3b9552e1", "value": "384:flzEBkDOvTCZuQEkymy/Gf+3pK9pGr39KKD6sq+GJ4kjNBrHKuxTnxl/KEuBmskQ:pwkyTc9pHiGJ7bLxlpuYPW5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773934079, "uuid": "f1bc0fe8-05ce-4ed9-bd6e-fdb637b43356", "value": 26828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773934079, "uuid": "e83bca7f-cbe8-479b-aae2-4c5b7f326ee4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934079, "uuid": "679cf9bb-560e-4195-a4ad-19a6f66f2e8f", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdbf6a3f-23da-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1773955889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955889, "uuid": "d3802254-007f-46a1-8706-40c537e34a85", "comment": "Malware payload (QuasarRAT)", "value": "63bddc2a7832d5a378b4eee4f1902158", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955889, "uuid": "461e5bc2-5c63-4941-b31d-ff1e5978ed33", "comment": "Malware payload (QuasarRAT)", "value": "a163f15064f9c28b10cad6f67bccbedb1562217fe83ab9a2a1966e210b8d287d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955889, "uuid": "b12a90e7-3292-4a0e-9c7e-1561904796dd", "comment": "Malware payload (QuasarRAT)", "value": "12c7dcb57f7c92dd68deb52a89562773abed4b41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955889, "uuid": "924df122-3f36-453c-9f14-6d758bdba65e", "comment": "Malware payload (QuasarRAT)", "value": "c9070506f23361160bec1f11802765a10cbd361d0c8dd2d60cd04bd49f7f9da2dea9cc25a0ffced66ffc0c213525b11c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955889, "uuid": "87c076a1-d31d-4806-a161-1f4ed6f5ebe4", "value": "T1BEE55B143BF85E23E16FE3B396B2544767F0F82AB363EB0B618166791C8375458423A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955889, "uuid": "7404cd34-e977-4fc5-a94c-dbc5a890fa71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955889, "uuid": "d28ade12-964d-4a35-a8f6-d45d89618116", "value": "49152:HGgrmJI39xbfZkCmn/kGGuMo8GlVXMuPGQURU1lTHHB72eh2NT:HVCItxbfZkCmnrGuFnlVXMuPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773955889, "uuid": "c242c0af-020e-4ff1-aad4-0ee0e8e8f984", "value": 3291136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773955889, "uuid": "3329dbff-2baf-4807-a634-1947c7e0c4f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955889, "uuid": "d26081d9-faa7-404f-a6bc-31680a03d674", "value": "nooooooo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5f6e67-2369-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1773907009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773907009, "uuid": "64eb69c0-48af-4b33-bda8-6005a492a6bd", "comment": "Malware payload (VIPKeylogger)", "value": "cacba2f03a0f7b17889dd49338d7fd16", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773907009, "uuid": "056b79d6-b693-44ca-bb8a-779fc0bae42c", "comment": "Malware payload (VIPKeylogger)", "value": "a2862e4d2c722c7bfc86aa6c2c589455659b7a4ce6bb15ae55706df40e0f1f4e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773907009, "uuid": "d0b061e9-3586-44c6-9a55-2eb806bdac4c", "comment": "Malware payload (VIPKeylogger)", "value": "375620949bf7dcb7d8947c7c5ce4337d09e9502b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773907009, "uuid": "25569ade-4a45-4508-88e1-6e3d15c9f26d", "comment": "Malware payload (VIPKeylogger)", "value": "43e4a2f099a1fa21471a9355e79ad5c9a082b3defaf59cb98aa713bc145518b1ab2af31aa4d5b5b84be464c8e1e7068e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773907009, "uuid": "112f799c-83d0-4016-bba6-e6a934593155", "value": "T11485B494E5ED8D2786DD74338BC8FC25B93A60AE34539E4D7F0B8F565E481388606B38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773907009, "uuid": "427ecefb-aa69-4d42-aab8-87b5271cd363", "value": "768:11qRVA27SDbivdMW5I1sie2DG3GuOoSr/wIQQlezJAAUmzoBns4kLU6qVmuUlSDF:Xgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773907009, "uuid": "a5fc4a3f-36e6-4568-8f10-9811e739ad08", "value": 1801714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773907009, "uuid": "3f21e047-1fc3-4526-814b-04187a09683d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773907009, "uuid": "f411df23-8807-4159-a4a9-dfab503e513f", "value": "Swiftpayment_14568180326.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8776eb69-23a8-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1773934215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934215, "uuid": "7efd5d57-2b82-497c-9bfb-146096b0d99d", "comment": "Malware payload (NetSupport)", "value": "d09dfc29de653430b275048afcd9e49c", "object_relation": "md5", "Tag": [ { "name": "freegaten-com", "colour": "#D4EE1C", "exportable": true, "hide_tag": false }, { "name": "freegaten-info", "colour": "#AE56C3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934215, "uuid": "9785f6b0-3c6a-4213-9e52-4fdbae8e0315", "comment": "Malware payload (NetSupport)", "value": "a47e3628d1e61b007c4c17d11678c1dd6b5b014efdef2afad34893da2fa8127d", "object_relation": "sha256", "Tag": [ { "name": "freegaten-com", "colour": "#D4EE1C", "exportable": true, "hide_tag": false }, { "name": "freegaten-info", "colour": "#AE56C3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934215, "uuid": "c65674e3-c416-41cd-b77d-939ea324a110", "comment": "Malware payload (NetSupport)", "value": "176615003e8c02c20299800c02a7df0c8810a504", "object_relation": "sha1", "Tag": [ { "name": "freegaten-com", "colour": "#D4EE1C", "exportable": true, "hide_tag": false }, { "name": "freegaten-info", "colour": "#AE56C3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934215, "uuid": "4201f71f-2a9f-4024-80af-aac135044b2c", "comment": "Malware payload (NetSupport)", "value": "5679b38867ca0826cdc2b3facfa44f885ed745a8cb32a30d310148e2f5f84a01f614a95672cb85e4d63ebb8200f57aaa", "object_relation": "sha3-384", "Tag": [ { "name": "freegaten-com", "colour": "#D4EE1C", "exportable": true, "hide_tag": false }, { "name": "freegaten-info", "colour": "#AE56C3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934215, "uuid": "6c20fdb4-b416-435e-9d26-3d8a7813d48d", "value": "T192B5336DBB44D3A1E98067FCCF9FD05206445F125B85CC22284ABAD977727E1A1B2BC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934215, "uuid": "621b969c-c31f-460d-9a6c-b12398f711fa", "value": "49152:hVzsshKJeAA5I3LOcoBYSHbzt9yTq2BeHzxK9H886V3/49Mu:ztib/oBYSPt9yTqEek9X6B/KMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773934215, "uuid": "90eab729-3163-413f-abfa-d30db56c7d6d", "value": 2269184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773934215, "uuid": "673bf4c3-ac13-447c-b074-958a66aba7f7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934215, "uuid": "e7ddd7d0-6373-4a50-8834-ac5099ec4db6", "value": "ID466943.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c8393a6-2395-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1773925876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925876, "uuid": "6cc1b7a8-f766-4fc2-bd08-81c3c8b6e524", "comment": "Malware payload (RustyStealer)", "value": "dd37be2765d341278d07cbb44c0d5962", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Xisu-Technology-Co-Ltd", "colour": "#1A0A5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925876, "uuid": "233f4cce-9200-4fa8-9c0f-73e971893b2d", "comment": "Malware payload (RustyStealer)", "value": "a63cb8de82ca6f2739e46a73c59d607dcf34e683c396aa0e4a4ce96d3666bfcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Xisu-Technology-Co-Ltd", "colour": "#1A0A5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925876, "uuid": "c1ea8ef6-025a-45fd-96ae-a149fa8a33d0", "comment": "Malware payload (RustyStealer)", "value": "2a4d802d60aa80d515abf7941064f18c5b835c56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Xisu-Technology-Co-Ltd", "colour": "#1A0A5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925876, "uuid": "033a077b-f111-43c3-92d2-cd282ffc2418", "comment": "Malware payload (RustyStealer)", "value": "e40f2cc594d209fec4517d17c893808fdc44cff8905df0b61ac5b36ae26ba5c1820353cb7acc334c2aaa6ea2691112f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Xisu-Technology-Co-Ltd", "colour": "#1A0A5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925876, "uuid": "ae00a655-9b4c-465d-b1d2-c61f19de5a84", "value": "T104C63703F19E40E9C019E077D75EE636E6727C490B6466EF37904AA33E66EE06E3C644", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925876, "uuid": "96887387-0c3f-4986-bb7d-158ffbb36ab2", "value": "1b69fb79e888a0caec78a8d6877bcb15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925876, "uuid": "2f9587cf-611a-4096-bee9-e820f20baa4a", "value": "98304:AepwsrCSD8hdTNtkPwvT7CUs8w8+bUzBEPaZ/Kwn+C4CyiG03Prfj:NXrCSD8hpkA7Cv8uPaZsC4CrG03Pjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773925876, "uuid": "94d1bbbc-d4ee-48bf-921b-8307e460a8e1", "value": 11916000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773925876, "uuid": "0ef0d4ac-301e-401f-b44c-af09e3a18b41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925876, "uuid": "3c0a1b49-7726-461a-b961-b4102e3e635e", "value": "a63cb8de82ca6f2739e46a73c59d607dcf34e683c396aa0e4a4ce96d3666bfcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b4ef02-2342-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773890273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890273, "uuid": "d6136b61-7352-417c-9d85-445b804db089", "comment": "Malware payload (Mirai)", "value": "5611c3edd06b6d6cbd7f75bdbd3bf62f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890273, "uuid": "b283873f-ca35-4bc5-ab96-a5a621d8083d", "comment": "Malware payload (Mirai)", "value": "a686bc271135eb760dc319d372be6f8238f3d6496c8dc62f7528e9a7f05d28ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890273, "uuid": "3d3b99c5-f8ca-4579-92e7-a47d66b99f09", "comment": "Malware payload (Mirai)", "value": "802c60b509f60f092acf676322d894fd5242518c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890273, "uuid": "59572604-f536-4ef7-8d39-68837ed8e360", "comment": "Malware payload (Mirai)", "value": "15ac47cb5c4acc03e77965d137c19c7f9c067556085c1903b90c7a0f21a8cab02182622b3eb24e9407d209a9f797b755", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773890273, "uuid": "93e375e2-77e7-4139-90b8-ef7b01358b20", "value": "T152A34C42770C0E47E5975DF0293F27E183EEE99121F4B6882A1EEB459172E32118BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773890273, "uuid": "a6845544-5c2e-4ca1-a058-946acc73f4c0", "value": "1536:aeR2Qx5LFioCdrp2GxZ+NUFazjwFjInC1my3ULSQ6Fo0aYpVOqdLi+y:NX+8Gj+xw2yS6C0J7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773890273, "uuid": "a0ac2d17-da1e-4a57-9add-085339c7146e", "value": 100032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773890273, "uuid": "5ffa148e-1aec-4380-967f-283af69d8433", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773890273, "uuid": "08e1b00e-b197-4975-b16a-b7027663f83b", "value": "tux.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "639bf777-2377-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1773913110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773913110, "uuid": "3737436f-a065-465e-be77-0000081d7428", "comment": "Malware payload (SalatStealer)", "value": "467b18ae2314e7a0b6f5e71127897d74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773913110, "uuid": "38d23ab9-943f-4ac1-8eb5-4337f3725697", "comment": "Malware payload (SalatStealer)", "value": "a9808690851c0cef6bc1758f59c27b82990dc17e6cf8b9f0fc5f0b2a20aa1031", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773913110, "uuid": "0bc31929-a227-4a1c-8298-5b7e45aab7b2", "comment": "Malware payload (SalatStealer)", "value": "f4ddb3feff43d504aae9447fdcc4163b4d7f8647", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773913110, "uuid": "c0ef6772-e9f6-4cca-8888-d45ec3a6d29e", "comment": "Malware payload (SalatStealer)", "value": "6516f34c5c202e0ed23fc455a8ccbb1006d8cce4ca865511faa57385ce7b28acc2c7b895b1d4178bb0784f54c3c64448", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773913110, "uuid": "c642f290-1f7d-4db0-a25c-9b74c4453120", "value": "T185C65C11FACB54F6F9036831416BB27F23315D048B28DB9BEB583B6BF877691186A305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773913110, "uuid": "077f047b-1e07-4ab7-9b42-715347de6941", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773913110, "uuid": "192645e6-9e28-4825-93f1-c4804fc1a81d", "value": "98304:5GsqTIVri2C3jGdD4/LowU4d3HVdiEqO/:aTx3jUDsRUWZqO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773913110, "uuid": "28223114-b56a-434e-aca5-442a915f3b54", "value": 12570112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773913110, "uuid": "b58f9f1c-54c1-44e2-96ac-d10ff97ebd74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773913110, "uuid": "f17fc1fc-c054-4516-9465-d872cc4d8844", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0724170f-23c3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773945597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945597, "uuid": "cc226b81-4689-43ba-8b14-c36787d37a40", "comment": "Malware payload", "value": "6f0955ecc584a7f533926e2e6e27a0a3", "object_relation": "md5", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945597, "uuid": "cf62f6b5-1591-45af-8b5a-f3b3e99a3026", "comment": "Malware payload", "value": "a9c7e502c49b3fe1d23e124f15ffbd7a42e9646ba46ae00669db60ff7d46a6e0", "object_relation": "sha256", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945597, "uuid": "514350e7-4238-4c3f-aa79-7c62a32d5a62", "comment": "Malware payload", "value": "82d6ec6c1f7552b960fa4ee8057ea379aba2c1e9", "object_relation": "sha1", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945597, "uuid": "b3814a9e-205f-4448-ba01-ec21b9f956b7", "comment": "Malware payload", "value": "f2718d30561a145fe2734b8325076e313443d8a913733a1f146401bf6ca3c785f67e721f36b2c5ee2be68fce5a67dde6", "object_relation": "sha3-384", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945597, "uuid": "dad1ebb2-8c4d-4d9a-bff1-b12e972ae619", "value": "T10A71DD0693E8466BF4B70738AEF7531267B0F9608F73977D4980521DACA1AA84D31BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945597, "uuid": "06b60c3b-39c0-4600-992f-2336bf1922ea", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945597, "uuid": "90c9e4ac-6d2c-43d1-baff-1a6b19bec83d", "value": "24:etGS4sh2WEMqlB3luyq4usdrj2cTbNtkZfpao5p6DzGWI+ycuZhNiGakS1XPNnq:6dHqjl9tuNJpaepQzN1ulLa3nq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773945597, "uuid": "8b48013b-69d4-4fdb-9f58-37c55bd86d11", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773945597, "uuid": "66a9c44f-a214-49ec-9f3b-cc56ad401de8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945597, "uuid": "a744b9f0-3dbe-4d8b-a659-8dfd1a9b6e83", "value": "jig4g4ew.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e4f769c-23b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773940669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940669, "uuid": "18276c19-4364-4254-8f9f-8d607341bf62", "comment": "Malware payload", "value": "ba4660be665d47aa147eb02e53f0d146", "object_relation": "md5", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940669, "uuid": "45c99eaf-66bf-4134-bee5-458aaadb36ef", "comment": "Malware payload", "value": "ab2072ea9875d18f277462b80b10835a54c863ef4545a8ba821fff05291bc592", "object_relation": "sha256", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940669, "uuid": "528de6d9-e8d1-4906-8152-2b21602d0d07", "comment": "Malware payload", "value": "f2ef57d4137216872eb251a8d57a18eca62bdddd", "object_relation": "sha1", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940669, "uuid": "ac36271c-dc1c-493f-82bb-5dc4cd631001", "comment": "Malware payload", "value": "adc936276de52459f1e705bf299c30b041218286e8253f349cc1e866f3b305e2085558a5c2098040dfac5268f7be4e3b", "object_relation": "sha3-384", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940669, "uuid": "49c47770-fc09-42e3-b1f4-6ab749965f94", "value": "T165E5F13FB28B653EE06E5A367AB2E210583B7A6165134C5696F4C48CCF250B11E3F787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940669, "uuid": "f4cf56db-67d6-472d-9bdc-3c0d8a8a4428", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940669, "uuid": "16a3f44c-9752-46dc-b00e-837fbe4ef5d6", "value": "49152:fuI2hU90i6Ds9TGcLhB/KDMnQzEcR1l/dVymTVQJXOWpC4kFIr9e:f5OtinTtLhB/7WNR1l/do4yk2r9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773940669, "uuid": "0840648c-82c3-4d7e-8ee1-f78b896f7072", "value": 3264160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773940669, "uuid": "22d48b73-fba1-4a12-868d-a503b94120a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940669, "uuid": "aa4c5121-edd0-415a-81f0-103fdd018b36", "value": "ab2072ea9875d18f277462b80b10835a54c863ef4545a8ba821fff05291bc592", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f4063d-238d-11f1-a769-42010a9c0008", "comment": "Malware payload (Expiro)", "timestamp": 1773922429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773922429, "uuid": "feea45f9-bfc8-40b0-bcfa-357f57c01f07", "comment": "Malware payload (Expiro)", "value": "a94af59019be2fe1aeb5bc36f314b975", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773922429, "uuid": "2543a6db-112b-479d-9f1f-93dbee5e8c4f", "comment": "Malware payload (Expiro)", "value": "ad846f4c69c3ffc0399a4314cd9aabb3aa966c68f01e7106dd5165bd6c5a724d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773922429, "uuid": "61997d52-eea3-4a65-8788-b2521a7d01ec", "comment": "Malware payload (Expiro)", "value": "b6acfa63f87b26517a4572727b9b8a4bed784e18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773922429, "uuid": "781d1366-399a-4192-a455-e7a5b0d9cf8d", "comment": "Malware payload (Expiro)", "value": "0f21084fb0abab3484fbc5cefc1dbcad4ffd7c428ca57262a46947fbeb6a3f8fef2c13bb34455112afd775088321d7df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773922429, "uuid": "c5d24b88-5787-4602-8695-8cb524533fb1", "value": "T176354A16EA51A02FF45789B1797956867C293E361A80EC47F7801FA930B09ABF1F071F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773922429, "uuid": "977ca13d-f96e-49c3-8b6b-56b93794373f", "value": "1772da47331d23c33a60726080f50627", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773922429, "uuid": "7c35fd3c-9b82-4f79-8500-40c282493394", "value": "24576:0NaHqBs9+UklX2Vg9N9JMlDlfjRiVuVsWt5MJMs:2aKBM+zVygFIDRRAubt5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773922429, "uuid": "20902be8-1041-4670-a988-8b15835068c2", "value": 1159168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773922429, "uuid": "09a13c2c-89f1-4fda-8e17-6f6aace5bc53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773922429, "uuid": "95c85dd2-ad09-449d-a0e5-d31a21ec2378", "value": "COTIZACION FERMAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13df2dab-2354-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1773897944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897944, "uuid": "cba025d3-df63-4143-a5b5-3b7e97bdaeff", "comment": "Malware payload (SalatStealer)", "value": "6c102d4c1f4232809d1485c9299c923d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897944, "uuid": "b5a68505-f9ba-426c-bfc4-463b58d40812", "comment": "Malware payload (SalatStealer)", "value": "adf45c63c44bf4d8247cab1e2651946d076d5871fabc0147fed9b53ea8493963", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897944, "uuid": "b3fbbec1-9357-4842-b6f7-c01c22b3af39", "comment": "Malware payload (SalatStealer)", "value": "c33df059e84e0e74f00633fd63249a5dd540a230", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897944, "uuid": "5c732bcc-4d95-43a3-baab-ae04ed50a337", "comment": "Malware payload (SalatStealer)", "value": "1a6462ef8988bd818053313b577d383c9d57e79b76ef80ea8bfa1a89c1fd3365cd304cd785e26f3aa3a3182d281e6c0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897944, "uuid": "607fc4ed-4a1d-4185-8f04-90ea96b66f08", "value": "T1F6D65B15FE8B94F5E903583141ABB27F63305D048B38CB97EB447A2BF8776A11A7A305", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897944, "uuid": "101a2646-fe55-4e46-ad4f-92d552c502d7", "value": "49152:jE/76EcVmmidz3Q9y3hynaL6RQTnsZLGKNyk1guOdOF2h+91ZccdxWLCFCgbdOse:E7vcj9yReW64nXXGT6g5DO453HVdjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773897944, "uuid": "f5ce117f-b421-4661-b430-f7b2a99afe2e", "value": 12924928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773897944, "uuid": "f7248c4b-0838-42a7-8577-37a94a8c5a82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897944, "uuid": "4598bf0e-9b35-4151-bf58-8387833e3bc3", "value": "bf92fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d58e1d-23b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773940734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940734, "uuid": "cbf7f9ca-0dd1-4ddc-9542-89e4a787b7d9", "comment": "Malware payload", "value": "cf914b9b26bf7e336ac1fab2f818c0e0", "object_relation": "md5", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940734, "uuid": "ebd2c897-a4a9-462a-b18b-e51971df3c42", "comment": "Malware payload", "value": "adf94bff0ef5bc2b9acf48b637c877b36c5bb2446e33116ecaee174b5989d0ff", "object_relation": "sha256", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940734, "uuid": "c4215696-fdee-445f-9637-65e566b914d6", "comment": "Malware payload", "value": "8b23d86f04dfc5802183a1fad1c75d5790b654f6", "object_relation": "sha1", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940734, "uuid": "ddada160-085b-4b6b-b664-62911a9152e0", "comment": "Malware payload", "value": "a77e2360155e8d5c1c8dcf049e60b69ab521e159bfacfd75e15508e49c4e615e8f52d6c4003f76a4b5f141a87813791e", "object_relation": "sha3-384", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940734, "uuid": "e66e93e6-18b3-40a1-9ded-c303dcb13a1a", "value": "T156F3CF413BFC4822CAAF4FB914F21141DA32A70B57A2D34E649C90BC7E5AB950F167E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940734, "uuid": "314825cd-dfd0-4704-9f02-c8597b7bdc03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940734, "uuid": "5fe25a06-effc-4921-aecf-d3cbbc12bbee", "value": "3072:1qvZr3eqUGbr9QjsuMjziqX36n4suMjziqX3PXaU3Quxqt42L9u7jziqX3HdMVZb:wZ3eqUMQj1MH7X3+41MH7X3ykN0t42LV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773940734, "uuid": "9a6ddb9f-f108-4776-86f3-aff9ee2048e8", "value": 171208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773940734, "uuid": "8a87a74b-5f85-453a-a1f6-8fbf40202e1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940734, "uuid": "39d8fdfb-f899-46c9-9e29-c9ec4f32b432", "value": "adf94bff0ef5bc2b9acf48b637c877b36c5bb2446e33116ecaee174b5989d0ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e923fe-2345-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773891872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773891872, "uuid": "96ac12af-ffdd-4ed2-8448-c873ba9d4606", "comment": "Malware payload (Mirai)", "value": "ea3266ec63e7716d209033b3b522ec41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773891872, "uuid": "efbd9952-b494-4a03-8ca8-93d124a32c01", "comment": "Malware payload (Mirai)", "value": "ae479532635b3ea5e296c9266f09cf7a0b532b3c731ba96885a719372396de55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773891872, "uuid": "3b45068a-f4c2-4a73-a5e9-029b226a6b20", "comment": "Malware payload (Mirai)", "value": "25c527be5bf8e24084bc33a7d9312e34599f81a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773891872, "uuid": "1c88cde3-504d-4741-b60f-7b069dc8cf80", "comment": "Malware payload (Mirai)", "value": "bb4bd7a1d9ac02a671f47c5666e47c77bfa5976d1d4ceccee6f9a7b3f5c345a360879c953252956489b0d1b4fea4e8ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773891872, "uuid": "72c01ec6-57d5-46fe-bb96-cd739394f9d8", "value": "T17783BE62D418AD94C294867878F0CEB85763E84082D72FF7496AC27E6407EECF5593F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773891872, "uuid": "130fd6e4-6703-47ff-8eb9-aa80b73d5dd0", "value": "1536:rcADwkhdLPxkjL00WC1HfLSmqNsodK3KrRr4kWC8zw8nkN7Z2:rc+3xk300HGmquoE3g4dqQu7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773891872, "uuid": "3d5713d5-6de1-484a-86fe-b38337dc06ae", "value": 84180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773891872, "uuid": "005cc8f9-05b3-48ee-86aa-957113f016dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773891872, "uuid": "2e7ded06-af83-4b87-87ce-c1df92847bdc", "value": "tuxnokill.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4728439b-2395-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773925947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925947, "uuid": "25f6b586-daa9-452d-a1c6-db90fd3f5350", "comment": "Malware payload", "value": "9f9f6ce28738f9b5aabf0d07cc1fd20f", "object_relation": "md5", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925947, "uuid": "c4a239f4-173b-4124-8a78-5d1ae198e9d8", "comment": "Malware payload", "value": "ae91e1e3316e47747182650317f0a1810426bfc9a70d1dc46d4d12b3e2f79fa0", "object_relation": "sha256", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925947, "uuid": "47027e29-2edb-4e05-b9aa-55d30bb43693", "comment": "Malware payload", "value": "258a7a4b46a790614a0d16c8ebbe251a1c14b659", "object_relation": "sha1", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925947, "uuid": "3d16d82e-4c8e-4b57-a4e0-194fc60e4513", "comment": "Malware payload", "value": "4758d98bcb32b4a4925be52640656291e568eb6bfb2b6efb614985cbab21ce56ea1ae8cb3f802c7bf726daafab0b513b", "object_relation": "sha3-384", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925947, "uuid": "85428e80-7eac-41e2-b067-d1090cd7a282", "value": "T10276CF307A8AC036D62E01B1AA2DEB6F953DBE720B7144D773D87D6A19308C25736B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925947, "uuid": "daa80a43-e235-4429-ba95-4ca2a862a287", "value": "98304:iiI/uKL8gfAJSnqFozxY/XuFtN6xRwAMcu89r0qaa0+POq/5:HKhA8nqiMu7N6xeBR89rPaa0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773925947, "uuid": "a7a212a6-4d0b-4457-9437-ae6006f40844", "value": 7462400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773925947, "uuid": "2ddae0f2-d9a9-414f-90eb-e336fc01f829", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925947, "uuid": "78fc1c4e-8243-4544-b8a5-684ca44c059b", "value": "ae91e1e3316e47747182650317f0a1810426bfc9a70d1dc46d4d12b3e2f79fa0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db51f8fd-23a7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773933927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773933927, "uuid": "b2733db4-eccd-4f5d-8796-645614bc3476", "comment": "Malware payload", "value": "86c7bef3d2aa0cbaafa27bb8772b5c7f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773933927, "uuid": "9cbd5b44-775a-4afe-a1f1-431e3799e151", "comment": "Malware payload", "value": "aeb6c843ee38c043a99ad5a080a9676bc452a2733a4bb9f5678e692359a51b56", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773933927, "uuid": "ae0daa0a-4c97-4fb1-8d75-cdae6f96a043", "comment": "Malware payload", "value": "1cded0fc0542e869e6e56813c355ec25fe28efc6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773933927, "uuid": "31c8d12b-167d-4481-9161-7351a67527f0", "comment": "Malware payload", "value": "4f232adf22f7d98b0bfc8b248380783a2e8b892afaa5f06379b0e923c0fdb5a5e1a21b8d9f954feca9198db87f536fe7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773933927, "uuid": "0b9dbd06-a87c-4769-b2a7-0862b66a00db", "value": "T18AD3139DF8A529254D827022C4B314CEEBF3BA6151315A30C1EB64A3BBC1D174FF52AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773933927, "uuid": "d00276b5-b20c-4922-9a3e-4919e7febc91", "value": "3072:34PyihsW7uTSI7KL5WI/rD/3SCjhLiSDfs94NaFcKAD:jW7OSXUWrD/3SCjh/E94NaF+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773933927, "uuid": "f9469040-34e9-41e4-af26-8b510e09a757", "value": 140621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773933927, "uuid": "3f1469af-433f-43f7-9b32-1214a1a34517", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773933927, "uuid": "68d593d2-73e4-43ec-ba9d-a60a99023f01", "value": "plugins.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c225fb-2369-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773907023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773907023, "uuid": "cc059a0f-eb2b-4b7e-9911-b86c82f88cd0", "comment": "Malware payload", "value": "e35b1c910e78e82b66925a41911b6f9c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773907023, "uuid": "4145a475-838a-4691-869d-ac2790e87f13", "comment": "Malware payload", "value": "afc14f8ce7e4f0ec1d5c06b91e0a45908195282c646c0f58d64aa488f964f74d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773907023, "uuid": "7c60e2ad-b14a-464f-9b03-a23d18f0fce9", "comment": "Malware payload", "value": "f2096e5d123aabb23d4ab16308f7dd6a8c8be86c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773907023, "uuid": "3106441c-fad8-49ec-bd14-7c6c2d644955", "comment": "Malware payload", "value": "c2a6505363fac2d512ea03a64893683fd8a432f01c6e1d0c76892cc5186a2a5a9b3e00129517381a49ed798e0e1e3165", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773907023, "uuid": "26c80db1-7d2e-4088-acea-95937ae709ac", "value": "T1E091C91853D4264E83CB9FD22E7B4CE1FD015468366806DBA480BFB5BD9AF18D29DE34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773907023, "uuid": "d68fc064-de9d-420e-b902-68f2808fb53f", "value": "96:5G2xJykR9EH3b3dlDQ0ER6XcxnXQxGqR19aFIM:okyQ92lDQ0ER6XcxXQxG619aiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773907023, "uuid": "6f65b5bb-f04f-4d6e-9f05-0ab4511e1511", "value": 4264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773907023, "uuid": "d66c1e99-b6af-442b-a11e-ade158d42d22", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773907023, "uuid": "a3789cbf-d7ae-4b33-9903-15697674b513", "value": "Upd_te.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c8e27e-23a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773934422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934422, "uuid": "c1f247d0-0f52-4e73-b777-78fbecb5b83b", "comment": "Malware payload", "value": "ad641c71913880e83da5ad95c22bbf1b", "object_relation": "md5", "Tag": [ { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934422, "uuid": "8cc4e4ff-394c-4533-9f0d-65ce52a261bb", "comment": "Malware payload", "value": "b0513b62412a40d81ca1c4bfaf4c0f158aafb5a2aefa7edff847d26ed5252865", "object_relation": "sha256", "Tag": [ { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934422, "uuid": "9bea0d4d-ae1c-463f-85f0-89477f3d1975", "comment": "Malware payload", "value": "9dbb975693d7b76cc757dbc91184907f35f65b33", "object_relation": "sha1", "Tag": [ { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934422, "uuid": "18e52da1-1abf-45c0-8102-f0af05238faf", "comment": "Malware payload", "value": "97affea754caad4bcb45eb8092ae83359c1110b82ee5505828d1987e2f12e89d5961e6305909070def18df1db4daf989", "object_relation": "sha3-384", "Tag": [ { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934422, "uuid": "1d80a106-639a-4240-bba1-64747f6ae977", "value": "T13452C076964B130ACCDC4ABDAF848D9AD3625F052CADE24F4BC472172A4169EF087907", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934422, "uuid": "a11f8cd3-a72d-4fd9-ada2-6ae3c39ee653", "value": "192:pxP1nyKbh2J6YqFLdlitvDq2ROp2vz8Gn1oVFltWkIOoeXMFb/+J:HP1pzFFGRnROQLvnmL/JMFjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773934422, "uuid": "72f645b4-c1ef-4a8c-930a-7220065beaca", "value": 14077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773934422, "uuid": "286692fe-92fa-4005-ab2c-8f44a391f377", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934422, "uuid": "db7315d6-94de-4bb3-9536-8a00f91d0201", "value": "db2c3b131d8682d79e94d516248e1d9103c9e5080be8f045fd36b53533276f3b.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "802b1f4a-239a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773928190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773928190, "uuid": "75b1accb-2998-412a-a2b7-245a1affc6c4", "comment": "Malware payload", "value": "13ca2c1f3a53465ea1b7945f33c158a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773928190, "uuid": "d238a636-be39-4608-8f4e-c42b2056b2cd", "comment": "Malware payload", "value": "b097951f7df772bf4676225866c3c95946a7f9b7daf6e2c811ccea76de99e918", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773928190, "uuid": "65d67e40-d0e7-433e-b39d-fbf52194efb2", "comment": "Malware payload", "value": "8862c4e39f1853f0158746e04562e8a7ff7daad3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773928190, "uuid": "cef3ba62-6113-4a16-9149-0c181fb80e42", "comment": "Malware payload", "value": "27fd233baf8a329e6190da141acd1aaf603ce8261f49109179878399af98b06e830ee1fca8baa12e2e804deb22317ede", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773928190, "uuid": "509be677-8aae-4504-bd57-638acd499d66", "value": "T1FC973370AC52D45BDAE80973F800A6306E6CE638671BC577CED3AC0C78545A52EFF269", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773928190, "uuid": "8b23409e-8f99-48a3-99bb-0cf8f0fa1983", "value": "dc78060b861de085d3b25326d5393553", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773928190, "uuid": "ed9239bb-95bf-4c44-93ba-2cdbff72e3bc", "value": "786432:zsuGbYKVmQr+lCERftoPjdaZb6rNuHM3Lgd/910v0TH05Y58rTuAzr:opAY+EIbCNp7C/91rU5YWxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773928190, "uuid": "6adc6bd8-1641-45d2-91fb-af8d4a6f919b", "value": 42895468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773928190, "uuid": "35b56842-858f-4f4e-8856-654fec868e4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773928190, "uuid": "54978966-0833-4747-b1c9-e2189c5d8532", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b389ffea-2345-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1773891769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773891769, "uuid": "a0a83d5a-b8d8-4596-89ca-14f769f71917", "comment": "Malware payload (GuLoader)", "value": "475344cf8eafa2bc4c6d50a7b0f1575d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773891769, "uuid": "b9d72bbe-2a83-4de0-afb4-3c27765ab659", "comment": "Malware payload (GuLoader)", "value": "b14ffb777287fa540f571f2acada09336b4f687b01ceb69ef236b9af0b68b6e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773891769, "uuid": "922539ec-279c-46de-bb97-6e9334cedb48", "comment": "Malware payload (GuLoader)", "value": "54eebbaa42647c905c497980a8a6c0e01083346a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773891769, "uuid": "4981c515-bd33-4992-bc4c-94108ca3d650", "comment": "Malware payload (GuLoader)", "value": "258ba35f34a902454c4e7fce57eb645ce127d4449afe9a36e0d3f7f92da5a4802979e224748db3a691b31c236ace3581", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773891769, "uuid": "c0941c32-c63a-47f6-87ad-d300f279cd3d", "value": "T16394E003B6809662C1650731A8B74B3C27736EA85B724B0F635CFF753AF72925A4335A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773891769, "uuid": "f09eff17-54d0-43de-8ec8-a70a2157ad46", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773891769, "uuid": "455db9b2-866f-4339-a263-0be3698ffe59", "value": "6144:QhRMPAEwuZ0NTcIoh+XoHKAPNnxT8634BQOd71Rk/tWDsF2nnjfVq5h8B:2AAwYJoh+XoHRnxT8634BDdAILnjfsnk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773891769, "uuid": "b81a13f5-58cc-465d-a48a-d1aaf2673f8f", "value": 436832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773891769, "uuid": "9b19bb32-e71a-423b-8a8d-cbe8f1d1684a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773891769, "uuid": "dcd9875d-c111-48b2-995e-6c87319458d0", "value": "First_Tranche_Payment_Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5706a332-23d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773955180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955180, "uuid": "e558cca5-f851-4aaa-8b5f-f09b151aa78b", "comment": "Malware payload", "value": "be6f1f890c3016af6c14eb17f0fccea9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955180, "uuid": "33cfe581-7346-4ed6-b221-6a7eccb8014d", "comment": "Malware payload", "value": "b1599da80f790e8ec4057e2f8794c81a1b03cba12efe57f754e62626ef6b74ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955180, "uuid": "0d276017-08db-46e8-9f06-ce8aa89ecd8f", "comment": "Malware payload", "value": "b5945598e68f4372d64c97d8372459f3ede84060", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955180, "uuid": "21cf9ac6-3ed4-4fd9-b920-ed18f68171ce", "comment": "Malware payload", "value": "326f3ba5b37fad7473f829ffa72cd28eb9ec4455f6709ede9618dcc1fd6dcf46a1020acea63484e2c7e5b0ae7421c00d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955180, "uuid": "e437676b-f6a5-47be-9e36-9f957f4c6c82", "value": "T1AE36FA15AD812B66C2DC137845EE675622503E499B95072323A8FBF83E3733DAF5788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955180, "uuid": "c6cffeef-90f8-44a7-a8e9-71f6512c98b2", "value": "49152:VmvdLv7slfUSjixN0AuL4l/EZlWSfJYdj11:V+7EfUS9Js", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773955180, "uuid": "e0d2ea7c-60cb-4ad3-95ff-66a43a29fe86", "value": 4915200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773955180, "uuid": "03d5822c-f7c5-4bb9-9211-150e254613da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955180, "uuid": "2f59d129-3803-446e-b23d-e61aa7c8ed80", "value": "linux_mips64el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779444ca-238e-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1773923022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773923022, "uuid": "1a4d34db-fa09-43c0-b388-e9ad2d358dee", "comment": "Malware payload (RustyStealer)", "value": "bdb32ed6384606cf953a8557e8f2147b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773923022, "uuid": "04240737-6380-422d-a047-9662848dd178", "comment": "Malware payload (RustyStealer)", "value": "b19e9d14ae598c8933da4a6e3d7e3be670cecaffaf9447f600eab1e70b120a19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773923022, "uuid": "9cf0b974-b71d-4817-92ba-b8dba08be75d", "comment": "Malware payload (RustyStealer)", "value": "3040971ae8e16f75a734e682157d21cf1b7d0c0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773923022, "uuid": "db16dbe9-32bb-404a-9c5b-a5c27456fdb9", "comment": "Malware payload (RustyStealer)", "value": "6abed8f3ec86d5aa037d5193804090bffb509ede77edc65cae0a77f6382592dfa7fad5edc5aed1e0aa6002c3c16d38ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773923022, "uuid": "f789ae67-8baf-4a9d-bb7f-87d6a369bf95", "value": "T14CD67B2024D86607FD7ADFBE89DC76440F7AB2917723FA2897410DED4FD1B49CA025A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773923022, "uuid": "04bb4757-e365-4855-9506-d99de492a8d5", "value": "196608:KpsdJGCLJylmALc91+1rSdL6pYdhsJbzE8CJgLh36WXwGzjS:nNLclcIqepY0JfE8egLR6Uz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773923022, "uuid": "418294d1-a520-46c2-ba5d-7b46d322d2f8", "value": 13598720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773923022, "uuid": "d26532bc-e7de-4107-a661-9ad6fa84af6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773923022, "uuid": "1ec0e2d3-4a6a-4993-b3ac-a9296038625b", "value": "Adobe_Photoshop_2026_Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2356d205-2395-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1773925887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925887, "uuid": "af590fbf-26de-4bc1-bb09-4740b99e7894", "comment": "Malware payload (RustyStealer)", "value": "1e0fef9f87f222de6cf25a53e167ec6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Xisu-Technology-Co-Ltd", "colour": "#1A0A5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925887, "uuid": "15df87da-5bd0-47ce-8cd4-654e05488faf", "comment": "Malware payload (RustyStealer)", "value": "b382d5c1e3f942eb010c44c69943ffe38e091fe2baf5a2c41460bd38827cc39b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Xisu-Technology-Co-Ltd", "colour": "#1A0A5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925887, "uuid": "4e0d74a4-9c58-43f8-b692-0bd2fcb0459d", "comment": "Malware payload (RustyStealer)", "value": "a9fd5caa81e0af03bb4032163dc5a32a881fd3cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Xisu-Technology-Co-Ltd", "colour": "#1A0A5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925887, "uuid": "7ff96101-d15a-45a5-87fb-2c71bd13f903", "comment": "Malware payload (RustyStealer)", "value": "e1dde9a1b74f29c92269b063b2d831f42f33f54a5a7a58edd5f4c89b459ad8cc109c987456927c06b96bf04b718d2451", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Xisu-Technology-Co-Ltd", "colour": "#1A0A5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925887, "uuid": "e474d56c-1325-4578-acfb-906befd8f7c6", "value": "T152A62703F19640EDC019F077DB5AA636EB617C490BE466EB26904BD32F63AA07E7C750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925887, "uuid": "c5799a46-07b9-4cc0-ba5e-dc450c7a2000", "value": "fce2943ec8f906970387f12d880131cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925887, "uuid": "0439dae3-8a6d-473f-b040-951f0cb8b9f5", "value": "98304:12xoxFadIhNV11PPwvT7CUs8w8+bUzBEPaZ/Kwn+C4Cyi8ARC0:sexFaKhd1PA7Cv8uPaZsC4Cr8As0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773925887, "uuid": "753f7210-dee4-43b1-a82e-52ec89ccd7db", "value": 10132192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773925887, "uuid": "7af09eb0-c50b-48c5-9adc-fb021cf17e47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925887, "uuid": "635167be-6a53-47e5-884b-e72dcab1a6e3", "value": "b382d5c1e3f942eb010c44c69943ffe38e091fe2baf5a2c41460bd38827cc39b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e72251-2395-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773925940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925940, "uuid": "0ff126fd-1163-4a76-b72c-98366d6830d8", "comment": "Malware payload", "value": "b24b1d7e34998c87d5705c07221c8932", "object_relation": "md5", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925940, "uuid": "0a9e1deb-2958-4b78-9ece-560273c4302f", "comment": "Malware payload", "value": "b4d4f6d9b498d557d205004edd64662d20f543cfb80a4cfe8d144278ba8da61e", "object_relation": "sha256", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925940, "uuid": "e0bb0149-2d0e-4830-9d48-271d52299730", "comment": "Malware payload", "value": "d22c992d1cdbf9d563c40935c994e5a31ca2a74d", "object_relation": "sha1", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925940, "uuid": "1c3f7c07-b792-4855-a6b2-dc420703d0ff", "comment": "Malware payload", "value": "20e1b0972ba5491605ef68a6b9dc3d1367d42e41100192114837456a09f96066d5dab2bed1d69f5f3ba4074e2ee0a091", "object_relation": "sha3-384", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925940, "uuid": "4d60c887-a779-4e80-8630-ae1c81bf8edf", "value": "T1F276CF207A8AC036D26E01B1AA3EEB6F953DBE720B7144D773D87D6919308C25736B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925940, "uuid": "8dba5430-c5be-46b3-887e-f5b312b8fa03", "value": "196608:ycvWSuXYyVCh8mfjxx1Prh7S89rOaIc6RToH4CEXXl:ycvluoy3mNx1l7S89q7NdoH4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773925940, "uuid": "8ae626a6-7208-4951-a2b4-dcb312345693", "value": 7628800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773925940, "uuid": "6057de2d-804b-4e2f-a915-8aa601e59e7c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925940, "uuid": "46a34df8-cb1a-42e0-ae0e-b8224e806d1b", "value": "b4d4f6d9b498d557d205004edd64662d20f543cfb80a4cfe8d144278ba8da61e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af4869ef-2389-11f1-a769-42010a9c0008", "comment": "Malware payload (DiscordTokenStealer)", "timestamp": 1773920968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773920968, "uuid": "7c511982-5d09-4c06-a51e-611d88a7348b", "comment": "Malware payload (DiscordTokenStealer)", "value": "12675189f8d2f871c6d4d2013fed7671", "object_relation": "md5", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773920968, "uuid": "8e46bbd7-70f1-4b89-aa38-d5b3dd7e98f0", "comment": "Malware payload (DiscordTokenStealer)", "value": "b53589acd4328cecee09eea88187cb0f1e2fad6ab5410ebb2e6f6a6e5b35f3fb", "object_relation": "sha256", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773920968, "uuid": "e1e5a3ac-1e0b-4bc0-a38c-4e41ce178494", "comment": "Malware payload (DiscordTokenStealer)", "value": "72d1e4fcc85e5d909d61ab196aa8909cff93fc51", "object_relation": "sha1", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773920968, "uuid": "09d9bffd-cc2e-4cf8-bc1e-b46c51bf74e4", "comment": "Malware payload (DiscordTokenStealer)", "value": "00fb9e4b3ce84f67bb37d6a0ba527e1394f76222a395ead851c456e6261fdf844a30bb5b331e6796cf78a84d2c0c0b59", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773920968, "uuid": "7803afd9-abef-4582-8aba-da8540afdfdf", "value": "T1AC0833910AF95894EEE701399C1A224B92B1B130A37DCBCF87F597D0AF530B56C3DA61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773920968, "uuid": "fc22058d-8992-4101-bb2d-a88b1ed1320d", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773920968, "uuid": "a16df80b-bcf9-49c0-8791-a16137e9bb1f", "value": "1572864:chhY7GuW8Wm8T57NoXZMs2lHK8o8iLxxtQ6ZKjY7+UDhQ0pM7:chIGuWHNT57N1OUcrgYZppM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773920968, "uuid": "3d1f5cad-7f5e-46f4-bf88-8fd5076a5f5a", "value": 79980014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773920968, "uuid": "13ab86b4-47b9-4d14-9e30-ad68f0a163c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773920968, "uuid": "796b8c28-2ea0-4a33-9dc1-e1abfbb6e9b7", "value": "CDXTools.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52cf1606-23d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773955172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955172, "uuid": "307180d0-aab2-4fb3-b980-aa3cb51373e0", "comment": "Malware payload", "value": "9491796f2dcfe32d6478171c480b98e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955172, "uuid": "cbdcbc6a-e31a-470f-a0de-b9be2a401225", "comment": "Malware payload", "value": "b7a92042924957d6e8a5afa3948abf767cb7b304f73445f0ff0d6001a68527c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955172, "uuid": "2796d839-3bb7-4e0e-99a0-5e4830e15002", "comment": "Malware payload", "value": "4881c50deb8fa8c5e9205849a09038e28aadb2e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955172, "uuid": "abb32cbf-d8bd-4792-995e-3d7dfc151e51", "comment": "Malware payload", "value": "57f7b8d095cb82f86bd71c1b13ad49a9d1cb0b656bc2c2e6e9b238afd76f6f9413d0b248062fbe260e1ebfbd1b7c9699", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955172, "uuid": "4bb8eada-92cc-4bd5-baac-fc814b721475", "value": "T1693609127F58EE1FD26421348AABC63427E93D0482F025338756F3192FBE2759D5AED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955172, "uuid": "a012fb48-0f96-473e-86a5-0c278d554fa6", "value": "24576:teHL5UGPZuu8aOrH/KcnHZbwbaiPVqj8lVGaZt/hq6eQDWiYCID:tUj+9ucnSbrPnlVDZtJHeQqiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773955172, "uuid": "f1b3b254-9b81-49e0-afb3-bcf885725a5e", "value": 4915200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773955172, "uuid": "dc2c72cb-485e-4f4d-aa81-9de52aa3d8bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955172, "uuid": "4570a032-5b38-4245-b32d-9b11f1a0165e", "value": "linux_mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dce5840-23ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773948641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773948641, "uuid": "86ecfe60-365e-48ad-bba8-c1848a494ad2", "comment": "Malware payload", "value": "1bc593da9be19605b4855d1781309b33", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773948641, "uuid": "1b87e6e2-c53a-4c24-ade5-b2fa29a24808", "comment": "Malware payload", "value": "b87f0bdbd165da304157ea51e8d1fdf4cf91962e529247932e0876649db31cf3", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773948641, "uuid": "fb73d34d-0d9f-48f2-9134-a013cbd9fd23", "comment": "Malware payload", "value": "5b6b28ab9130c81dc6bad6a62c7b1945bf7c6f3c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773948641, "uuid": "ba3aa4f2-e184-4209-b3a8-7b48495968cd", "comment": "Malware payload", "value": "49964d2bc4265ef5d9acfdc34a1688a758537696e6e7a928048ea09e286f345129f0c5e39b40f845ab16d9877cf4aff5", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773948641, "uuid": "f516f42e-aff6-49e1-bece-011f29a54871", "value": "T18DD59D213685C437D16F03B01968E77A51796EA03B3785C763F86D6B3EB09C25E31AE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773948641, "uuid": "e866a43a-c0f4-42b8-ac61-da2b9bf06742", "value": "49152:t7qJrMf+7UVZDEFeyrUDqYaZrf5jSTUialf4vLNgmUESIEjPMN2lv+oBtYbMV3ev:Oq+ysjSTBY4veHjPMNaJYbMV39qA0Lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773948641, "uuid": "888b3d75-2933-4d74-8a05-ed3e8e8f9ccf", "value": 2863104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773948641, "uuid": "0b42bceb-85a3-471e-b64a-9c153f02fe5c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773948641, "uuid": "d01b7607-2a2f-4103-bc57-c06e30b7e71b", "value": "resources.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4045e82a-23ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773948699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773948699, "uuid": "c7fcad87-ea64-4e8e-ac03-1acc43e83605", "comment": "Malware payload", "value": "359c3c22f3c01b291ed8dbbccfce2ae6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773948699, "uuid": "a4c96ea2-376b-4411-b1cb-ad7be7fb7843", "comment": "Malware payload", "value": "b9116582a5b629ca0983e34037ea467a5b2da12f6bed8904b85e35429c08c4f3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773948699, "uuid": "ce130dd6-4313-4660-b5e4-df8b0e0660c4", "comment": "Malware payload", "value": "ab18da9731e24b04c1ef2c59cee175ccd87f4e60", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773948699, "uuid": "79be64b0-a102-4788-9028-c4e004085c72", "comment": "Malware payload", "value": "f629965b20547f19cdd3cc2ce54b8ba5d8e279a4499e784f2cc10b19cad8081dea33bbcfd2f280919dbfcb52735a32b5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773948699, "uuid": "a5b58867-d4d0-4052-8314-9bd8a5312a5d", "value": "T1CE062349E7E804F8F0B3A1B489634A02F7767CAD0371D68F03B556A51F273A19E39B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773948699, "uuid": "31760e59-5ace-4eab-a080-f0f14d1098f7", "value": "7e0a0e8f80bbd1a9c0078e57256f1c3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773948699, "uuid": "659629cc-f468-42f4-a2ad-85023c40fdac", "value": "98304:zzUU83tEzZaY+Jxuhv/qvIK0McID3ORUGZ:zzUfiMY+khagKreOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773948699, "uuid": "b3f58712-36a5-46f5-8709-cc3470a1b475", "value": 3698450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773948699, "uuid": "90df09e6-4550-46da-847d-8e4e37209581", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773948699, "uuid": "925e2eec-7434-4136-9950-45944b539b23", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f24f7a5-2368-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773906579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773906579, "uuid": "a223a5d3-d086-4746-8b06-567d24b2ab9e", "comment": "Malware payload (Mirai)", "value": "0a2b61463b0407f80c580495e8549991", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773906579, "uuid": "7a76b06a-5b18-4a48-8245-9613db45b313", "comment": "Malware payload (Mirai)", "value": "b961d093005bdadcee5b4c0258df85a48e6ca0f5d38f32d01e33cf2518545437", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773906579, "uuid": "2f615705-0830-462a-80f0-671339912462", "comment": "Malware payload (Mirai)", "value": "1185c5168caae611b3071a6c543a2d31d0413757", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773906579, "uuid": "fa11a3aa-b3d4-4956-bc9a-156c04a8cdfc", "comment": "Malware payload (Mirai)", "value": "ef529c64fafcc4fe0f9f9454ca1fe27770cd62ec7f55b079c8ff0d007f5b74ff32851f1c3a686499c2e8d0869b2af5e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773906579, "uuid": "6fb634cc-3f84-4a9e-831a-48daebf08ca9", "value": "T164338D80F0675CADDEFE813869938921F2AD94EE718B63C751592C3C76187249F2CE63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773906579, "uuid": "6c8945f9-2de7-40a7-ba5b-9fac00de8234", "value": "768:0CF0KQJS/qG8rvRddAH2X+4qWu73xY1bbbHk+gQrsNuaGC2BdMQm79:0XKJiG8bRgisWu7BebjlrAd4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773906579, "uuid": "4e52902f-3815-4ee3-806f-2555965362b5", "value": 54696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773906579, "uuid": "5677e37a-bc1c-4f72-8c6e-05ec6344f29c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773906579, "uuid": "1e822c0b-5c4f-41bc-b382-fcfefc9983fa", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b81f92a-2347-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773892400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892400, "uuid": "2a81f9dd-96fb-4e93-b7f7-62550295ad18", "comment": "Malware payload (Mirai)", "value": "1f8b14b8b9f960c999c97f839bf7eda0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892400, "uuid": "b5bf7914-e5b8-43e5-9f38-2ba05307ea6b", "comment": "Malware payload (Mirai)", "value": "b9e67a1a91971857a8cdfbd1e24b7a130a3f586ddcda8397246fcbf3c09faa5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892400, "uuid": "f16c2fd4-ecf4-452b-9b34-1e9ec7953e09", "comment": "Malware payload (Mirai)", "value": "38b7688d77391546077ad2a4e67072237ff6c07b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892400, "uuid": "7d6d2298-8b34-49d1-9072-b74237ea1b2d", "comment": "Malware payload (Mirai)", "value": "145ef4010d8f8c7dbe3d3a1331b841bfbb45767246a5d7f77a8b406d8ce245a13198ac097bd8c0633a7dff62bac5bb21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892400, "uuid": "727f7f65-94e3-477d-a3d6-94bbbbe805c7", "value": "T1CEB35AC6F800DDBDF84ED77B44530A0AB631A7914A830B3B7227BD67BD310A55827E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892400, "uuid": "03e73957-4894-4507-993e-ae20fa09cda4", "value": "3072:kv2zuJ1mCT04/OeKyNW191lt3USyk+g1cd:QYa1OuKyNg91z3Uzged", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773892400, "uuid": "f2ee7b05-161d-494d-8a7a-f303a41d4265", "value": 108200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773892400, "uuid": "c134cbf1-06b8-47b4-9b13-407c8b1c3759", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892400, "uuid": "a23cba6c-81d5-4ed1-8967-c70fd26ea1a7", "value": "tux.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8983bc07-2342-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773890410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890410, "uuid": "c08aa3bc-88c1-4981-a062-cdd2defe4a7a", "comment": "Malware payload (Mirai)", "value": "b641783cedfa67065c50890a892536aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890410, "uuid": "815b90a3-ff57-416b-8b74-64f5610fe4c0", "comment": "Malware payload (Mirai)", "value": "b9e8cd9320f061f32562cdee60bb13978bea3c2ac09f73f7a851e2439a582eba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890410, "uuid": "ffb12234-158b-42d6-a10e-163850113240", "comment": "Malware payload (Mirai)", "value": "03fb06850a63d12210dffabdc5ddf9e7332da3b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890410, "uuid": "da34dd5c-c17b-4a4f-8607-e7b005bcb0ca", "comment": "Malware payload (Mirai)", "value": "7099b7e6a614e5b06c4cc2c508dad4b8be52016e77dc5ee7d297b857336541c18ef539815cd7604211b303ac7e4da9f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773890410, "uuid": "8796c4be-198f-4ea8-8711-95f339dcd865", "value": "T1E0143A46EB418B13C4C6177ABAAF42453323DB64D3EB730699286BF43F8375E0E66506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773890410, "uuid": "7a566278-62c0-4e9f-bb61-eb7f0a4976e5", "value": "3072:4ZEo4lx3IykVwao7DGRLAelY1E5ZUSeOPG2XTQL/K7vzUOO+:GE3gwao7DGRLA91EMSDPG2XsL/K9O+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773890410, "uuid": "25e12084-a8f1-404f-90c7-f03abfb1d37e", "value": 205750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773890410, "uuid": "d618d7e9-85e0-4048-8d45-14055bd40b44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773890410, "uuid": "cd4154ae-e9d0-411f-a3e2-b36e571a557b", "value": "tux.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a222f7a-2395-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773925925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925925, "uuid": "737ec517-3601-4693-a170-fc7bf0e8b617", "comment": "Malware payload", "value": "7b9433a90524515450f3e094da3871d4", "object_relation": "md5", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925925, "uuid": "b0b52260-7f37-447f-8092-71a818af90fd", "comment": "Malware payload", "value": "ba6f672c268116ee38df1d639117edded05a43daf77e7b8a7a14a68855b926f0", "object_relation": "sha256", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925925, "uuid": "ffec2ccd-58c2-4cc2-a123-1c9da10ecebc", "comment": "Malware payload", "value": "d40832311390279dc47600dc9c91a449a6ed2812", "object_relation": "sha1", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925925, "uuid": "6bb74d11-6d65-4156-8636-a36641bc20bb", "comment": "Malware payload", "value": "5a01543e8a83979856d0be994345435c79daf9e81ec4ce27226101974c64d6e8ded488e0723b45a4e8ccb265a4cbbbca", "object_relation": "sha3-384", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925925, "uuid": "ff28e5a9-94d4-45f1-9fa1-5de468b33e45", "value": "T17EB6D02177DEC036D26F0171993ADB5BD63CBD210B3196CB63D479A91932AC2173AB23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925925, "uuid": "aeb1f98f-972d-4ede-8154-98d41be31e12", "value": "98304:SiI/uKL8gfAtSnqFozxY/XuFfF6xRwAMHGu89roqamUz9Lx8LMQIfvCr4e:3KhAonqiMupF6xeBHz89rjaQLGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773925925, "uuid": "6821cb82-bd40-459f-9431-8aefb9aa2596", "value": 10572288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773925925, "uuid": "29e9fc87-668a-4e5c-b797-e469765a0493", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925925, "uuid": "12ede6a4-86f9-4f8a-9e4f-667b1561b8af", "value": "ba6f672c268116ee38df1d639117edded05a43daf77e7b8a7a14a68855b926f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f8714fe-23d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773955113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955113, "uuid": "0fca88e4-0cd0-443d-ab45-7dc5e4fc7e59", "comment": "Malware payload", "value": "15b9ef4510aa686c2e7eba7fc5da8deb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955113, "uuid": "341b600d-e39a-4471-930d-f76e5316fb2d", "comment": "Malware payload", "value": "baa2f8273b8052d53401e12d1d22640c0b3a44c3cb1e396baa95bcdd8322eeda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955113, "uuid": "9d71d8a0-ad4d-4879-920e-b8e994eabf9f", "comment": "Malware payload", "value": "b910f175e867d2cc6467a2a161554d91126d0798", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955113, "uuid": "51e5f53c-4cf3-4e81-857e-cc4733dd4a42", "comment": "Malware payload", "value": "acb4721b5b67aad854749ae0574e312fb4f8ad0793435fc29e62cb9712338233971074c7023e893fad73a529e1aff8f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955113, "uuid": "ddd8c68c-16ed-4a72-a358-d4fb1ed7ba9c", "value": "T163262A177E28E71FC22911345C72CEA86B791C8A45DAA917B355F309B8B10BC496FCF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955113, "uuid": "4f177349-6208-48cf-8103-583f8863655f", "value": "49152:KvFRlPfZQLXLZYbzitttTN5G7eHjtVFcTx16DmHjVVF/JJeKDDGeTVgg7Dbh+/lE:MFRU1dnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773955113, "uuid": "ef9c3245-855e-4c8d-82c2-0dc9d47ee8cb", "value": 4849664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773955113, "uuid": "725e2db3-fab1-4af7-b882-f51acb5b1b0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955113, "uuid": "787775d4-9df6-42a7-ba4d-5f5d8fb22c3d", "value": "linux_mips_softfloat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66197548-2392-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773924711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924711, "uuid": "14f9dfd9-f9ae-486b-b60a-3ab63b6aef77", "comment": "Malware payload (Vidar)", "value": "a982a8b6188715ee4c61d16dab776e1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924711, "uuid": "a0276e16-eb73-49cd-ac36-c62adfefb6b7", "comment": "Malware payload (Vidar)", "value": "bc83a4e4b8d579cfca1258d52c1023958bf1f49052544fb25140ffbcfa0781c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924711, "uuid": "5f943b86-6a33-4a23-92fb-5f9c8ba65a77", "comment": "Malware payload (Vidar)", "value": "76ee877e03ff66c9f2bf5c1cfdd7a3527ee77c72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924711, "uuid": "aa66c7cc-f0aa-4647-ad1c-6ee196d66a65", "comment": "Malware payload (Vidar)", "value": "e6a50d066bc5c4b0a81553d000225d8e6c63756f2b31b97c4c110f281207aff1d84210530dfd3907e1fd6db36fd4a5de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924711, "uuid": "1db4bcb8-68ad-4dee-a267-9beb7f5b13ad", "value": "T1AE958C47BCD060B5D5E9C23289B512A27B30F85A0B3037C36F56A7B92EBA7D45E35384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924711, "uuid": "564f4c96-4fb3-4cef-abfc-5337de25ca19", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924711, "uuid": "f64d53f4-6328-4ce3-aa33-cce7c24dc25f", "value": "49152:QR8oVvtS9WncfKCsmms0rObAg2MbseqpMYgtcLK1:QkgrOB2Mgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773924711, "uuid": "f50938cf-ab56-4e12-9ad2-3a0278b38a0c", "value": 2018304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773924711, "uuid": "3083187b-9c70-4726-b720-7e10cf571c04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924711, "uuid": "4964f72d-972c-4b4e-bee3-bb7696a54157", "value": "xbc83a4e4b8d579cfca1258d52c1023958bf1f49052544fb25140ffbcfa0781c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b6c50b-2392-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773924920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924920, "uuid": "1fc975e9-ee86-4b08-b34c-21edb58bf7ed", "comment": "Malware payload (Vidar)", "value": "083e8422079f7e63ba080ba5c4863099", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924920, "uuid": "150d7e14-6c60-4173-9760-20f283ce6f25", "comment": "Malware payload (Vidar)", "value": "bcc73d429408a933db2f51368a3c3c30238556acaf69e9acf9ed5e313adbf950", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924920, "uuid": "a689a24c-ef68-47bd-bc37-3a7440e4fe51", "comment": "Malware payload (Vidar)", "value": "55bbf58af200e54c555acba927752c4d9a87402b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924920, "uuid": "8cc9d97c-528c-435c-958f-ce852812a462", "comment": "Malware payload (Vidar)", "value": "3079f11089632e00d49caa403370672fe632c30ff750e9381943183278c6c7919c2b1e7adf72cb4e954c2078c619398c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924920, "uuid": "2f347e2a-4aa6-41ef-b506-d2331cb42fc5", "value": "T15C958C07BCD421B5D5A9D23289B512A17B30F85E0B3037C32E96A7B92FBA3D45E35394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924920, "uuid": "f425c217-10ff-41f2-99b2-cae93f78b590", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924920, "uuid": "7c023f0a-c9d6-48f6-9348-a1b6b93e0139", "value": "49152:nHorXDiDO3FG770MjuYAIvEBnQauEnkYwMYgtCbK1:oS8KC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773924920, "uuid": "f2e24d32-db4a-4512-882c-7433d5a6a3f9", "value": 2021888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773924920, "uuid": "e8d5f652-9de8-41f0-96ee-f61770670d66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924920, "uuid": "f58d960e-20f6-4096-ac53-8fb7cf3359ae", "value": "xbcc73d429408a933db2f51368a3c3c30238556acaf69e9acf9ed5e313adbf950.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "965e5668-2398-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773927368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927368, "uuid": "cd32cc3a-7207-4467-8872-c18c7dcec7ce", "comment": "Malware payload", "value": "80fc64b636834e85ed58220d456cd5c5", "object_relation": "md5", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927368, "uuid": "6bee36e9-694d-4d9f-ab38-cd434e208303", "comment": "Malware payload", "value": "bcd30f2116f5ba6731c628483d597b2ba3620ed464c63875855906306beb102a", "object_relation": "sha256", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927368, "uuid": "8123a0c9-eed8-424e-bf41-373007825e65", "comment": "Malware payload", "value": "2989aa779d95c9e2d8cb3a65e2cb05203f0d562a", "object_relation": "sha1", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927368, "uuid": "9913715d-9a7c-4a4b-bae2-a7e72a4320a5", "comment": "Malware payload", "value": "f7e84d61b0dde79d3a0fa7b4c044e989ee45d02ec28f2ef28ae7204d474206f4400c75fee6ddc1009971602863ca8d64", "object_relation": "sha3-384", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927368, "uuid": "46764a9d-1973-4842-8abc-519fe4c14387", "value": "T14165E1035985CA77D12242B07E076D2C6DAC3B14DED8A7DB3368DF1E2F33182A95625E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927368, "uuid": "43a7c90b-85ca-42f2-9506-135ea06eba59", "value": "24576:R4X1SmyMrjc/yh2mgiY2djPeUstqJDE8OX17gcHX6p8QUkHEPkrCUT:RC1SmyMrjc/g26vd7etwlE8MBgc1wHES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773927368, "uuid": "4bdc07ba-95e7-4b0e-9614-71c7c1b4e0ca", "value": 1477040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773927368, "uuid": "45954117-2a79-4a85-bfbb-e5dca0d9d2e5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927368, "uuid": "7f04fdce-288c-4471-898b-0c52bed60f15", "value": "OECD_Update_on_implications_for_energy_markets_of_events_in_the_Middle_East.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38076ec4-23d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773955128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955128, "uuid": "c6ab8130-8653-49fa-a8c8-abfa099427f5", "comment": "Malware payload", "value": "bb32598513135db9dfe510eac24f3b39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955128, "uuid": "5fc192f0-83b9-4ef7-bdc5-5b461d1ff9f7", "comment": "Malware payload", "value": "bd6f00168e9e92434533fc1cbe5933c22bdde8239e7d6b7bf7e26b761723e0c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955128, "uuid": "6283d313-57c7-432e-97ec-6d46c4d43f13", "comment": "Malware payload", "value": "2a3cb765e37861b4d4ba4e5c23acf3747dc74050", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955128, "uuid": "e4c730ab-1e58-4436-a965-6bbb6360910a", "comment": "Malware payload", "value": "d1365de394000130d4b14694161780450d1cb14004df067148639bb9b6c03f26f24b6172dbc1ca2487da383339058af3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955128, "uuid": "6d68bf2d-cda7-4ff7-9fe5-11851f11ff75", "value": "T1DD165C95FC2DB452E9E87DB83F2602947139FD889F81C3176614FB9DA9F23148F22660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955128, "uuid": "312b7d6e-31ba-4643-bd7e-97f55349cdb8", "value": "49152:qxLcp2PMSjPnYxD4YuUsXoqR5ELkMO02Otz1V:Acp2PMS4/uUsXogEuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773955128, "uuid": "5e7d1134-127c-4df0-839c-72814a2772ff", "value": 4194304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773955128, "uuid": "69da0dfc-8900-4ea8-bd88-58b4b1408d25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955128, "uuid": "080ee76e-6550-4d5b-995c-ab1c2d11e260", "value": "linux_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358af574-2340-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773889410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773889410, "uuid": "bb6ec0ba-2475-4f4c-8ea9-dd227bae50fe", "comment": "Malware payload (Mirai)", "value": "ceb0853cae7b3d09cd82c93d40db378a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773889410, "uuid": "4bfad715-fd37-4ef2-8d8e-6139afdade6e", "comment": "Malware payload (Mirai)", "value": "be902e86ec68515e23a3387a21e80d098d258223ce562598c27ee6d89b83ff2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773889410, "uuid": "5fbec59e-1d65-477e-8087-66bb2b78ba4f", "comment": "Malware payload (Mirai)", "value": "e6d50c944c6412bb638d4e0bac085f2dda495f8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773889410, "uuid": "617f1c7e-e355-4395-ac68-686ef8766b0a", "comment": "Malware payload (Mirai)", "value": "b90f2c3b779f11926b9d1820f09d44832e072e4a94251c943dd8ceb77b57315c3ce83b719bc5178983b2f274816782b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773889410, "uuid": "48939da3-083d-4bf5-9df8-e296ecfd68a2", "value": "T144836DC5A1C7F8F1ED614579207BEB734E77F53A6029DB82C7A4A933AC51601E2072AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773889410, "uuid": "aa2812e5-bcf5-43f2-b884-654c75abc007", "value": "1536:i/a4C6Fjl5/rM5HUGw9jdf2dVOESctNXYlOM9UkHy0lBtCioHOgjj3:KcOjl5/g9nw9jOOESIXqX9XPHAiMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773889410, "uuid": "7f848475-d9ac-4a49-ab47-abd3faeaa8d7", "value": 82836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773889410, "uuid": "23fb3242-930e-44f1-a9c5-47cc6d7cb532", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773889410, "uuid": "071dc675-63b2-42a7-b390-3ad2c0e99871", "value": "tuxnokill.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f03610-2369-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773907000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773907000, "uuid": "df80a369-8dea-491b-8e3c-e3ddaebfdc7a", "comment": "Malware payload", "value": "4f93d006701d4d50bf54b15bbcbf16fc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773907000, "uuid": "ab8021e4-38fc-40b0-a5e9-6ab7f8753672", "comment": "Malware payload", "value": "bedf959667ff23dc1365a0d0762c4b52d3181d4824d44ee53ebcc767a97753d3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773907000, "uuid": "d95bbe77-a685-4608-b967-26d375e0888f", "comment": "Malware payload", "value": "16be52765af1457a9536fb674de5dc4078c287c5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773907000, "uuid": "daf587c0-d3a8-4629-9ac9-72b60e55dfe0", "comment": "Malware payload", "value": "8db8cf3374c65702cafff59367d72ff5b0dc67238e22e318639a746a154546d96d5d0a60327a30e761ba12544b93421e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773907000, "uuid": "759bc3b6-db6d-4c3a-975f-87d74766b6f9", "value": "T16785B61B4FDB442DD19443C78FD15B22E6895CF675EB8488167282A3809BEC71B33B7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773907000, "uuid": "024af055-e666-4be2-8bbc-a85853c03cf6", "value": "48:TYh88402CcyBF068CjKv7dlvWB/gDFqWl06/Rgg0p4rdB+YLOzBWCfXYGWYTcWVI:TmaW/TUB2d1q7oMBK2SJQSQYt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773907000, "uuid": "165ac5f2-098e-4918-9106-289cb3fd675d", "value": 1844250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773907000, "uuid": "68a9d35c-98e6-4eb0-a4a4-e34b57fefeb1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773907000, "uuid": "cd80de60-d888-4510-8f4c-492e4fc6e50f", "value": "Adobe180201.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b4191ba-2399-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1773927753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927753, "uuid": "e84c4644-9909-43a9-8f10-8dd2173536bf", "comment": "Malware payload (DattoRMM)", "value": "cca01624e785e01faf490c6a07e06683", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927753, "uuid": "17247f90-cdb4-4aa2-a3e0-0eedd4ddad2b", "comment": "Malware payload (DattoRMM)", "value": "c106d9794619304cf3468e881461c950cef3d96c77b2dc5b7e0e1f96f7240a99", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927753, "uuid": "608bd3ee-396e-4957-ade8-d10e183d15f9", "comment": "Malware payload (DattoRMM)", "value": "000c5655070c10d7ebdb05665c64d9badd981f87", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927753, "uuid": "07579439-6d15-4194-9e9b-d00ce19abf4c", "comment": "Malware payload (DattoRMM)", "value": "b866af2a0d1e853e57ab74051a6ed7c19a6dfef8f95372c666bdcedb9197abd050029cb4477425f053722a23580f3dea", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927753, "uuid": "0accc7b6-1249-4b25-911f-6e0df0882821", "value": "T13AB63347D9778DF0CA330A3890D21A6B3305980E485BF4C9E509277ADAF35AADD2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927753, "uuid": "80f6533e-edf8-417e-b956-397ccc4e68e0", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927753, "uuid": "3e240ddf-ca9d-4894-b92d-7e528b3e9bdc", "value": "196608:zaZk+wVP+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2Z:TnYmzZFw5S9pE7Asjp29qIT0jarlZr8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773927753, "uuid": "ac4a0dd1-9061-4cef-8575-1396e369b0ba", "value": 11056040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773927753, "uuid": "8d23feb5-2340-4a15-a5c4-11d182c1d5d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927753, "uuid": "af7b62fe-c0c8-4f6c-a097-8ee9fef12017", "value": "Invitee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a29de8fc-23b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773940703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940703, "uuid": "583ae5dc-eeba-4170-91ee-cf6f444a2179", "comment": "Malware payload", "value": "5e90d275df0a491c2c7de716bef5b54b", "object_relation": "md5", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940703, "uuid": "f2fbfee4-d477-4398-aeeb-5b050d86c711", "comment": "Malware payload", "value": "c1361e943e723746f92e83c35bafce8a6800249c3253e0ceb75023ece695c1f3", "object_relation": "sha256", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940703, "uuid": "078d1746-f6f0-4863-a1ca-6f3d3c737e4c", "comment": "Malware payload", "value": "0a79aa617fbe8ff5e340673ca8537be4eab58408", "object_relation": "sha1", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940703, "uuid": "b44278a2-d9ac-43b6-a410-9f1744637553", "comment": "Malware payload", "value": "10eda234fab90cf0e28d91ccaea03c6a0f60422078aec14e7713cfe743db69c6401be2bd4bbda92afb491be3deb29a7f", "object_relation": "sha3-384", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940703, "uuid": "e4f37f26-fbf5-4236-b54d-189ae44ce715", "value": "T1F9B5D03FB28B753EE06E5A3A7A72E210583B766165174C1696F4C88CCF250B01E3E797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940703, "uuid": "147ddb84-f8c8-4013-8608-a9951e734e00", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940703, "uuid": "92a41fc4-69e8-4460-b8c0-e54be3a526a2", "value": "24576:kXNrSLScusMmOkKIhzvLvnrqdsp7xuQvoeW9XtKT16wV/Rznkm1TqleZs0dsgEri:LuI5hHXQ+W9K1D5ziq6f3qwYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773940703, "uuid": "ebac88de-b549-4a87-886f-e9a9feb2be02", "value": 2396488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773940703, "uuid": "5ae86c05-4c0b-44ec-a316-30ad23094192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940703, "uuid": "053899c4-e2c9-41eb-90c8-7db6a59cb796", "value": "c1361e943e723746f92e83c35bafce8a6800249c3253e0ceb75023ece695c1f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2b5669a-23ec-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1773963521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773963521, "uuid": "b4a105c9-025d-410b-a6b6-be5c6d01abb1", "comment": "Malware payload (OffLoader)", "value": "3fdf8dba854ad9f4a48b3d1512527912", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773963521, "uuid": "fead420d-fa63-4639-a6d3-5db0d14cf725", "comment": "Malware payload (OffLoader)", "value": "c14e519bb36a26fab5708bd3b880bf109520c239a1ddce57d63df1b62da1e99f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773963521, "uuid": "b6ac530a-1f5c-42c4-af99-5568cf70211a", "comment": "Malware payload (OffLoader)", "value": "a6d2f663c9809575e83f10a5db02db7d51c782b1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773963521, "uuid": "335158d9-1f6a-47e3-bedb-e8f2d4ff6c1d", "comment": "Malware payload (OffLoader)", "value": "135821d526af5819340eea0df8a120f41af404275c04a22830d456f63fd5b4e6b7a6da8bf79afbd230d014380152eab2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773963521, "uuid": "9bd8f2e4-3db4-45bb-80f6-93bfe772a0ce", "value": "T100A60237B28A633EE06E5B3759B2D2205C3B7A61A45F8C0696E44C8CCF2D1A01D7F657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773963521, "uuid": "b25278d5-5ac6-4bf6-963a-e48126d9d41e", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773963521, "uuid": "a460b338-b35e-4acc-8cc1-1825efaed480", "value": "98304:YN66TvRjW2fASD1pDh2B4eiXZjH5AAIlgGOrbpMnJKv:cM2fAIO4HXZNAAigGOrb6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773963521, "uuid": "4f535025-ee98-457c-8415-f7cca797b029", "value": 9990703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773963521, "uuid": "f23aac9c-1024-4db6-a92f-d56011e16dd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773963521, "uuid": "ef952a35-2ba0-4703-bdb8-baa8bbde8869", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "621fa45e-23aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773935012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773935012, "uuid": "1b3818c4-68d7-412b-a07b-6dd6ebd49a9e", "comment": "Malware payload", "value": "e80ba57f340bd351d84380f6cacc59cb", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773935012, "uuid": "0a320112-5214-4496-89c4-ff0f9b43da35", "comment": "Malware payload", "value": "c25dacb36ab712eb7f6c8a3e1b1e5403d7ee677bd5134026152951e4f0336e8f", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773935012, "uuid": "047f5038-5aa8-44d2-9b53-7aaaae0d74db", "comment": "Malware payload", "value": "94356acfe114d8d15e76ff954b40fdafe43d658f", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773935012, "uuid": "3341277d-fea6-48c7-854e-a26e0068cab6", "comment": "Malware payload", "value": "dcb6f7d6db6fd6e8ed56e2b2e6e957a0d172ae38b6298e72e8d356afebcf278221f2b2378ff5efb1d6a8c6c72d05e699", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773935012, "uuid": "24783014-14b8-4097-8c1f-614ae16e0772", "value": "T11AB3F1C905AF8C69CB9F2028752E6C075A9C9207451DD590FEDFAED63F22CF431A96D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773935012, "uuid": "f25af6aa-4c33-483f-a997-2ee3fa66bb8c", "value": "768:GEdxGtMG1yfeZT3eI2xIPic6tIiIIIt04H05TwgcCT7NpuoLUPxKCToG3oyctZ2U:DMJJRziLXBjSHBMO5TGgcOo20v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773935012, "uuid": "6e58687a-470f-4694-a9dd-6c539dea6fcb", "value": 116300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773935012, "uuid": "f402a94f-0828-4ec1-8e83-206277f61d2d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773935012, "uuid": "a9a86f59-1c2d-4047-a9cf-6ec2b2eb1ef9", "value": "Core_Journal_Holiday_7097.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d78f013a-23d1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773951959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773951959, "uuid": "14f81539-e87a-4409-a28e-86d49deedcd1", "comment": "Malware payload", "value": "ec5d6e93e567055a42fec1b9b7d5e5fd", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773951959, "uuid": "46d7435f-81b5-4456-a352-79169b15a7e0", "comment": "Malware payload", "value": "c2fc241e929d21aae1a8fa3029f2362c38c9d1747d90068040423b98edf19021", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773951959, "uuid": "69ce5f9d-b159-4919-89d2-aee7fdb0a4b6", "comment": "Malware payload", "value": "1ba7816e5c4bc68face091c6bec2c3db2b1abc0d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773951959, "uuid": "3b207328-07bb-4680-a26b-d8b437e28c20", "comment": "Malware payload", "value": "ecaa1dad1c971d927708c4faf9d4f9e29aded15776717aed3a2f14ccb9eb305f7fdb5c386139b7b9b45e392740002fb1", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773951959, "uuid": "79e51a4a-3d0d-4101-8b21-d9f3cd07baad", "value": "T14F0633FA7FC4C52EE2978478EB2DA44718F626AE908C95D3D6425C061FBB9C45703CCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773951959, "uuid": "66ecbff0-3956-4484-9713-d576bdffbb8e", "value": "98304:ejXmstibEpZU+SGNh+RRqaWyJnr46Z7jFc3tGY31n88P+o:i2oIZiwWax9L7jFuGq1nHPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773951959, "uuid": "47821665-1882-4708-aef2-b73e0f8cf716", "value": 3745897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773951959, "uuid": "34486e78-c3a4-4f71-ab58-1ebb09454987", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773951959, "uuid": "66c19f82-fcb4-432a-b496-26159abc4723", "value": "output.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3957efd-2371-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773910640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773910640, "uuid": "82cfd67c-dca3-4252-bd59-0499144f963c", "comment": "Malware payload", "value": "76a40592574958d0e5201dec7cd75325", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773910640, "uuid": "bc5f791e-ca5f-44ec-884d-1a8418c58205", "comment": "Malware payload", "value": "c416bbb8d7a96ff69e7b2045c30ceddcf4829fb69e4c11560979b9f5c3d03bb9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773910640, "uuid": "1c0554a2-4798-4663-a037-3f4bcb599257", "comment": "Malware payload", "value": "e5f5cd978fa3629cdb34bcaee69cf219bdcf58c5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773910640, "uuid": "af779a70-b376-4465-897e-544eb84b2910", "comment": "Malware payload", "value": "5f415c02816521177fbe734dc036d8a77c18d6c2847337b77b98db795f828331ed142abc64a112deb5b02ed026c225f4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773910640, "uuid": "580430be-43e2-48e7-bd92-48d089238de8", "value": "T12A35057CE42390C4E29E588494256E4CEDEF5207BFD634BE7262B2CD9847E1CB70167A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773910640, "uuid": "01448e6c-af22-4942-a908-420ccb07a211", "value": "192:t8jtY28TkFYpmVPOyRIzws6zgzDExzkIOTucQ4VpLVVhz62Vq2VC2Vq2Vc2Vq2V4:F7g7uWZT5ddtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773910640, "uuid": "532aa9cb-d2b8-4843-b317-5aa6e4160da4", "value": 1118762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773910640, "uuid": "3ddeecdb-f6a8-45b5-b8a5-85ea8e8854aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773910640, "uuid": "3e3569f3-2cff-4a15-92f1-fe9098262fa4", "value": "estudarebomai.com_root.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5880cfa-23d1-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1773951983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773951983, "uuid": "8a3adcc1-34a7-46be-b4fc-a28e130d9add", "comment": "Malware payload (MassLogger)", "value": "e736c7a139cde5dc69ca4d8e2c9df78a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773951983, "uuid": "300bdc3c-f26a-4dfa-b287-9d4cdccd44f5", "comment": "Malware payload (MassLogger)", "value": "c47d92db7ed3cc5fdbb3296f3f4ab328cd8b66ac079f5bf658d4f2fa5f8a6af7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773951983, "uuid": "274612f8-e0c3-4166-8ab4-cd1e9a10e55a", "comment": "Malware payload (MassLogger)", "value": "66e1e9b07c5e9aa17d501b75d518620d965a7fc4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773951983, "uuid": "96a6a1ed-f34c-431f-843f-bd872550bafc", "comment": "Malware payload (MassLogger)", "value": "a43d08a494fe1edab15aeb9666ba49e2ea41ce68b581e0276bd0b51e8c69e1e7cfe3da1995739531b68d4f1b0057299f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773951983, "uuid": "4afe759d-b853-418b-a4e5-75287c706631", "value": "T15E1387D83EC5F079861160B36E27E026EA5E8C8477488451FBE768DCB92C334D57AA7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773951983, "uuid": "084580d6-8fc3-42d6-9910-a5d1c69f659f", "value": "768:6n9PjN7vsNeeKb0S47+GmhuqQxdIAzJFe/JEsLM:6Zxv34KPhuVxdflFAEcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773951983, "uuid": "36cdb31f-30c5-4882-a89e-085f08578a69", "value": 41442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773951983, "uuid": "8c5b0346-c14b-42e0-8a38-7bf60681aee8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773951983, "uuid": "7d75e81c-3a05-4428-8a5b-a1429b7141a7", "value": "nerdfwiqtwqhdgfrwt6fntdwrgonht.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20deffb3-23a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773934473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934473, "uuid": "fffec2fc-8c77-4598-b7a7-fd27158c0569", "comment": "Malware payload", "value": "55ce7ddabac89d0b8ccd7d8519956ede", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934473, "uuid": "a319e62a-cbc3-4d28-a23d-8a7eac2c9382", "comment": "Malware payload", "value": "c4cd6cae8532a649b239af919cb2c4e463d9145e3554a1d3425fc427e664bda0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934473, "uuid": "28254598-48ee-44fe-bb12-874480f45050", "comment": "Malware payload", "value": "5052d291080c08df73de9a832ba513e28bb43e86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934473, "uuid": "7181f04f-6c6f-4686-b820-9e3273e57f5b", "comment": "Malware payload", "value": "643df0c2f1b782c96e04fff52fe7dfd1a0e4182804d0d02b97cebc7c73ff9989d6405771fef8971412fbc563230d20f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934473, "uuid": "71bb23fe-0d22-4a69-a03b-30de75d6b159", "value": "T19796339493B109F9E9E6853E826BC12CD6727497472AD3CF279006922F27BF24D39F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934473, "uuid": "ed9bf37e-edcd-44c0-8cc2-db7ffa7c8adb", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934473, "uuid": "8ef3c844-83db-468d-97ea-f843be7a8574", "value": "196608:zFBNTwhLijA1HeT39IigwqtauDXURuAEk0ax8ZnEqCMS:zFWL71+TtIiFq8uARuAUax6nEqCMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773934473, "uuid": "fa666725-29a6-431a-8d2a-2802f8628f57", "value": 9239360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773934473, "uuid": "5d8e9d8e-2dbb-4848-940f-b68dacad8737", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934473, "uuid": "9575f663-f600-4b6a-af25-f94a044fa3c1", "value": "c4cd6cae8532a649b239af919cb2c4e463d9145e3554a1d3425fc427e664bda0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d0a9e4-23bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773942940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773942940, "uuid": "acdd2c2d-ac3d-4c0a-a86f-9ed55f573bdc", "comment": "Malware payload", "value": "37f992973472bc13cc08f946426bfafe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773942940, "uuid": "5c8c178b-0c14-4477-bd9f-775c3aca5f46", "comment": "Malware payload", "value": "c525b28d710535479e055bd038d458679b544158dab051040b2a58fa108289f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773942940, "uuid": "aae2d843-1f73-4d57-95eb-4b2bcbec913a", "comment": "Malware payload", "value": "ed2cb7472f36fef744ee756dfa20dc9d9f651ca0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773942940, "uuid": "ed7d7973-59e1-4870-8d72-2e0bab535bba", "comment": "Malware payload", "value": "c3df193ff912bf53c647454f737bf9d59a6ec7688228ebcfee76e6ab22b698500faaaf321547f99f45687751089e39c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773942940, "uuid": "28efb4b6-ee6a-4076-8c37-67317aab6ea6", "value": "T16D95E07813288D1AC7AE0738A0524190A735BF079282E75F6DC578DF1E73B8596272EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773942940, "uuid": "c8ef1e42-4c0b-43e4-baf9-be03657c93c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773942940, "uuid": "60d23193-01d6-4328-901a-55028b8f9d4a", "value": "24576:UY65vq/yqi/ylQP0RT1/yG3uR/yr1GT/Si2T6WqgIpkLnXW/yj7/yIr9:VGv18GP0iaFCaNC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773942940, "uuid": "0f6e8cc2-21b0-4a7b-9c38-2ad4b90d781e", "value": 1896960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773942940, "uuid": "8b85695c-4b45-4818-ba36-681e5a0f9722", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773942940, "uuid": "c133efb1-c7ed-4e62-babe-c35322939085", "value": "RevitViewpointsTrialInstaller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13585ccb-2395-11f1-a769-42010a9c0008", "comment": "Malware payload (GlassWorm)", "timestamp": 1773925860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925860, "uuid": "3b3b800b-d9fa-46c7-82f7-475e1d93643a", "comment": "Malware payload (GlassWorm)", "value": "1429f5250ac9119b2b52b9b61e896bf4", "object_relation": "md5", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "react-native", "colour": "#37C2CA", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925860, "uuid": "255ffda7-2066-4aa4-8dcc-106b4e8124d8", "comment": "Malware payload (GlassWorm)", "value": "c5e549d5d09c15223665a3fff078aaefbc890052c0b819ae6bb768f4300ac692", "object_relation": "sha256", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "react-native", "colour": "#37C2CA", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925860, "uuid": "460f774e-6050-4450-9756-0da0ab122584", "comment": "Malware payload (GlassWorm)", "value": "f1f4a1783498d16ea4a0862def112364968bd8c6", "object_relation": "sha1", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "react-native", "colour": "#37C2CA", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925860, "uuid": "743604ad-5155-4b94-af5f-b4cf9c7c907f", "comment": "Malware payload (GlassWorm)", "value": "6886e4407cd22e43c5eff3d958de3677f06dba2f167c8dda389cc52a4f9daefee48a0ab7a1cf106cfa817154fabe6c6b", "object_relation": "sha3-384", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "react-native", "colour": "#37C2CA", "exportable": true, "hide_tag": false }, { "name": "supply-chain", "colour": "#D1550C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925860, "uuid": "057d751f-1685-4b41-a53d-8ecae267dddf", "value": "T1B562A47A15F72B604113E17F9A1FE884A56AA30B4D18FD08791C6144EFDE83C93F1A7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925860, "uuid": "14917df2-c667-4526-abd6-88ec40946919", "value": "192:njhuIrQBnOOPqvOB6SgGnw2L19itaPhwQKSwsf7vkH1vOhi8C9+FkQCotadE4+Kw:AnOj2LHikhwQKlsD/3IzsiyINWAtZpM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773925860, "uuid": "019ca81a-c68b-4216-a0e4-b00fe56c3beb", "value": 15289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773925860, "uuid": "620a0ef0-14b9-4ef4-bded-d235251dac0a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925860, "uuid": "c56a431d-8101-4d48-85d4-afe8ede3efc8", "value": "rn_international_phone_install_v0118_deobfuscated.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77eb1828-2394-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773925599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925599, "uuid": "5ad2feb8-075b-4f1d-94bf-d138ffe757eb", "comment": "Malware payload (ACRStealer)", "value": "601238d0dd403f776b161e34932f1b8d", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925599, "uuid": "81baa96b-2b8b-4578-ad98-abd957b78132", "comment": "Malware payload (ACRStealer)", "value": "c69284960d9e928c6d051c3787e28d620963201873b59ec2637331640cd0677e", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925599, "uuid": "2e351574-69bd-41a5-b886-aec0c7dd3d67", "comment": "Malware payload (ACRStealer)", "value": "105bcb98250b96acf77a25f6a1a7707d2d7a1920", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925599, "uuid": "89f68b72-5a29-47ce-9250-bbfaeff84b95", "comment": "Malware payload (ACRStealer)", "value": "05e74643feb25cdc29780d895e8cc68556101c287cb2a42922fb93e95873a934ed7c41e99649907ffb9b19115c3b87d1", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925599, "uuid": "d70b3257-0e24-43ea-889f-638b3f5b0ba6", "value": "T14995E912C7D2AEB2F55701B2D29F8D3A2F3EE4496B4DD54442E405FA40D2F2F64BEA60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925599, "uuid": "12871628-7921-4ea0-9f06-f3dce5818878", "value": "220c59558875beb392d0c4500b008db4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925599, "uuid": "2ea2fbdf-862a-435b-bbb6-f8009005af87", "value": "12288:TBPEgvOSMOB7GCDL7tzFunr7FxBNIHw7WK391XuUyHLmRV98h:TabC7HunvI7K3T2LmCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773925599, "uuid": "7f5c4d9f-74f1-41ce-82d1-93b4c31240b9", "value": 1949184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773925599, "uuid": "f38430d8-17f6-40f3-b82f-5eab03b283ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925599, "uuid": "9c4aafb2-ef93-4337-87e1-38275689c567", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "821b99b7-23b5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773939790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773939790, "uuid": "7679ce0a-2b38-4fd7-b4a6-c348bd6af9f2", "comment": "Malware payload", "value": "5d0999caa20f369912373ab8d57cf528", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773939790, "uuid": "c0c2e090-fe37-4fc9-b4c6-19806d3f8083", "comment": "Malware payload", "value": "c786f503dd4ac3f8b596b2974b51e156021275010f13a993cc7bbc31bb1932f8", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773939790, "uuid": "edebe4c6-c46d-4c44-aaac-ae777471f7a4", "comment": "Malware payload", "value": "7ab6a8fe2bb2f48dc2cc3e2f63b16748b2e0b3f7", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773939790, "uuid": "9f4ea29e-997c-442d-b12b-2a0af716221d", "comment": "Malware payload", "value": "4096567ef7d19e2b9d907c2973feea65e1471eb3b2589e66a8e7eedfff4fc0e50387e9e7694313f10a506296eb0c4174", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773939790, "uuid": "71d216ff-999a-48a9-a0ef-5b16f00ea20d", "value": "T172F58B213586C13AE9BF43712A2DDB7B11B97EA03B7358DB63D8592E0E709C14231F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773939790, "uuid": "9ba49aa1-5e91-41ba-ba01-ab3bfdc148ad", "value": "98304:SAfwrty0jSTBOq+cRtv4veHjPMNa1YGMV39qAR:1q0OQmeH9ID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773939790, "uuid": "1095257b-0ab8-4d0b-9009-9f181878ac1e", "value": 3377664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773939790, "uuid": "5fc20c13-e4d7-4cfe-88d2-d29d0084a4a1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773939790, "uuid": "8c407e8d-96e0-41f1-bba3-383ad0cf7bb4", "value": "Microsoft.CSharp.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e54a9be-2342-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773890257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890257, "uuid": "a97b0d36-dc20-420e-ba71-b00c12631a36", "comment": "Malware payload (Mirai)", "value": "2286a42da31c8d16144543af83436bfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890257, "uuid": "2e82c12a-e2e7-4628-81b9-078f45239a7d", "comment": "Malware payload (Mirai)", "value": "c7ab0244c34484718eaa4a804453c984fed93b56dd9f24fb94589c1c96cda206", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890257, "uuid": "688e611f-6503-4ec7-9eeb-b27c731ef879", "comment": "Malware payload (Mirai)", "value": "cec815f4bcf1d4f1ef2c75c017cb9760c01121ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773890257, "uuid": "828de2fa-e69a-4533-859d-9e305f80941d", "comment": "Malware payload (Mirai)", "value": "a39fcf3f1f98d97d7e5d685166127061905e60118f9d99ba1aeef528608926a6905167961b16ebc08df3cc8acfa72887", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773890257, "uuid": "452082ad-2993-462b-8a7b-2ce6274c70d3", "value": "T182143A46EB414A13C4C61776FAAF42453323D768D3EB73069928ABF43F83B5E0E66506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773890257, "uuid": "370d976c-5be6-4b6e-a174-7566f7a46f5f", "value": "3072:OF8/bFKmsQyDzCaKUZ0XUgMOyDEnhgTSxoq7D8S0FL/KQY+:08cKACaKUZ0XUgMBDEESuq7ISAL/KQY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773890257, "uuid": "f4e26e59-4c10-4b5f-b4fe-da6fe832f1c7", "value": 205817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773890257, "uuid": "fa13a6e8-2aea-4df9-bad3-95bf5a3379f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773890257, "uuid": "284e636e-a16e-4e89-aa51-b4136f0edb1a", "value": "tux.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c945ed4-2395-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773925983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925983, "uuid": "152f2cff-af9a-490a-96c8-4977189f8d8d", "comment": "Malware payload", "value": "63b4cee9933f3caa4226809ef9429064", "object_relation": "md5", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925983, "uuid": "50838e9e-fa4d-4d19-86bf-6489b8aca4ce", "comment": "Malware payload", "value": "c7eadaad1189f105fc059cfa2a80db5a0c716c92695297c065b1dfc03ddea2db", "object_relation": "sha256", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925983, "uuid": "e58e0c7f-0ca8-4047-a00a-ae75709fedba", "comment": "Malware payload", "value": "ebd6b9757a1ba8f2dc8ace5685229e05665b4f3b", "object_relation": "sha1", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925983, "uuid": "599d9c63-8a82-40d8-91e0-4173fab10bd5", "comment": "Malware payload", "value": "298d9ab98033717df259f040ee53244fce524a41c447edd7caf64904ea7330f82a6ce63b49b7d8b3761794b7f4f89c99", "object_relation": "sha3-384", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925983, "uuid": "22078cb6-d344-4cfd-ad92-e65291a06a5d", "value": "T188440207D20D7653CBEF8DBD9C20054B5A337341E8E1EA44771864946827BAB2EADDCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925983, "uuid": "119220a3-b508-416e-a458-33a306a17e65", "value": "6144:Wfa4nIPuR7glircs0UQuR7glircs0U1uR7glircs0Ujr:Wfa4nxR7gErcs9R7gErcs4R7gErcsXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773925983, "uuid": "610e5d0d-c838-4364-931a-120d05b69e52", "value": 258776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773925983, "uuid": "cbaa87b3-3efa-4a14-93a6-87f2c467ca29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925983, "uuid": "4c00ece4-a224-4549-a0da-d618d0312b22", "value": "c7eadaad1189f105fc059cfa2a80db5a0c716c92695297c065b1dfc03ddea2db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65ae09d-2381-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773917624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773917624, "uuid": "194c310c-0c12-4e91-8309-3a9a66d091cb", "comment": "Malware payload", "value": "43766d04fcfdf3c50d3fe586d677564e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773917624, "uuid": "0b32eae2-73d4-43dc-a053-30ad45faaad1", "comment": "Malware payload", "value": "c805579d25000e5270305c926dee6fcc108efede9195c2bb442a6662ddaca995", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773917624, "uuid": "e4dbd564-bafc-4fbd-a355-b9323edb1534", "comment": "Malware payload", "value": "a78ab08b16e47d51d170618538a0b754c5c51d25", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773917624, "uuid": "ecac707e-6ca4-4561-9d36-55b06e0fb03a", "comment": "Malware payload", "value": "fccbd7898c98d7b23da131d6c77788c0acb662387206c866c4d83c0c6c47b19221d63ac79cd4d684df8bacb377cd9aed", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773917624, "uuid": "2a867c3d-16a2-4758-81ea-7b09ad3a470a", "value": "T13E85280BBCA549FAC4AA9231897661927B31BC490F3163D72E90B37C2F727E0AD75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773917624, "uuid": "977cc0a7-fe91-4ae8-b991-6d55f99d5dac", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773917624, "uuid": "46e45d35-ae5d-47b8-aa5d-b2b1ccf65be9", "value": "24576:P5Yrl8e+0p5dl2AEKnCVgU/6j3JQzlBeleX7KD+7/qwa/:P5Cl80p/dEcU/44H/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773917624, "uuid": "7fd19c35-f263-4810-9280-c27ac36cfe8e", "value": 1823232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773917624, "uuid": "41d2cf5a-a27d-4128-a3ec-388d9378d562", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773917624, "uuid": "bebeb5a0-dadb-4e1b-979b-901eb651eff2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ca915e-2354-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773897954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897954, "uuid": "281cfb40-f335-49a3-83fd-ebd8eea7c95e", "comment": "Malware payload (Vidar)", "value": "3fd16a25bd635214523a34565e94ac4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897954, "uuid": "ddea50c2-e634-45e6-a988-b3bb2fe1ba9e", "comment": "Malware payload (Vidar)", "value": "c89ec06e1527286cd1aca06e1ee91b90b3211e112e0afc65a79459356bfdc252", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897954, "uuid": "d27b0d1a-74c8-4711-90d7-0944f256154f", "comment": "Malware payload (Vidar)", "value": "3ea13056d2a01c29e70b1f85bd01d3614a44d942", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897954, "uuid": "6d374ed7-086f-48b2-abb9-48df067bc0e1", "comment": "Malware payload (Vidar)", "value": "82adb6634741112f11442ab5170d72bc0a7aaaefa9860759eee27883a97898e9991b4219e5b7e2bc10bdf7ed99ec6a96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897954, "uuid": "3c0ec518-9f52-46a6-a587-a56104d910d3", "value": "T143959B07BCD461B9D4AAD23289B211A1B731F85A0B3137C72E45B7B82EBB7D45E35384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897954, "uuid": "0461921a-3546-4753-b5f4-273d68845fc6", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897954, "uuid": "8145cae2-6aa2-4068-ac52-d3766bdde873", "value": "49152:tKfDiW3DgQS0pdeXIIv3DdPL8HMYgtO1K1:sHhIbdPQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773897954, "uuid": "89279354-6296-4337-9a52-f9e41a04d448", "value": 2002944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773897954, "uuid": "7cfd5f1d-fc6b-4862-9681-9e93ae69790d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897954, "uuid": "16f53489-a3fe-49b2-889c-56b1f42f2490", "value": "p7bvymein.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c0b7238-23db-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773956154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773956154, "uuid": "3d9819ac-e56c-4b63-8ff6-8ed232799fb2", "comment": "Malware payload", "value": "ee30809a5cc4babb5ba13424005149b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773956154, "uuid": "1d4832dd-544c-4dd7-b4c7-c6ffefb34ea6", "comment": "Malware payload", "value": "c8f3b84814fe469e2d551c141b37bf74e350bfeafb31a530d2582788cc445789", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773956154, "uuid": "faf3bd71-9178-4f05-96d2-502295b572ef", "comment": "Malware payload", "value": "1a07dc0a7b8926c556992e8a857656055e0783c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773956154, "uuid": "d265a5ae-ff11-49f2-9d8e-4dd4e99779a2", "comment": "Malware payload", "value": "9b71ff0cab76c2f0f6b8398fc25b567feec99e53b2d29300ee4fc0f3fdd2a8ff6e653c96d7641e70624f290b0ce0f49e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773956154, "uuid": "0805153a-ef93-4d66-a75a-09fa36a8bb6f", "value": "T125160850FECB44F6D9031D7054ABA22F27316D094B28EBC7EA64BF56E9776921C3620C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773956154, "uuid": "d4149e98-c3fb-407d-9a5c-571be49904f7", "value": "49152:v98CKaXPmgRdjhxnf3IuAjwh0XAW/6lzdWKUI1w5RTKJtU0Sk8KUfPPPwPPP3PPQ:v9Bugvf3RABB4w5RTKMMn8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773956154, "uuid": "b30ebb28-2ad9-4d8a-b143-4abcf7a1fcbb", "value": 4313088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773956154, "uuid": "70c778f9-0996-4ab5-ba22-ed93fdd1b95f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773956154, "uuid": "6143090f-c4f0-4cfa-89fd-6d02846d761e", "value": "linux_386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "823b958f-2348-11f1-a769-42010a9c0008", "comment": "Malware payload (NetWire)", "timestamp": 1773892975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892975, "uuid": "ca66e3e1-1684-4612-a1ae-a1402c063f2b", "comment": "Malware payload (NetWire)", "value": "90fb1840272d2a5616f30267b37e26d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892975, "uuid": "1d3063fd-301c-4d60-823e-90c930bac83e", "comment": "Malware payload (NetWire)", "value": "c9698f088b8e2207272a65388944608737408079b18650a0361aa4db5a8571a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892975, "uuid": "b7b164bb-4999-45e9-8522-3af9b4ae2bba", "comment": "Malware payload (NetWire)", "value": "6efceb0f7c5a0674ab5e6565450b2e181eff47e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892975, "uuid": "7cde6303-00bb-4eaa-b060-ba4c02cb7763", "comment": "Malware payload (NetWire)", "value": "e46386cc1eae564e9968906940463253c71c148767b6b603bafe074721866e46bb1b2b507a220913f46905070a5ec5c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892975, "uuid": "72e4331d-7a51-4218-add5-67b11da9e99a", "value": "T12565BF52E39EC2F0DE165172BA7DF73A1E3B3C254530B9566FC5EC3AAD21021112DAA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892975, "uuid": "f5c40bfe-fdad-4321-ac93-3507b00d39bf", "value": "dcbf4f6f0a66c4ef804fdb68720c8682", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892975, "uuid": "e71f834f-ce84-4bf8-a402-02e2a6a97ef4", "value": "24576:nu6J3xO0c+JY5UZ+XCHkGsoEAdx20W4njUprvVcC1f2o5RRfgdWY4:ho0c++OCokGs7Adgrd1f26RNY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773892975, "uuid": "0a9f542d-9ef3-4e9b-a559-156bc8f50eb7", "value": 1460850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773892975, "uuid": "051f0b17-f1f8-4ed4-b25a-4cda0f87e094", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892975, "uuid": "2abab9bd-ea92-4ffd-bf8b-45075a5fc066", "value": "g87h8685.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a605d47-233c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773887620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773887620, "uuid": "1ab899d8-aa85-4308-9d22-d41758fa9a33", "comment": "Malware payload (Mirai)", "value": "456588c3b2acf72a7e111e0e7274a19f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773887620, "uuid": "b0fdeec0-fbae-4e1d-8ba9-3b6320cbd0a4", "comment": "Malware payload (Mirai)", "value": "ca75aa84821ab28adae9c0ccb6fd5cf318ea38c3f26984027e2e3e8b2e23303a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773887620, "uuid": "b14cb619-a8d2-41b9-9dd7-363fb83e1fff", "comment": "Malware payload (Mirai)", "value": "4e0faabdf75d271f2f8e338d0531e87a8093a748", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773887620, "uuid": "a12e68fa-a8e2-43a6-86a8-f95417e2055a", "comment": "Malware payload (Mirai)", "value": "83469ebe3af4b537059a03c9ac788e83e3b928a1cb11ea7a01969edfce29e4b7f756360cb00bdfd507ad6c2cd9e4f4e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773887620, "uuid": "a6e9d17b-0548-4413-99c0-f90a8fe3454b", "value": "T1F0933985BC41AA22C6C156BBFF6F018D371613A8D2EA3207CD295F6137CB81B0E77656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773887620, "uuid": "1d9c4c5f-b708-4053-9ba5-1386a767ea10", "value": "1536:dU/ApPbiCso/2aQzS+tLWxEuZ9Gi1nhiL5/ALe/N/fueDvYrwO9XPztpZuyOv32:dUY1bi/fS6Ipxg+K9fueDANVUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773887620, "uuid": "1e441938-137c-49b7-a572-b81761220890", "value": 97184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773887620, "uuid": "af6f1d9f-e6be-4c86-a832-53e0b6ebccf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773887620, "uuid": "f0f2e582-56ba-4b69-9fee-0d9e8b563f66", "value": "tuxnokill.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "082e7fcd-238f-11f1-a769-42010a9c0008", "comment": "Malware payload (CanStealer)", "timestamp": 1773923264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773923264, "uuid": "4db34e74-9bd5-474f-99f8-b9258dc29a6b", "comment": "Malware payload (CanStealer)", "value": "83cee594430a8fd342a38bfccb472881", "object_relation": "md5", "Tag": [ { "name": "CanStealer", "colour": "#FD6137", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773923264, "uuid": "d339f576-0ba3-4c5c-baf7-67157ec8c8a1", "comment": "Malware payload (CanStealer)", "value": "cab376c7681dc06ced3baf038686e3f142247141b2c70f866161693f8e0ea738", "object_relation": "sha256", "Tag": [ { "name": "CanStealer", "colour": "#FD6137", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773923264, "uuid": "0c337a28-0f69-4beb-9bea-1c2ced462a8a", "comment": "Malware payload (CanStealer)", "value": "830b52639423b3eb0d9ab1db94c8a1def6abb94d", "object_relation": "sha1", "Tag": [ { "name": "CanStealer", "colour": "#FD6137", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773923264, "uuid": "cd835751-ce08-4562-9cd4-dc2a5bb4518c", "comment": "Malware payload (CanStealer)", "value": "0e88d482da50d12956bbd46f1c897d46fc6d4a5d5e7b032263f3a5dc8ab267910708baf5f340a123825df91b450cc749", "object_relation": "sha3-384", "Tag": [ { "name": "CanStealer", "colour": "#FD6137", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773923264, "uuid": "bc096539-dc67-49ba-a7af-655688844621", "value": "T188183314CF6D0827C0C3E775907B4ABCD4510D75AAE62A67A637FD809D37E3A209DA0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773923264, "uuid": "5550b785-907a-4d84-82c8-709513a79d8e", "value": "1572864:00z6teWeuZo+FywouEOGpXBV2GSk8nmHVivCyBvZShzjQr+kaaJJs1TG8B7zlPKW:00AehFwodOGBnam1ivCyBgRjVMsfhAf6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773923264, "uuid": "c961bc5e-3727-4888-9a8c-82fabc17d2ab", "value": 86499328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773923264, "uuid": "b7bda837-9be4-400e-af1f-b23cd424a820", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773923264, "uuid": "38692888-96f9-4994-be01-75209c012b7f", "value": "cab376c7681dc06ced3baf038686e3f142247141b2c70f866161693f8e0ea738", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c066ddb9-233b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773887496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773887496, "uuid": "58a27a72-5514-4ad6-96a8-96ecb1f26c90", "comment": "Malware payload (Mirai)", "value": "dba9da039a1a519fe845992520d0e291", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773887496, "uuid": "4a9618f9-38dd-4112-82c0-497e766049ef", "comment": "Malware payload (Mirai)", "value": "cac52df5f41670ead6c70fa13acd2e2a8b9fc633d019160b609a099fcb814386", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773887496, "uuid": "e0a4e2ee-2d7b-4ade-9223-697a8b341561", "comment": "Malware payload (Mirai)", "value": "3b39d32d8fe49b7ee4d9b3224d87251282975b68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773887496, "uuid": "e8cf8157-3e61-4c35-a75a-b4359320c45a", "comment": "Malware payload (Mirai)", "value": "ac19c67f27035b7510bdde9a4978ca3352dc77d95d63c58960c4ff3bbc02e8e964ee457fa85cbef08a87fe81efcfda0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773887496, "uuid": "ac4f8114-115a-448b-abe5-22946b87d08a", "value": "T192D3A54E3E318F7DFBA8C23447F74A21A24923E526F1C545D69CDA011E6438E685FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773887496, "uuid": "155357e9-ca1a-4d93-bfef-02e321aab179", "value": "3072:8jmJeeo5/dzyYqujf8FsFvJn/4Y+LmZ69y5:TJeeA/Nh8FsFvJ/UyZEy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773887496, "uuid": "8047601c-6ca3-4449-ad73-deda58325119", "value": 134040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773887496, "uuid": "b3944375-90f7-4407-9add-4c78a6523c86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773887496, "uuid": "faa4548a-db8b-49dd-a64b-248ab9570473", "value": "tux.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc601f2-2369-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773907030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773907030, "uuid": "2bd452d4-b2ca-43f5-aa83-e915fac00f3c", "comment": "Malware payload", "value": "2f8883f0e9e24b87a1bded87e27bd775", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773907030, "uuid": "96d27015-c747-42b7-a8ec-af357efed9ab", "comment": "Malware payload", "value": "cb14c05efa0cecbbda853d4a063aca4161e96bbaf6e763eb4bc2a3db315c7bc7", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773907030, "uuid": "8bc8284a-f163-4311-ad5f-36d9b50e2b6f", "comment": "Malware payload", "value": "ac948fa29e4b43510ddf85c24494117c2a32d335", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773907030, "uuid": "df5cba53-6a5c-4acc-a835-3360709c3922", "comment": "Malware payload", "value": "d4bf900620d800e3c644e5621719e2e3c9eeffaf69fb06b6e97cd0d7a1579de3e16d6cf50bfd9963ae98d0190c880ae8", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773907030, "uuid": "306a496e-e12b-4dfe-a7b3-115c6a7aeb76", "value": "T194C109563DDA5E2449821CE1D6F76715AA85D3CFEC913EC072E06209FD0BE392B219DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773907030, "uuid": "d6cb5995-6222-4d3a-bfc6-54c4c657962b", "value": "192:QbWYlZf+6zA9pCedqmzke5QIdlIflzflGflUfl5fQZ226CUvWtXSCiWPv8f7bSfC:Q6YvflzA9pCedqmzkoQIdyfxfwfSfLfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773907030, "uuid": "9fd5f420-44b0-45df-abb9-edf3058127bb", "value": 6149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773907030, "uuid": "e9495df5-23e3-4fd0-8ce6-38b8e34028c1", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773907030, "uuid": "54e65470-9d82-4e51-bc11-8c20701b59e8", "value": "death.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c05cbe-2353-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1773897833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897833, "uuid": "647399c3-0ae0-464b-93e6-d8e7e012539a", "comment": "Malware payload (OffLoader)", "value": "025a9324da342b0a5873208151f80966", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897833, "uuid": "3fdf8c5c-4900-4de5-90c1-b64f4cfb3bc9", "comment": "Malware payload (OffLoader)", "value": "cb7262cedd29d5273e5624a6d37c31d4d943ad747db349591830b5894554e290", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897833, "uuid": "6a52e493-ce9e-438a-a7e7-f06d2ac85f9f", "comment": "Malware payload (OffLoader)", "value": "620f8d5bee84d5fdb0b4a6fa0501a99f5b5ad174", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897833, "uuid": "98559bda-aaca-4301-bad4-46ed3e0a5ca6", "comment": "Malware payload (OffLoader)", "value": "c8e3270cbd321faba2f63789da58a2d931dd4b0bc3994547dd2c1689c7a93d68fcb0f88aa02169e94ef5f9019ac4e9ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897833, "uuid": "604114fb-efa8-47db-b3ed-755073b7d130", "value": "T111861227B28A673EE06E5B375AB292104D3B7A51A41F8C57A7E40C4CCF2D0602E7F657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897833, "uuid": "72f50da0-56a7-4a2c-9b89-e1e0c73aeb5f", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897833, "uuid": "46fecfd0-3bd7-4a69-b0c2-3e60dfd9c7e7", "value": "98304:bN66amY5ifs7O4DYjDc/oLT2hytGPzofzlj8D2I3QQzE8wKSL0IrF+erMqzVVFfU:7QwspEDcALT28tGbMqfgQPwtoe1z32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773897833, "uuid": "93c7c441-397a-4ab9-9e08-ba6b5a36a3ef", "value": 8348916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773897833, "uuid": "49d7a519-cd2c-459d-96d8-0d5732fcad55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897833, "uuid": "fb27d5f9-cbbf-40d3-9647-ab7c4bfd9696", "value": "Setup_Launch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f2d8426-2372-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773911036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911036, "uuid": "4e4c78da-e06c-4559-a334-1253b7e1b9f6", "comment": "Malware payload (AgentTesla)", "value": "c09bfe29795688e16af6571a62369a44", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8501998229", "colour": "#3CAE2F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911036, "uuid": "bdada40a-6341-4783-9bc0-c6abdcb85e16", "comment": "Malware payload (AgentTesla)", "value": "cc2742e1a2b4021a2de5bef4f4a0e323003ba2f96a9dc95e0a9b817b3b50b0ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8501998229", "colour": "#3CAE2F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911036, "uuid": "c3afc962-d2eb-4bbf-a5b6-8351e4bf841e", "comment": "Malware payload (AgentTesla)", "value": "f4e7d221dd8ca1402c5b0b7d7f2eb30cf13b97d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8501998229", "colour": "#3CAE2F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911036, "uuid": "c5212046-caa2-4be6-b581-40a74217356a", "comment": "Malware payload (AgentTesla)", "value": "0d5d91c3353a01ce736a259770533d085d4d126845bc98f51a61a5bd330d837ad480a6b3aa9d8ff67724066b59fc1d30", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bot8501998229", "colour": "#3CAE2F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773911036, "uuid": "8cbbff19-f62a-4b17-94c2-2beb351b92a2", "value": "T18795337D807A8A07ADE8B1A61BB4C76ED834DDB61D99010B0FCED25C1143EA23E57F25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773911036, "uuid": "52d77b71-5279-4688-8778-8233f10f19b5", "value": "49152:wevY9tewVDdVMZbV37QvsYl8ULfCh25k4W0ra3EdS3Fb:wQaewVDzqVc36wdWCdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773911036, "uuid": "ff31e778-5fd6-4f00-80d1-55e5cc01a894", "value": 1882393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773911036, "uuid": "9c42883e-3565-469f-a33a-9d0e3e6ed5f6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773911036, "uuid": "5bf80b31-2871-4062-860c-333491cc46e3", "value": "Amul.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f313c1ee-23b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773940838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940838, "uuid": "f6d10116-d9af-4b83-ad78-cfc360793f6f", "comment": "Malware payload", "value": "51c53f0a9eed6efbd115f4fdedcc2936", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940838, "uuid": "17ac9840-bcfc-4590-8476-2e740a453957", "comment": "Malware payload", "value": "cfce609802692905054dcedf85bc451e652fe5177f580b5b3e8806fd1f9a7295", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940838, "uuid": "67f04415-077f-4f8a-aa28-b4fbb6a82d67", "comment": "Malware payload", "value": "35b1488b92f03882f6ce9c3e30a07baae018d10c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940838, "uuid": "c128f98e-ecee-42b8-aa94-ba68408c573d", "comment": "Malware payload", "value": "a9eebf21f1a02c0961bce1177ab7c25f8f01a2d8c0d7f400cb9d6024524567fd54bbf81dacd1a6fd29b7c4a0cfd24fb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940838, "uuid": "15b7aeac-2b08-46c7-af36-ac8496f58ed9", "value": "T1B2F48C03E74ACEC6C0DDFEBA20A1061B49A75C75BA6C834EBD5CB53B9DF22811D22751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940838, "uuid": "32363229-d2cb-4496-ab6e-ae6eba532ddb", "value": "12288:OapOinnk5SiCNXpckbFVCiPQadSSgG+zhgb+rBqm5jutI/VaJdV:2innkMiCNXphoIEG+zubmyu/VaJdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773940838, "uuid": "aec18b96-f66a-4f8c-a4ff-4560c4ee3a77", "value": 771288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773940838, "uuid": "93cd17a3-2989-4af9-8e1a-025b8b21caea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940838, "uuid": "bcb5d1a6-90b2-481d-bf60-45420e03c6c0", "value": "cfce609802692905054dcedf85bc451e652fe5177f580b5b3e8806fd1f9a7295", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40dd0b2d-23d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773955142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955142, "uuid": "7fbd30d6-27fb-4d81-887a-d3e51f73705e", "comment": "Malware payload", "value": "fa4da0cb74c4fbc6b28572bd96e2eae0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955142, "uuid": "7b53474b-acab-4e3c-96c2-4e85b6873319", "comment": "Malware payload", "value": "d14f2cbe763c083e82375e4b6fa19386d8514e1b35a87e6d5e42d465a48e818c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955142, "uuid": "790f26f9-7b4b-469d-9366-8b71d058dbc8", "comment": "Malware payload", "value": "761c0f39bd1b7ecc0df0d8842451f8fbef3dc9cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955142, "uuid": "c0605a99-5f1a-4497-84d5-5eb2a12ed083", "comment": "Malware payload", "value": "f2eb537fa1f4b9863c26189d333dfd25ff9ff193c9962480b476a2337273c3b38717cfe043bae67ab5904433628bcc3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955142, "uuid": "388e8c58-4fc2-4a81-afba-415590a978bd", "value": "T1282619526E18E71EC62911345CB2CEA86B7E1C9A41D7A917B345F309B9B20BC0D6FCF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955142, "uuid": "9e18329f-3cc3-49af-908d-ee218486436d", "value": "49152:3e0GUe1v8hicBZ1raTK3J33N8a0NNTG3J3vB8uQ9UVWXQaFBgaN/OzCXIG3Qn1+Z:3e0GT1mWaUqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773955142, "uuid": "54281b77-861b-4d37-b725-c22779e694b7", "value": 4784128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773955142, "uuid": "e7257cd0-db6e-49d4-9fed-aa8532e58170", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955142, "uuid": "cf907112-7dac-4d8e-883e-159a5b3d0e2c", "value": "linux_mips_hardfloat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f388adfe-2345-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773891877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773891877, "uuid": "1220ff55-e816-4837-9e53-012f1f5eb4bc", "comment": "Malware payload (Mirai)", "value": "40b14174219f58fbabd7a554a6f7baa1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773891877, "uuid": "203f0b3e-b69e-43eb-b1c5-2250001816bf", "comment": "Malware payload (Mirai)", "value": "d232c0960f24ba4bb369821b1bf2836d9e576a34fa3ddca2618c80b2f54277f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773891877, "uuid": "f894abb6-97ee-4fbe-91a8-0f36b0429aef", "comment": "Malware payload (Mirai)", "value": "74879ae5e4985606e4c97293f0386da027839183", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773891877, "uuid": "76ca433c-d47a-447b-96a3-730ed74a2742", "comment": "Malware payload (Mirai)", "value": "64127fe382778911f744f7d4b9f9de55f32e9443f4d791180b88e529cca8c878408575cbbd1cf1eca0a12da40550562f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773891877, "uuid": "50abeb25-b030-4077-93dc-11d5d85936d6", "value": "T16FB3A70A3E219F7DFB6CC23447F78A21A79833D526E1C685D15DDA011E6038E685FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773891877, "uuid": "0ff82c00-e91a-4514-be7e-7487bb461b82", "value": "3072:6ba5h3ZQL5zyYn55yUiSkfQC9ccrPYop7Siki:6Ih3ZQViUiSkfQsHTYopuiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773891877, "uuid": "98015b2c-f2ca-423a-b078-4122b100b881", "value": 117776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773891877, "uuid": "70bbc5a7-4302-495d-9542-743fe48f6bf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773891877, "uuid": "973731d9-ee48-4b1b-ab56-645fd05c7946", "value": "tuxnokill.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4462bb6d-233d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773888147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773888147, "uuid": "e48352e8-5690-4c84-ab34-69b89175da8e", "comment": "Malware payload (Mirai)", "value": "1bb38cfc6216599e2a40ee51add1d970", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773888147, "uuid": "bac0348e-9792-4670-85a9-ec2b68ef272c", "comment": "Malware payload (Mirai)", "value": "d3e8db8315b0c11a575da587fd60b54b026cbd631cec72dec5a3a07706f2a6a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773888147, "uuid": "5a675525-0ea7-4f8b-b068-172efc79ba54", "comment": "Malware payload (Mirai)", "value": "4ed130594b357bbe37fea9c4dfac7115005cebc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773888147, "uuid": "36c9a412-d2cb-4623-9ca7-432564712ea7", "comment": "Malware payload (Mirai)", "value": "8e49c779b0ebedfc0c9a785f8761de828cd47a9912bc6a0a69819cf5cc4f0aef424f4a31a92fd11690daefc80d623d36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773888147, "uuid": "187c39a9-594e-4ac5-a685-8114d12aa5e4", "value": "T1E7933985BC41AA22C6C0227BFF6F018D331653A8D2EB72179D295F6037C691F0E77656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773888147, "uuid": "39b5f854-d405-4bcf-9ca1-e3b1eb7f0f36", "value": "1536:v86IozS2lxDBxyI/LvIqj/x+i1xx9CnhVgqFAIxdVBJNI/rAOFeNyGtKVSiEXsC2:v86PzJlEuvz5hwArInJNwwKbRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773888147, "uuid": "2de4e9b9-1b61-4236-864a-43793c4631d1", "value": 95372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773888147, "uuid": "5d49df4c-d2b0-4298-966e-2a94503bec51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773888147, "uuid": "753eec6d-c420-4c53-b43b-8fd7850df816", "value": "tuxnokill.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3bd7789-2372-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773911151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911151, "uuid": "4a160661-05e3-4368-9de7-ef5e10ba332b", "comment": "Malware payload", "value": "4abf0f22a13496453d31c2217da557f0", "object_relation": "md5", "Tag": [ { "name": "api-zipsphereapp-com", "colour": "#CADF87", "exportable": true, "hide_tag": false }, { "name": "Chrono-Orion-LTD", "colour": "#D76FE9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911151, "uuid": "0631e378-c8c6-49fd-ad44-932000ebea3e", "comment": "Malware payload", "value": "d46402e9b1c792fd716a7e474cac50bb9f6924aeebfd25bc0f1efdfa7fe34081", "object_relation": "sha256", "Tag": [ { "name": "api-zipsphereapp-com", "colour": "#CADF87", "exportable": true, "hide_tag": false }, { "name": "Chrono-Orion-LTD", "colour": "#D76FE9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911151, "uuid": "33b59154-3f12-4ccb-baa9-5d68220989b3", "comment": "Malware payload", "value": "6d2d98b991660b66c8d3de7f29a439ff9ffc5f97", "object_relation": "sha1", "Tag": [ { "name": "api-zipsphereapp-com", "colour": "#CADF87", "exportable": true, "hide_tag": false }, { "name": "Chrono-Orion-LTD", "colour": "#D76FE9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911151, "uuid": "136e1839-bb4d-427f-bcd5-5610cfbde237", "comment": "Malware payload", "value": "fbf42dba1c5d83f00e0ba6050f7427260a615bf0e0929a277bfb033a450830631e981beea7713af44c75420702a38b8c", "object_relation": "sha3-384", "Tag": [ { "name": "api-zipsphereapp-com", "colour": "#CADF87", "exportable": true, "hide_tag": false }, { "name": "Chrono-Orion-LTD", "colour": "#D76FE9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773911151, "uuid": "5ffbb712-f969-40ad-9709-d7f82de18aee", "value": "T173866C17F323832DC71729359AA1C3617375BC517916EB1B70AA3E48DCA72B40DD2AE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773911151, "uuid": "ea6ceadb-35e1-45fa-87d5-0d20d3cf80f7", "value": "98304:5SrJmc2lHHuK4INllc27lVvdgttoZfnVBNeo0ZAiPc7Rnd4WXcaowkwm5dbjiVc4:+0RHV7iKMx5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773911151, "uuid": "ae1bd0d2-6e62-43ae-ade4-b6590e758851", "value": 8147672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773911151, "uuid": "33328685-3cee-4000-b249-718350537fbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773911151, "uuid": "2b42a7ab-2e52-410f-a0a5-dbfaf017ef5c", "value": "d46402e9b1c792fd716a7e474cac50bb9f6924aeebfd25bc0f1efdfa7fe34081", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d282f9-23a4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773932355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773932355, "uuid": "890ae116-9541-49bf-a0f7-b6c2df4d859b", "comment": "Malware payload", "value": "25272a57b1e0412a0b03c4c54d81f512", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773932355, "uuid": "6d8f36f9-7ab9-4aa3-8af8-07aa57a32ed1", "comment": "Malware payload", "value": "d46d7acce8ce99536d7d7dcbdb04099b56fefdcae28c44087fe337ec401f15cd", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773932355, "uuid": "abf43f74-fbe8-4e3a-8001-0954c95f39fa", "comment": "Malware payload", "value": "873ec12d547768c1af767d6394b359dddd1708bc", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773932355, "uuid": "66beb8d1-b36d-4fc2-85b1-66b3d040446a", "comment": "Malware payload", "value": "69cc34d13ddf128df05a7401413f16bbf30cb5eb10ce81885eeec865e7b7d47efa9aee260f7d7665ba1b5d36916989d0", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773932355, "uuid": "d28f35cb-da35-4659-bbae-04d1f0db9561", "value": "T162B311898F4E64B9C79AB828D4DF9D07DFD89212131E8062765FEC403F3295E60ED6E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773932355, "uuid": "ebf34d9d-381a-43e3-8191-2205fa9a0bea", "value": "768:Iw0Jd1MNEJ3gjo+how4C+LWFggrVvBsbYWx/4d+3jvbMkb0KsYmiwyaOc2Tgi7pA:Iw1NmH+how4C+L2+zgKuiB7RXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773932355, "uuid": "42e400a6-41b0-4e0a-9603-24ffd9eded9c", "value": 111709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773932355, "uuid": "a919383b-113f-4d73-86dc-382490463e6e", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773932355, "uuid": "77a6660c-764c-47d3-a442-7052358fefb3", "value": "Z_Session_Europe_1759.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b49d3336-2339-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773886617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773886617, "uuid": "94d57d14-ea4d-4c9a-a4b3-5504bbf8e81a", "comment": "Malware payload", "value": "e894468f9b66a754f3caefabddee096b", "object_relation": "md5", "Tag": [ { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773886617, "uuid": "c31c68b1-1620-4f97-9696-8a974a766510", "comment": "Malware payload", "value": "d6f34b1f3a32f7df2dc5f709ac9fa37b6e149ad44a933cf921f1e0b20ff45ff7", "object_relation": "sha256", "Tag": [ { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773886617, "uuid": "722c327c-5a51-46b6-bf48-e2b2af516502", "comment": "Malware payload", "value": "381ef111b9ec6e1c1e93856616900f563000bf78", "object_relation": "sha1", "Tag": [ { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773886617, "uuid": "127c5fd0-0ee7-4bf2-b2f0-a42afcf3a2d5", "comment": "Malware payload", "value": "88dff80513dfa0b782e2b9806fedd4908796e0e28517284d6e39e7ca57da0fc803d8faa4a33fa888c8689654e798208c", "object_relation": "sha3-384", "Tag": [ { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773886617, "uuid": "3a780151-70ff-474b-a2af-98fb9e45c6c7", "value": "T1FA961211738AC636E15E01B7D42EEE0EA139BDA7033041DB63F4B99E2E724C1567E792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773886617, "uuid": "3fb8fa89-9167-45f1-aa7f-df226b78bbe7", "value": "196608:eylQ2xD5xC75LBJoKKk+e05GczcRpbrCahZdsAQ:e12xD2FBNPEqhuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773886617, "uuid": "b712d437-192d-427b-9206-7d135eae6c3a", "value": 8882176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773886617, "uuid": "b7c213b0-72b4-43fe-9318-9d7226b57599", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773886617, "uuid": "9e2d1fdc-3aee-4eb8-b6cb-5186b4e65ffc", "value": "Chawuchro.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "860cf95a-2329-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1773879667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773879667, "uuid": "417cb24f-f7f6-478c-b7e9-c696209a6d64", "comment": "Malware payload (SalatStealer)", "value": "6c492750ea02c917cb472ad74a86f0a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773879667, "uuid": "10cfd60a-de21-417e-b37f-cb1ba5b3b950", "comment": "Malware payload (SalatStealer)", "value": "d732f9a42679a2e763dd882d08a660b09dd51045cd073e6336e4f4627d21f183", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773879667, "uuid": "79241465-cf0d-4a16-8de0-33c992bdac9d", "comment": "Malware payload (SalatStealer)", "value": "c150436e571e7d329c6d21ebaf90c7d47995797c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773879667, "uuid": "681f6d4e-f1d9-4e20-9079-d443729313e1", "comment": "Malware payload (SalatStealer)", "value": "85eaa717b7942c4e3c18adbe8fb526d10bb60b06c8bc229c15198a6b524dc9c5e95c6cadcb1c00a0f587594bf8ebb3d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773879667, "uuid": "e19c59d0-9dc3-4a9f-b97f-790a4c58114d", "value": "T173E53373A42847F2D66103BEC088E09C76E534750883D55DBFEA6B6C52A252BB43D39F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773879667, "uuid": "38a2bb7d-2b5d-4cb4-a736-d2011867e628", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773879667, "uuid": "e5b83929-45ce-444a-b898-4e63e29810c4", "value": "98304:2rrLt+M2/DhlTr6XFePjcgkH2hfeuwqibco:kLkT/DP/6XA7sHAeuwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773879667, "uuid": "6c33aa03-54f1-425c-a888-fa8bd2318688", "value": 3296256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773879667, "uuid": "c2da6dbc-3560-4964-a5d8-af865274c43a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773879667, "uuid": "ee5e1a22-beba-4ce1-b1e1-5b61e1f9e9e3", "value": "vpn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244f517d-2398-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773927177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927177, "uuid": "c14bb9c6-851b-48ab-a4e2-8d2d29692b9f", "comment": "Malware payload", "value": "1c9ea99a4eeef05fac62fced58f3875b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Speagle", "colour": "#A458F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927177, "uuid": "392748db-9636-4685-98e2-bd9e6f0c5937", "comment": "Malware payload", "value": "d7f167cbf1676c14fd487219447e30fadf26885eb25ec4cafdeabe333bddf877", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Speagle", "colour": "#A458F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927177, "uuid": "f444b379-6da1-4f43-8737-af313668db35", "comment": "Malware payload", "value": "6849d6c63bb69374f3d6fe1c8e3a80c7544f35fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Speagle", "colour": "#A458F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927177, "uuid": "b898b141-1a06-4bdd-bf79-7420ada26f41", "comment": "Malware payload", "value": "22dbbf2014e5f6a47b3b81b7723d494ddb81b68b45a72a22d8d7ec6eea4fc7d49be32859e9e0faaf157b0c9a80d5b4ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Speagle", "colour": "#A458F0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927177, "uuid": "a551fcac-c3de-4b9d-b7e5-b4e6d5cbc3e8", "value": "T141F4182A3AD6E82BE1AFCB70D1D12C698768D0229307BBCB056592F15D533D0BD4A47F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927177, "uuid": "f96c4725-b13c-4132-a199-2b013ad2a35d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927177, "uuid": "3ffd5b40-5cb9-4c66-9cfa-edde06830a25", "value": "12288:0FiwX7lYGXQ0c2BQ7BEE8RLfaIgERQJPJ0TT6F6nBp63gA4+Z9rKcFN6lr4jt:QpYGXQWBY0RLfab1mKF6/st", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773927177, "uuid": "f91cb256-1d19-44a9-b5d7-eb638070ede5", "value": 785408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773927177, "uuid": "0afdeab1-7e9c-4e2b-8117-2673203de5f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927177, "uuid": "835de562-5f64-4177-9860-d8da584eab01", "value": "E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7425b18f-23da-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773955658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955658, "uuid": "7d721bdf-ebab-4afa-a086-ed69e9b341f6", "comment": "Malware payload", "value": "0b68c8d6f22471371e0395b20098764a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955658, "uuid": "0cd89f03-59cf-4d6e-b713-a2f1a52f1ffc", "comment": "Malware payload", "value": "d97f4dc437525fd5a20043f03f5b9be19d5c9781d060e477e6b6e6da2e925fac", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955658, "uuid": "4b222e43-ecf8-4cb6-b1c6-a2b54c902713", "comment": "Malware payload", "value": "69346922b6153c8f9d651d365b4b3c4cda6de668", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955658, "uuid": "4d155e0f-89d8-496d-9f92-6546b17a40bc", "comment": "Malware payload", "value": "8f8cde3e18b3d1423e34abbaafa758e2788ca5e56bf2aedeaee3e9021760fab0b7fbc1c5f17d860f04b2215a8c3ec66b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955658, "uuid": "5317127e-a975-46a2-870c-b49aa78c96c7", "value": "T1C8925DB512896C79FBD1CE399F3C6F4CADE8C2C42124B3ACBA0F39205A1166DC705349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955658, "uuid": "c4ea9b58-be0a-47df-a667-717339e03062", "value": "384:TFcuQpWx+BL0SWL0gczsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:TF8i+BL0SI0vzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773955658, "uuid": "3c205fc0-6e4d-4482-960b-22034aae52c5", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773955658, "uuid": "1860476c-97ad-47f4-aa91-e06959c64e81", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955658, "uuid": "5cf0c01d-3d5d-4cf4-bb4f-4c1d1c330cb5", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dd3e37f-2390-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1773923918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773923918, "uuid": "cb889755-f49f-4827-b398-90c0e8df0919", "comment": "Malware payload (DonutLoader)", "value": "cb48134a95c7674d21533e00806fbd77", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773923918, "uuid": "ec54d0ff-8b35-4528-8fbd-84d646e1b2b7", "comment": "Malware payload (DonutLoader)", "value": "d9c0913c0be2b20e93c4eaac52dd6dce96b0f67acd5f8b6fb7f7c754b85a1536", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773923918, "uuid": "af982a07-8313-4574-b3ae-e774a3bd9f9c", "comment": "Malware payload (DonutLoader)", "value": "a28c1e9576d56c7b91cc738a4d587ae7bdb28e66", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773923918, "uuid": "0deb05e3-da71-43ae-bf57-481c85a0c468", "comment": "Malware payload (DonutLoader)", "value": "7a1b8ce3cf75c16807844dd48ee9bebfa3bd234d9a003786a16f38e9b582ba4de18ea9796e52fa9e80df409e3d86c07b", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773923918, "uuid": "7f87f50b-d8ad-4535-ae1b-840be595d359", "value": "T1AC66B601EA5D9B30B9FD9B2CC439BE018688631B2054FF2D327D155D77A1B63139E8EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773923918, "uuid": "0b4f4275-2b35-468a-be29-a0578de6594b", "value": "98304:ejdWIrXVCzDIq5e6q3n/yBviU0CX1u0J7VJZojuBTOWFhTJMgpSrzEiSk8CfmZ8:Kd5cCKBvyCX1qETOe5pSnZS3Cei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773923918, "uuid": "b31fba8f-1562-4725-958f-690f5e275c5c", "value": 6727950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773923918, "uuid": "a780fdef-f310-4d3a-aab9-fe109a89223a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773923918, "uuid": "abc30387-5fa1-4f1c-a1df-c14e0586857c", "value": "Quotation 1563050.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f2917f-238a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773921407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773921407, "uuid": "fab3290c-c3b1-4703-9057-472a0d20628c", "comment": "Malware payload", "value": "e6968471e17dd1d7add053fc14222304", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Jianzhuohong-Technology-Co-Ltd", "colour": "#EA53C4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773921407, "uuid": "02a79df7-c3b5-4003-a21f-cc9fc23df540", "comment": "Malware payload", "value": "da361708f2c756adb006851c7da2a299c4e50da7922cb55ae64a5835b614946c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Jianzhuohong-Technology-Co-Ltd", "colour": "#EA53C4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773921407, "uuid": "d603cb27-5605-4ca3-919f-d261a633c1f7", "comment": "Malware payload", "value": "03d48273c8ae950c117b6ce2ffcc921f4dd002be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Jianzhuohong-Technology-Co-Ltd", "colour": "#EA53C4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773921407, "uuid": "82e9be68-06fd-46ab-8c13-825b0a6d8356", "comment": "Malware payload", "value": "ac7e1b216d46d9182b3981c9ce827cd6654f6ddb5013a1cbb32d2e4c58bf324e83930b2fc69af3e2fc961e699a6fee1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Jianzhuohong-Technology-Co-Ltd", "colour": "#EA53C4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773921407, "uuid": "849c051e-2e11-4463-93c8-a2f50e4a0b16", "value": "T199A55B43E1A394ECC1ABD0398666AB73FA20B82D01347E7B5B95D7311F71EA0561FB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773921407, "uuid": "91f42989-6f64-425d-8fd1-3238a7df79cc", "value": "f5392b34a955f86aa3019d3c4a8ae08f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773921407, "uuid": "a4cad0a0-d19e-4f1a-9a9a-070dd87082f2", "value": "24576:MFSlJy6itEJ65ATIT3jync4WC1MP70Xv+rb++gF/bHz4BPgoFp/Jf09nW6BogVB:ySlJ5J65ATI/ytMT0X4++SbHz+PJYnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773921407, "uuid": "4ddb66b4-3cae-45df-b0eb-2685cb1345f7", "value": 2150120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773921407, "uuid": "1763728b-fcca-4424-8450-3baa5fa77816", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773921407, "uuid": "2c677762-06a7-4fad-9a6d-0f373b5d2f24", "value": "da361708f2c756adb006851c7da2a299c4e50da7922cb55ae64a5835b614946c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a65d0c-23a8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773934407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934407, "uuid": "d518f97d-a780-4085-9dc3-e60a412c4e53", "comment": "Malware payload", "value": "d734791a54b5201afbd049d02c5bf8bf", "object_relation": "md5", "Tag": [ { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934407, "uuid": "468fd964-d7ba-4b3d-aabb-08434b98209a", "comment": "Malware payload", "value": "db2c3b131d8682d79e94d516248e1d9103c9e5080be8f045fd36b53533276f3b", "object_relation": "sha256", "Tag": [ { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934407, "uuid": "39ddaed1-0f09-4e48-9957-323cd147ac58", "comment": "Malware payload", "value": "f0b1f308506c10ed6583a2e7b84098cce8ac93ba", "object_relation": "sha1", "Tag": [ { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934407, "uuid": "f7c05b1e-adc2-4f94-bda3-019b8eec4382", "comment": "Malware payload", "value": "f530a8c30da9e5608b1854d6469635c7a0dfc20dfd483de33f9d8293a84ecf371ab51293dc7dad24196274dc624096e2", "object_relation": "sha3-384", "Tag": [ { "name": "LIUSHEN", "colour": "#E1696C", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934407, "uuid": "3fcb7a85-ca86-4f35-be0e-79878bcf83d8", "value": "T1A343B722EC69BC14E393D66D995794432B4A78076A053C3C7BECE1601F8D33DC6B5AB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934407, "uuid": "2d4cd709-ad9f-4c94-a4bc-d453b74f0ccf", "value": "1536:C4TViXI5CW5lgbiWq6C/W8rtatdm4NitKzIW5MOJEVr:Cg6C/X0biGGOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773934407, "uuid": "7281203c-c99d-4c36-9019-a3f9a90954ec", "value": 58683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773934407, "uuid": "40447bdf-116a-455b-9947-b7e075cb7db8", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934407, "uuid": "01a120af-abea-4018-a7c6-2cea8c50ebc3", "value": "db2c3b131d8682d79e94d516248e1d9103c9e5080be8f045fd36b53533276f3b.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5557d8fc-2348-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773892900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892900, "uuid": "50985c55-66ee-456b-8d14-28f7a02c63d6", "comment": "Malware payload", "value": "222c7d27d3eea777b9180f9ff6210406", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892900, "uuid": "e63d3099-dd58-4f29-a9b0-8398ddc38a9e", "comment": "Malware payload", "value": "db57a104ad2c37ea1ab823dae708d00b3eb65195067bd6ce326138e8490e3afc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892900, "uuid": "229ebab9-0a18-4e2c-9d32-66206989948b", "comment": "Malware payload", "value": "12e7e89266991a4c7c4f52013590213232e9753f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892900, "uuid": "22501282-fb85-41bc-b3e2-dedc493c3701", "comment": "Malware payload", "value": "748d965070b58ecf88094fb6a41a1b9c3bffb47f9d6e7a56878212614d8efd6c2d9ecaa0b5d46362d754f6c086a3ffc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892900, "uuid": "2aefbd2c-f290-4e4d-b0fd-cc9ab434dc7e", "value": "T197157D52B3C3C1B2EFA215F3D9B557360939BC78133889C7B7D8282DC9A26C06A75359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892900, "uuid": "bc22bcca-fa6b-4252-8c68-e94966acdd27", "value": "471485476459c716374c5ae96580f71f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892900, "uuid": "2d8b519f-29a7-4efc-a54b-13eb1d8d98af", "value": "24576:ybi/QhDC8mY93kyw8hC2A5CxLbRpWrzzZyP4UMd6ZG:d/QMnl5YL7WzZyQRd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773892900, "uuid": "b87524d8-ec0a-476b-9bf3-d67232347398", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773892900, "uuid": "14c5b6a2-b1e4-40f5-a50d-9e7c95d4e3d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892900, "uuid": "b45b28ae-8551-4124-af0b-03b2868cb0ea", "value": "Y708155257.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554f7d2a-2377-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1773913086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773913086, "uuid": "d6c97c06-f1ce-4130-8ff5-7df5ad6052db", "comment": "Malware payload (SalatStealer)", "value": "c4be31ffc31dc359cb5a66c577ac1a0b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773913086, "uuid": "b7bc1166-244b-47ce-959e-73f0a77d6a4c", "comment": "Malware payload (SalatStealer)", "value": "db6381cb9c7713c1b142fa6013d85c84e8121917036131e707488f1dc1111f2e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773913086, "uuid": "ea7b3438-73af-4ef0-accc-dfac3d3bf86f", "comment": "Malware payload (SalatStealer)", "value": "4dcae5b96ab678651be1fbe431219725849b5541", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773913086, "uuid": "e9907978-0503-49b9-a836-6204ebc7959d", "comment": "Malware payload (SalatStealer)", "value": "0be43eabd87696de17f8f767141d446b1630911527c5b28c091b4e5eaf7f6cd9288104ee58b4d3ebaea0cee11ee66269", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773913086, "uuid": "3217a53d-b2d8-45f9-9115-9e6ba492d650", "value": "T1E5F5333FE459B131D07647B4C1937A1B8E8AB50DA968798C5770C2B313ADEC3A1C49F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773913086, "uuid": "2d632e52-5a23-4229-ac4d-e3540c9d0b5b", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773913086, "uuid": "052384ba-2abe-455d-ae17-6523e72cf3ac", "value": "98304:pDk1pu/99cVQkR0vqLT7sQp81QFPrk8gh4op/U:l5RvqLvP0QFziKoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773913086, "uuid": "4e7f3da2-81cf-4977-b419-8dd4b3dac3fa", "value": 3592192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773913086, "uuid": "7896f199-3da3-4e1e-ba90-4b823efdb53c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773913086, "uuid": "ed1f8539-ce1b-43c5-a120-64dcd85bd337", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b9024c-233b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773887371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773887371, "uuid": "1c918d8d-3900-42ab-99b6-8e3bab2e1500", "comment": "Malware payload", "value": "f826b2bf8e83d8ce787ecc81daebca36", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773887371, "uuid": "1db4f5cb-8433-461b-a3f0-91485809caae", "comment": "Malware payload", "value": "dc9ec8cc29b821abc61d2bb9275febf4237cfcd1b96b08b53796155c2a1c17f5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773887371, "uuid": "93b7a7c3-e6b4-489e-8b9f-facb20a816fa", "comment": "Malware payload", "value": "74c00183304b408114e656027946d3ce363c4e97", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773887371, "uuid": "a903ec75-28b5-4529-866c-7ec5960d4645", "comment": "Malware payload", "value": "4b4c7c2bf9049e433a96c8211619b91c453f3f76a5c05ee6a0915eee520466de8da400dd4b96854b32069dca2e8bfae3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773887371, "uuid": "9b8c6642-435e-475c-8bea-36e161bad558", "value": "T140925CB512896C79FBD0CE399F3C6F4DADE8C2C42124A3ACBA4F39215A1166DCB0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773887371, "uuid": "bbad8695-7da1-4b85-b8e7-3c074f8a1558", "value": "384:hFcuQpWx+BL0SWL0gnzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:hF8i+BL0SI0YzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773887371, "uuid": "1dce3be3-9548-4217-88de-0ae228ab93fe", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773887371, "uuid": "70a1f4b5-52bc-464d-9981-22dd108fe346", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773887371, "uuid": "649e1f83-46de-4a81-8fc9-c06eeed5353b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b389335-2398-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773927216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927216, "uuid": "81325a57-f7d1-4621-a8c5-6afee44c929e", "comment": "Malware payload", "value": "9411b5b8c025edc897d23f4fa6b38f2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Speagle", "colour": "#A458F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927216, "uuid": "b6f3fa60-4b07-4c8a-baa0-472fb1714927", "comment": "Malware payload", "value": "dcd3f06093bf34d81837d837c5a5935beb859ba6258e5a80c3a5f95638a13d4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Speagle", "colour": "#A458F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927216, "uuid": "891544b1-9321-420a-a5ff-7f52bb6592f7", "comment": "Malware payload", "value": "df926c55bdad0722517bbb631f81069ba209d072", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Speagle", "colour": "#A458F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927216, "uuid": "914b0da0-bc96-4bc7-abf0-13f8180ff9e7", "comment": "Malware payload", "value": "667a4943e97f3b880cf54aaae6954dc22f298b82d9c0d0b27a897aa1d3275bf30c33b6f98cd2be6f9a66e4e7ec238f70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Speagle", "colour": "#A458F0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927216, "uuid": "6bdf9f01-aa0b-4ffe-a9b3-9906ca169a9e", "value": "T1A2F417163AD9E823E1ABCF70D5D1399D9B68D022A746BFC7112181E24E43391FD8A47F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927216, "uuid": "597aafd7-a402-4918-93f0-8762ec637a73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927216, "uuid": "5efbf655-f808-4aac-871e-b41f7577b7c2", "value": "12288:+VlZmX2X1ZxVD/HydYVandNGZ38J8Xf+EfJ8QfAmFTKaCx8UYH8swtNnFrgR:4SU1ZxPVOdNGdY87abmFVH0/FrgR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773927216, "uuid": "ce9d53d8-408c-4e04-865d-c204415af640", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773927216, "uuid": "15f2ed97-af5f-4450-8745-72ca8ed068bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927216, "uuid": "f508ef65-269f-4d73-89ec-6aee4c618574", "value": "H.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b88fa5b-23d2-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1773952046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773952046, "uuid": "157ee73e-e5c7-4c17-9f97-c70b297ad3c7", "comment": "Malware payload (MassLogger)", "value": "0f85745b3800e8421353eb7478974dc7", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773952046, "uuid": "f5b165ae-3196-4405-9b79-919be7cd1bf4", "comment": "Malware payload (MassLogger)", "value": "dd737dea20792860147b53679f68e964778a2b47e98d7187ccd4ead0127aec76", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773952046, "uuid": "65a44954-7c9a-40a8-8979-98860a47222d", "comment": "Malware payload (MassLogger)", "value": "5fe39c460aa7d1e6b57ae08111e260d802477c86", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773952046, "uuid": "c1c38c39-234a-4b7a-ba21-1695071cf73a", "comment": "Malware payload (MassLogger)", "value": "bf6de73cbd2842e1f0aaf7e4f6d7c1bf2e4105d70baf5c7affb0b38635ce5dce8f9f18242c1a24f8d60a7b5c31e692e2", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773952046, "uuid": "61ca1070-a6a6-474f-a3dc-4ad807a58523", "value": "T111453AD570B5D0F796400A6C39B51AE235782ACA35879C382207B72CBBDE7516E4F28F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773952046, "uuid": "c06fe23e-1300-4347-adec-02b9999b5bb7", "value": "24576:5zLhTSZL0fJ88iXTio8r3ekxqZjKRTP7htF3vpRKNtPs78QgceF18KbC8/IVhBH8:5ACh88iu3/agPlr/pRz7IBF18KbC8/IW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773952046, "uuid": "f0f9f24b-1430-4e04-9029-a92b20502a89", "value": 1219066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773952046, "uuid": "1a638c7d-ea8e-42d1-b799-f2a56512a474", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773952046, "uuid": "e0d73a0c-a679-4cd1-92ba-a7127ed20da1", "value": "ENCRYPT.Ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f23a72d-2354-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773897963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897963, "uuid": "50566b19-1b82-423c-8b8c-e4db515dbd65", "comment": "Malware payload (AsyncRAT)", "value": "37472fd91a92af8ebe685df09381277c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897963, "uuid": "c61f0c0e-7a59-4366-9ad7-b8cd4652eb92", "comment": "Malware payload (AsyncRAT)", "value": "dd8375126f30b07852e283371e84a9378e79668fa69810214b42edbf1d870bda", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897963, "uuid": "a24eef13-315a-4be6-b46c-40d49c28c79d", "comment": "Malware payload (AsyncRAT)", "value": "b6d37fc9f803573a008b493c88b6b82499b6c40a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897963, "uuid": "4890c927-a8d9-41d0-acde-93296128fa2c", "comment": "Malware payload (AsyncRAT)", "value": "8817262e54a7da581673e8b58e6af1620d305cfe9a95f7448335e1eeafe06de1356eb2392db4d2e57b4caedbabd58b76", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897963, "uuid": "8cd7c742-c260-4dd3-b77b-e4e60c5b7af4", "value": "T16BA47C16F79404F9D5ABC174C9924646EB36B88E1B22EBDF1798432A1F237E08E39714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897963, "uuid": "91b2a61e-6131-421f-98e9-8229bca448e1", "value": "75d930149d98b9b34c55459c6a79b293", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897963, "uuid": "5d8c8fd7-b134-468e-a335-9102136618dd", "value": "12288:jYyDi5rNiQ7uysMFZzN/E/msumGlsEmPWmCbxu8JGH:EyvgUGdAoGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773897963, "uuid": "710fd20a-e6ab-4dd8-88a8-7abfe9d31b2d", "value": 488288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773897963, "uuid": "637291aa-2089-4264-bc9c-b30cb905e587", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897963, "uuid": "666ad336-3fe5-466f-8356-21e1477ac2f5", "value": "r6ygdthh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64706cf3-2395-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773925996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925996, "uuid": "58551c92-00e2-419a-993f-54fa7c364b1a", "comment": "Malware payload", "value": "cae4db76c3a7bd208d628727b087eb7f", "object_relation": "md5", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925996, "uuid": "e02cb0b1-747c-4140-bded-19c83d7a6e1c", "comment": "Malware payload", "value": "de68226566cbf1d6f5030a84abefa1621c625c22f2ae31866af2d4afc48d51cf", "object_relation": "sha256", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925996, "uuid": "fb1b14f8-0235-4d66-9433-eb8d454757d6", "comment": "Malware payload", "value": "2affe5ec2a63c2c3848a3d4dca32cf54a70d8246", "object_relation": "sha1", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925996, "uuid": "a256117b-b11e-479b-bae7-c845fc9f7c45", "comment": "Malware payload", "value": "5e1c1218bd2144e7a25a93d7a706f9b7d8974d3b489f2d55a9ef0df8adaf55d07124e83a6392f7ab2f1aadc52839fb74", "object_relation": "sha3-384", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925996, "uuid": "8140409e-86c7-4ff3-beb2-25ec11edb9c9", "value": "T11A93022782187553CEDB8E7EDCA185471E37B380DDF1D94D75142008AC237DA2FAA99E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925996, "uuid": "8097a57a-11e1-4752-86ab-debbc2aacf74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925996, "uuid": "5d2587de-d8b0-4676-b2d6-b175599765fc", "value": "1536:qYVakRhICypE7VZHm9oBlSTSougluRrSgna7eFeh2sU+yN9rBv:qYVauOTE7VZHm9SouglircsehnU9N9rt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773925996, "uuid": "1a21c58c-f5a3-4a00-8bb7-a52787543ba7", "value": 97496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773925996, "uuid": "34069714-0cac-4177-895a-f8f82d4f5d9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925996, "uuid": "ceb3fcdb-146d-4eba-8bf5-0a9b7a285275", "value": "de68226566cbf1d6f5030a84abefa1621c625c22f2ae31866af2d4afc48d51cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02270ec6-23b8-11f1-a769-42010a9c0008", "comment": "Malware payload (EternalRocks)", "timestamp": 1773940864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940864, "uuid": "71493f93-8ad7-4436-b2fd-15441ce7afa2", "comment": "Malware payload (EternalRocks)", "value": "8149eb8784a27fedccd9efc62adffc96", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940864, "uuid": "ff2c06a5-281b-4935-800e-ce681f7682b2", "comment": "Malware payload (EternalRocks)", "value": "de6a89934b09b3a090a3e742e4375b366a56a9b3ad12d5112be2b56c3124ceb5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940864, "uuid": "1c38f4e5-b291-4a2a-9b83-450ef523e9ac", "comment": "Malware payload (EternalRocks)", "value": "9b356fc67f88e711eb997c8712c13ec319116853", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940864, "uuid": "2f516312-e37a-43fe-9ea6-26fbd3fca6fd", "comment": "Malware payload (EternalRocks)", "value": "39996a4a68144b98fad026e92f9fdad37203e05600d9d931c456080ec23d26c3a9e769c23f1efd43a849b36e9a46cc85", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940864, "uuid": "dab2328b-9bd6-4542-af96-002c342ce0a4", "value": "T1DB653353309C9F6CD48011BF2543F280BEFADD84FA6085076C487B96B6B5CE996785CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940864, "uuid": "f1695f1c-a12a-4eae-939b-db654f0ae883", "value": "24576:eUkZ+vMII/DOqPxic4ShwCczA6Vuv17QKnCC7fyOC4LhHaX1gJccghhCkbY7W366:zk8XGN2SSCz6KnC6ap4LVaX+JXcEkbYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773940864, "uuid": "cfee9441-8eea-4040-941c-2f4107b565e7", "value": 1462272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773940864, "uuid": "9e7bfd14-2a6c-4df7-bbe3-347e844101bd", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940864, "uuid": "2ee7c34f-d895-4eaa-a49e-58a4f817c32b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793fc6bf-23b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773940634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940634, "uuid": "2c55ca4c-c364-422b-ba2f-be1cf7974dd3", "comment": "Malware payload", "value": "52270c63af2b52665a0de1ebf4abb6ab", "object_relation": "md5", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940634, "uuid": "76cacd36-9403-41c2-94a2-b093ca853773", "comment": "Malware payload", "value": "e087a147917e3c9d13f1e37add9cb7cb3e7585ef0e60be89316079bfb31ee12e", "object_relation": "sha256", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940634, "uuid": "60f3fa5f-b85a-4a28-ba06-0c078715e744", "comment": "Malware payload", "value": "d16ad14c2d79e7fd59993b2c2dfe52e0f595c242", "object_relation": "sha1", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940634, "uuid": "7c44b2c7-8e69-4427-9199-bc4a2f0ca613", "comment": "Malware payload", "value": "31d42d62512360499e29dae652f38015a8ecb34d65ad6666bca44d4c93d9f2f246c3e7f8136f6c43fe6cf6ff9eb2a58f", "object_relation": "sha3-384", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940634, "uuid": "6770c564-a11b-40fb-ae69-0b6af7dd4076", "value": "T160168F03B388753EE4571A3A583FA680983F7A213A26CD4B6BF40D5C8F396416D3A757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940634, "uuid": "e2c58507-e937-4f1e-bc83-01c3a033e9dc", "value": "4f3a70412c909e6e8f69020f0bee4f39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940634, "uuid": "0d026278-921d-4cfd-8b4a-c9c58cfcc6f0", "value": "98304:j3U5HY/KwjoYY1j48UWm2eTMFdC+Jr333WF:g4/1jorPmEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773940634, "uuid": "bfbd3679-bc96-4c93-9eb4-8d55f2ced714", "value": 4372680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773940634, "uuid": "d7a0e838-40eb-4b2b-bf48-ef57ea57e37f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940634, "uuid": "adf07e28-ce21-4b68-936d-eff9834b1f7b", "value": "e087a147917e3c9d13f1e37add9cb7cb3e7585ef0e60be89316079bfb31ee12e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "821a952d-2391-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773924328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924328, "uuid": "b8855fdb-725d-41da-afd8-2e3c455da32c", "comment": "Malware payload", "value": "5267aacf348ddc908d439eb007d33fb2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924328, "uuid": "37abc281-3287-42fa-b7cd-dbbdfba47c70", "comment": "Malware payload", "value": "e15ebe6b60173a80a7fc6b421ad5bc59d72404eae2e71ff1b0cf530b20c1d886", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924328, "uuid": "5d01a998-e7bc-4c03-b973-903fe2425846", "comment": "Malware payload", "value": "655d5c274551ed9944f2267f2fb26d4782e96334", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924328, "uuid": "7e8cb3d6-2db3-4e42-8986-624f268700fa", "comment": "Malware payload", "value": "7438f51eab050c7ba201749affec3004cd01adb4844c1417ed6b55748cc3237e644990d56f22081aa990f069ca7958da", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924328, "uuid": "85b9ef10-a185-42d8-8689-578b86f54183", "value": "T1FAD62346F78CB12FC47745329AA61772118B4D4A8D82EB0B6605730C6DF7AC49F9AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924328, "uuid": "25e47a07-4a71-4305-847d-50619f8e22aa", "value": "393216:6LDTFQ2kTgjLHywyXoDHKVmYIGLlDO9dzu9y2OuZgi:6LHG2ugjIXcY1O9d6rRgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773924328, "uuid": "909003e3-9d2d-443c-aa34-72accdd0d5a3", "value": 13638915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773924328, "uuid": "1fa67e90-ebda-43a1-9474-65380b2a571b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924328, "uuid": "f13f6502-e6bd-4997-97be-88fcbb86c2ca", "value": "SuperVPN_3.0.6_[Mod].apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "843babab-23c2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773945377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945377, "uuid": "d560263b-175d-4428-8660-f46c0b73353e", "comment": "Malware payload", "value": "646cf30b8b0a71e54075aaea68d7dbbd", "object_relation": "md5", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945377, "uuid": "a0c56459-40de-4781-a3a3-bcdee22e9f32", "comment": "Malware payload", "value": "e36a7b5141a3a8eabd6fac3e22112f508b76dfeeb95e12dd6442de3685bab4f8", "object_relation": "sha256", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945377, "uuid": "e27cd1b4-2cf5-49cf-9e00-67d248148c6c", "comment": "Malware payload", "value": "5f53a4a6c1058c8107d8f04278701f1aec2ebb66", "object_relation": "sha1", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773945377, "uuid": "f2c21f06-f0cd-463f-b8d9-881e936a0c50", "comment": "Malware payload", "value": "28b0b2a8c1e76cf971ae82ff54c1d066aadf35073b6c0eafbe0cf0127b7b754045990dcaf48b18f4c8fe5eef9d5b35f7", "object_relation": "sha3-384", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945377, "uuid": "da066a74-b16c-4a48-88b9-80e43ffa99b9", "value": "T17E51FD0B97E84A6BF4B70731AEF3431227B4FC505B73636E0980022AAC707545A72BB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945377, "uuid": "a7587a8f-631e-42fb-9c27-cdeda189a277", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945377, "uuid": "a9a0dd54-9a9d-4db8-9487-c0aebe860ead", "value": "24:etGSEfB2JuwALu8zigklnlKeoU12tkZfv5q5LEWI+ycuZhNeqakSJbPNnq:67MwARziLltNDJv5qFn1uleqa3JRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773945377, "uuid": "2536b3bc-3e94-4ec9-9503-67e5a15e3cf1", "value": 3072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773945377, "uuid": "4b98d220-3df2-42a6-b344-ea156b4e6e8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773945377, "uuid": "d692a2b1-41ed-40f2-8501-5f965e8bccd1", "value": "rv1qfrtm.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9aa09a-2395-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773926012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926012, "uuid": "0fcf61c0-9582-4aea-91be-ba0a2f027222", "comment": "Malware payload", "value": "175fa2b9a567c639bd6b7929d5f8d9db", "object_relation": "md5", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926012, "uuid": "bd4c90f4-92c9-423c-93c2-59fdde9f604a", "comment": "Malware payload", "value": "e3a9d91987eade1d639a286934eeb0483ddca57febe7a827e4539a82554c6d8a", "object_relation": "sha256", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926012, "uuid": "ce954118-404d-4510-b480-ab7195126ab7", "comment": "Malware payload", "value": "6c91bc685cd7802d5bc5de6f253b1c69b9605367", "object_relation": "sha1", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926012, "uuid": "1898c2d9-85c0-4d3c-88d0-c22a1610b43e", "comment": "Malware payload", "value": "8476b7f5d60f04c23210e03eb4a571a0df352598982f6dde32e33bca22a8f08b670506ef0ce9f9802d84d93aee697ba6", "object_relation": "sha3-384", "Tag": [ { "name": "Chengdu-Jiadao-Hexin-Technology-Co-Ltd", "colour": "#698E92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926012, "uuid": "cc805c33-07f4-46cf-8c9c-2376d4a03509", "value": "T176632B882BECC463DA7F0FBFA821F46686B0A553B519E68E3CCC65D42763B405235397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926012, "uuid": "6c55a454-964a-4add-a135-bb58b0239b4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926012, "uuid": "08bd6009-ebbd-48df-aad9-b720ae68379b", "value": "1536:VbdCHmDf/w2XuFd28KJyEq2EBLrWmMjjFxpsRpBXw1kesC47XlNwNuW1TUkf0FsO:VbdCHmDf/w2XuFd2LJyEq2EBLrWmMjjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773926012, "uuid": "6d80b728-1720-4770-9291-b1e80a5efbe6", "value": 66776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773926012, "uuid": "79af0db8-555b-4833-a8db-282cc5850b09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926012, "uuid": "cf77c838-3261-4fc1-b704-a2844cb08784", "value": "e3a9d91987eade1d639a286934eeb0483ddca57febe7a827e4539a82554c6d8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e4b6a76-2398-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773927301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927301, "uuid": "97219e66-9372-4060-bb55-df9c443e0db7", "comment": "Malware payload", "value": "bda2088d03bccd3c1fe4231aa2c062ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Liansitong-Technology-Co-Ltd", "colour": "#A420A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927301, "uuid": "7a560c2a-0a24-4765-8fa1-db10c686e8e5", "comment": "Malware payload", "value": "e67d9ee06cb74b8f18d20781e9a6e8920bf8d7536ee0c773c91d87f8d2e17c0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Liansitong-Technology-Co-Ltd", "colour": "#A420A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927301, "uuid": "8d6f409c-6eae-465c-88a8-ffaa05c9d549", "comment": "Malware payload", "value": "abf8a87a6d48facca404c9385023abff43fbef47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Liansitong-Technology-Co-Ltd", "colour": "#A420A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927301, "uuid": "2c9b9da8-2a53-4b3a-8453-08a23afe8dd0", "comment": "Malware payload", "value": "2347f0bed738541cab3e474e412633201c9e63c1606554a71d8fa3a36a4e14f81ed44cdbc8f8a99ffc9512fd1f31a586", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Liansitong-Technology-Co-Ltd", "colour": "#A420A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927301, "uuid": "32f304cd-d2b2-43c2-a18d-ded121d68303", "value": "T14754020EAFBD8921CD286FFFA319D771C078E293399AFB413698C50529EE70244D0766", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927301, "uuid": "c5213845-6d74-4d84-86f3-947d71ce623e", "value": "6144:Cvg4nI36wwlxVO6SPt6wwlxVO6SPg6wwlxVO6SPF:Cvg4nVwwl2PYwwl2PJwwl2PF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773927301, "uuid": "91ac6a45-3aa4-4ef2-86f7-7d9a310cc890", "value": 278784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773927301, "uuid": "85d9162b-8f52-4279-a183-b24422655560", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927301, "uuid": "ffa104be-a017-48cf-9eca-71172cc8c196", "value": "e67d9ee06cb74b8f18d20781e9a6e8920bf8d7536ee0c773c91d87f8d2e17c0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7985aa7-2398-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773927397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927397, "uuid": "56cb34d8-27f9-4256-9854-6390ddc57d13", "comment": "Malware payload", "value": "fa17ea8485df556f9fe6a1aa9f9b7116", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Liansitong-Technology-Co-Ltd", "colour": "#A420A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927397, "uuid": "d0d827e2-a7bd-4d5e-ad2e-0f018c0baebc", "comment": "Malware payload", "value": "e6ff9329c96c2fefb7656a594e40a2d0d12c1622f75d076486c253e445d7a117", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Liansitong-Technology-Co-Ltd", "colour": "#A420A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927397, "uuid": "b9a07efc-111b-4e17-9d99-1912661681e0", "comment": "Malware payload", "value": "edc3a69ac8e3f06bf0237947b5820517845d0a84", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Liansitong-Technology-Co-Ltd", "colour": "#A420A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927397, "uuid": "94df04ec-7259-4eb5-a0ae-55ba1b3d516f", "comment": "Malware payload", "value": "cfe75228325660bba1a6177cda3bdf086e8d2533db32b9fc077f70aa9dcb923a4d5ebb0ea5258753e41124b33702e1eb", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Liansitong-Technology-Co-Ltd", "colour": "#A420A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927397, "uuid": "529a2651-883a-457e-b133-2ff0077e7655", "value": "T1CB76CF307A8EC036E62E01B1AA2DEB6F953DBE720B7144D763D47D6A18708C25736B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927397, "uuid": "56bdf3cb-f19a-439b-9262-03842f629c09", "value": "98304:BiI/uKL8gfAqSnqFozxY/XuF7P6xRwAMhu89r6qauA0+PO6wM5DG7kkwb:SKhA7nqiMuVP6xeB489rdaf0+2MpdZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773927397, "uuid": "12e0b372-7f8b-4b5f-927d-d54cf0f09348", "value": 7464960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773927397, "uuid": "ee8289ef-31df-4ac1-96ec-c05a36cac89d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927397, "uuid": "727ab603-fed4-4752-9c47-47d49e01c1f2", "value": "e6ff9329c96c2fefb7656a594e40a2d0d12c1622f75d076486c253e445d7a117", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f68dc285-23b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773940844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940844, "uuid": "666e91d5-63be-4092-a6d1-07dfa4d6b99e", "comment": "Malware payload", "value": "b6cc056d196126ee00e0b1c1caacd53d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940844, "uuid": "e883223e-44d3-40ab-aa7b-8d0751e98bd7", "comment": "Malware payload", "value": "e7af0b8bb1fe8f5ba3f61b0b1320467fc25733abb813394ce915003968b19350", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940844, "uuid": "14eae23d-ae7a-4278-a982-d5ca6a5c8aca", "comment": "Malware payload", "value": "f41eb4a5e1ad8ae3dc3342abecae92ae6110bd45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940844, "uuid": "2563c9f5-5a53-4f2a-bec4-b42ae550bfe4", "comment": "Malware payload", "value": "58b107040c6c38200c60a8d1706dfe34c03482735a6e680a1db5af06a71cf9d481644a0c0c1bfc02dbf880ecd0fced54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ice-Ignite-LTD", "colour": "#3B76BE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940844, "uuid": "198a0f0d-1090-455a-95f7-d5dcf0ca9c02", "value": "T1DB173343F794DEC7C0DDFE79A0E0094699E34C74AABD430ABD2DB5BBADA21402C99354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940844, "uuid": "56a85ed0-ac36-4b3d-91a4-1331d53018cb", "value": "393216:/bZmOQ2oS9n1PXnB2LFU0IJ78KExxVJ0ANLm3RNBfc4fKWFhC:LQ2oST3B25U0GyVJncBkOFhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773940844, "uuid": "56fdaedd-4356-4ef0-b588-74d725ae1762", "value": 19016408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773940844, "uuid": "b4223f7c-2fc5-474e-95ff-f3d7d747fa23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940844, "uuid": "17a28c8b-0c3b-424e-b11b-074f274c72a0", "value": "e7af0b8bb1fe8f5ba3f61b0b1320467fc25733abb813394ce915003968b19350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c93899-2392-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773924737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924737, "uuid": "cf37d2ba-b92a-44c5-bf45-54afdb5e27ec", "comment": "Malware payload (Vidar)", "value": "5f0ef437b9ad8819f8f23aee8923773f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924737, "uuid": "463375d1-72d5-41b2-8bc2-7a62bae209a5", "comment": "Malware payload (Vidar)", "value": "e86c157b93e3a2c13113316aa34e92b2b7bcdae11eccc04f26fdcae00427b7c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924737, "uuid": "b1df34b2-0eb2-427f-aac3-4e75f2e543fd", "comment": "Malware payload (Vidar)", "value": "62c7ae9b9e2ef2d6388b9b8925406e1ce8c02fe2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924737, "uuid": "6aa82662-cd40-4f92-a1bf-5d4ddf268934", "comment": "Malware payload (Vidar)", "value": "5107bd2723400c4083c3c2e304eb570a54333baca240b709253e1749cbd1f19d5b4577926666ea8bea69b5cb17379f5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924737, "uuid": "e4da2f0d-4afc-4fa3-861a-6b442ef69864", "value": "T1D5958C07BCC465B9E1AAD23289B612A17730F84A0B3137C76F41B6B82F7A7D45E35394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924737, "uuid": "fc310513-b924-4d14-810d-2e9e2c888bb9", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924737, "uuid": "101899b0-0410-422b-a7e2-d0466f330dd8", "value": "24576:uf8H8rLZI9o2ifK6QldP6LNf4wXKyoLXFjkLtDhsZ0IOcsYgt/CfzDK1:u0H8rao2ifK6QlFkayIkHsbMYgtWDK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773924737, "uuid": "15bb7f2d-67bf-4ec1-be5a-b62bcf9009c4", "value": 2017792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773924737, "uuid": "c3e2a94e-9d4e-4099-8a61-6f5719b1669e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924737, "uuid": "8759141a-d675-4cfe-9ba8-fd790815f889", "value": "e86c157b93e3a2c13113316aa34e92b2b7bcdae11eccc04f26fdcae00427b7c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62201b18-2391-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773924274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924274, "uuid": "364f2b47-df93-4806-9616-878d81a76fce", "comment": "Malware payload (RemcosRAT)", "value": "88afcfb20096eecf822dcd139389a4b9", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924274, "uuid": "77ac6f84-688f-4254-9f24-d7d48b144ae1", "comment": "Malware payload (RemcosRAT)", "value": "e9a1519c73728ff5bac38f7d0c48cbd3e900a8b04352abf7ed0b6974dddb46f1", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924274, "uuid": "d3a47289-622e-473a-8dfe-fa0438692dcd", "comment": "Malware payload (RemcosRAT)", "value": "67b42fbf428c740d20376812345d7920417f58da", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924274, "uuid": "511bd5a4-5cb1-4771-991b-5e1f392b295c", "comment": "Malware payload (RemcosRAT)", "value": "85f01096624da4f975c2406d9c0f68ad4a960bba505c5d35bbe31591c35352ed2324b1abe437160c9e4ddb75b101b900", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924274, "uuid": "51d38747-8c8b-40a3-a613-5ceeb8fef0ae", "value": "T1DD647B975CEF244AEBB690B28D6719DB825ABD4D1B4394E3B310F28E907C6E591C3D03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924274, "uuid": "04abd0ee-43e1-46ab-9b36-be5e7fcfa9bd", "value": "6144:kh3pFYk4TbzO4pFYk4TbzO3EFbUyz9xOFYiiPsaTogUqE:khcR6LR68VbONYXUgUqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773924274, "uuid": "bfa05ffc-0bf0-419a-8a4d-602acdc0a269", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773924274, "uuid": "788fb7da-f08e-405a-8780-5ffa0066cbb1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924274, "uuid": "e01063dd-cac7-4edf-b339-9cbdb5325887", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.32058.25693", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade63f90-2385-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773919248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773919248, "uuid": "4f767995-8bfe-4109-8f76-fe40e5b6d83d", "comment": "Malware payload", "value": "3f7a7f448dfb25dde4d0f46e44632793", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773919248, "uuid": "35b0d050-be71-409a-9d85-12732fcc6cc1", "comment": "Malware payload", "value": "ea5b4d95f55d4c1234afde9d4663172b2b578806a052914a03c7ee51d2081068", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773919248, "uuid": "44aa7b2e-85c4-4ed6-a6d5-3112669617d9", "comment": "Malware payload", "value": "644025b0c402444b4755e0e482d90e105e95372c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773919248, "uuid": "00655963-5403-4dad-93d6-c66a4fac95a7", "comment": "Malware payload", "value": "f4e50e238fce49e97fe5dc74e53389f3397ab87d0b23b9bea0d236a52f69e766ff01f77daefc113afabf6989ad8eb584", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773919248, "uuid": "05165a16-2ec5-48f1-b970-76c4f6601bea", "value": "T130C723237684806DE5A905315E6FAEA0E2A96C335B2141DBF290FF591CF05D2BE33B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773919248, "uuid": "9770e484-d485-4047-90e7-e29785a8de1d", "value": "a5a0f941862df8e0d01359e62a3aaaf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773919248, "uuid": "07be8e93-5c75-4d8e-8fb4-a34bc7d5bd2f", "value": "786432:pLo/yafzHycVCOvxmG9pRfyn3WKvtcjppTIIj9+iaq0AuglDjnxvJzqcnh/:Fo/yafzScDvdUW4cjbZ9+jAugNn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773919248, "uuid": "21235136-e969-465a-bc95-581913b3362e", "value": 53520072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773919248, "uuid": "6cc73874-c44f-44f7-811d-d98866618681", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773919248, "uuid": "cc9f9a55-5765-4e04-bfb7-006ef84f74aa", "value": "SSA_eStatement.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e998a0b-23d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773955165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955165, "uuid": "9c2941e3-c0d9-4430-9efe-8bd4b749377d", "comment": "Malware payload", "value": "69f6f85e247d3ee352269200c87f0374", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955165, "uuid": "ed5166f5-9624-4f16-bb4f-a0b2adff3fea", "comment": "Malware payload", "value": "ea67345e99150d5d38382dcad1e508784a28ea8347440191d0c698a57c4b2cff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955165, "uuid": "01c267b3-844d-4cca-9389-8b1bb878940b", "comment": "Malware payload", "value": "106a236d85378cdef6d7404b05e5e0c8a4011261", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773955165, "uuid": "1dcc0bd8-c63c-4b21-9b18-ac1fa95dc7af", "comment": "Malware payload", "value": "60ff6bcf64dbc3648a2eb9a3db91b021bcc741180560b23bd9f9a81a275aacd64ebb705d1136e66757902f08b69976a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955165, "uuid": "2f3dc954-f9b9-4bf7-a97f-66bd054fada2", "value": "T11826D908BC842BAAC02C9B7894FBCE5523701D144AF55A366664FEE9B8762347F47CDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955165, "uuid": "e5a9abe8-8ade-47db-aaca-fcbb83b24f32", "value": "24576:+gKaqN4CfxSUTlgo5y+A8H2AMvxcdl6Yl3RgGPHPOZWsi8U1lxd3BBzJddG5T1PK:+pxIo5y+A8H2AMKPhGZTi8U1i5T11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773955165, "uuid": "635a9e4d-e613-498d-ab90-5ac98987a015", "value": 4784128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773955165, "uuid": "8edc6698-c71f-4da1-9947-6fc4cd61c9a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773955165, "uuid": "f8fd1db9-f08a-49fb-b7f3-a73ff4c50ceb", "value": "linux_mipsel_hardfloat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d0185a-23ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773950326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773950326, "uuid": "9cfef01c-98ee-4626-a0b3-23fdc85efe8f", "comment": "Malware payload", "value": "d60d1507c90d90639852751428f67d66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773950326, "uuid": "f08fc8b6-432f-4d98-b073-c336df570c2f", "comment": "Malware payload", "value": "eae49879191568dbce8515c27f4915c26bbb56a3266617a2dcf01932ef37ab97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773950326, "uuid": "f0aa4870-711f-4193-988d-56a84d082fcd", "comment": "Malware payload", "value": "b6c2bc71f5a09e1922d3c4d50b0a1e212553cc58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773950326, "uuid": "ee588e0d-396b-4ebe-bc30-e8d097e99708", "comment": "Malware payload", "value": "c5a5f7734c33102a4264728e9bc3b428c86d95b12c962d88a7dc5a3444d99b890042db3ff79b34ecd98b7a8c5516278a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773950326, "uuid": "977ad0f6-3627-4169-85b2-805fa4a299b5", "value": "T16E0833444D41C88BF86ED13647F98D52D63B7C9D29928E8B17E005793EAB3C8893FE61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773950326, "uuid": "ab7b31e3-fd88-4a93-90e0-db049630f2c6", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773950326, "uuid": "36715c04-75c8-4fdf-87ce-126f9fb8b37b", "value": "1572864:Indy5Hru+vWlM9ojCrD4WWJvKSc/JUNny16MadunnM9lzrCgYBodH0qCY:55LpelKbDSc/iFZsM9l/YqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773950326, "uuid": "34310b7d-d095-4ae4-b1ba-cde7b89b1567", "value": 80105573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773950326, "uuid": "c0488702-5a14-49dc-875a-8905130c5975", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773950326, "uuid": "4c14d6fc-a7fc-4dce-9520-80fc83895a8d", "value": "AttackerRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4919afab-2391-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773924232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924232, "uuid": "98ef6452-4b3b-4415-8545-7426c8a053f6", "comment": "Malware payload (RemcosRAT)", "value": "5eb74b2c74f46bb8a003e1b6cf7793c8", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924232, "uuid": "207aec54-28b8-428c-801c-0a61e1a2d41e", "comment": "Malware payload (RemcosRAT)", "value": "ec3b60bfe8a96c80b90c59875e036db214896d67a525ad78099e3113976a05e0", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924232, "uuid": "53e3c573-8386-4594-9716-e0f2c568a558", "comment": "Malware payload (RemcosRAT)", "value": "cf343703a90738f7afc0ef73a7ab39affcbfaa0f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773924232, "uuid": "6a90fa60-f2a6-4277-a4eb-a1d33166b9b6", "comment": "Malware payload (RemcosRAT)", "value": "dcd6eeef656ec38f3d8ac454b82b29ac9d5898d6ac70c5d7608074d321b5efc0c7a1f160c6b7d42eeb0e3e3c5ba06cc5", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924232, "uuid": "e41eb297-cf8a-4f67-8836-5af16116239d", "value": "T1A584015172A4D62EE04980B499C9E3E7131CFE31FBA565033C6C77AD9AB4F80F4A3652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924232, "uuid": "3c10daf9-4fae-406f-b30e-57bd412e5b31", "value": "6144:shhtI3fXMhFjvcc9vtI3fXMhFjvcc9HRGk32yxgVeIJWShXzkrHJUDLxXAbg173V:shhtUXe1tUXexRG8jWTJJLVMS3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773924232, "uuid": "2a133482-0523-4609-86b2-4a973bfbf1f1", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773924232, "uuid": "e921f8b6-01f4-41ff-9e37-5043ad4db762", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773924232, "uuid": "5dd0c9fe-bc7d-475c-8f04-c2b958aa9289", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.8914.27192", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c0b0e8-2359-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773900195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773900195, "uuid": "4eee609c-eb8c-44e6-8eac-27a03b1c2bbf", "comment": "Malware payload (PhantomStealer)", "value": "06c0a48bf06852cd3f73cc700c11a604", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773900195, "uuid": "9d97c35f-bd1f-402b-bcfe-be14c76e95fe", "comment": "Malware payload (PhantomStealer)", "value": "efcc455c178e18e96638ee642b2d395b7ff2931d702dc68253f8ab75b70e1721", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773900195, "uuid": "7b7b5e2c-ccf6-489f-ac73-6912568f06f9", "comment": "Malware payload (PhantomStealer)", "value": "60b1a8e0d146609e1f83ac50875513f547d8beb1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773900195, "uuid": "04b7a65d-539a-4917-aec2-5b8cc0a965d6", "comment": "Malware payload (PhantomStealer)", "value": "8612e71ea6e12f71f986392db701ce3e1ff45f4cc957de8a0d4e10332cadd748656bdf1d5ad0e20a20ed7c861ef278a5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773900195, "uuid": "a2229489-3ebc-41a0-8a36-c7864e0acab0", "value": "T1B085949703E4D0B84964544BFC5EA1E4DF0D49862B239CE8AD8CB7C5C02DBBD8735AB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773900195, "uuid": "3813a3da-26d0-4e1a-8dc2-5752e5fbadfd", "value": "384:yiTEhBrin1paAn1kYmprluBVr7KQtwall4Phx4+5ePpxKS0FTUxfX9F0jv5FUmos:j8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773900195, "uuid": "b9109b45-d467-49de-8b87-5b84670edfd3", "value": 1861417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773900195, "uuid": "8af8744a-6e62-44a6-8ff4-366457fc9dff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773900195, "uuid": "4a487c63-dcbb-4168-8c20-366bb197c276", "value": "Sabadell_AvisodePago_0003192026-pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "995bd72e-2387-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773920072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773920072, "uuid": "d8511c03-277f-4d5b-81ec-4bb52da7ea9a", "comment": "Malware payload", "value": "1cfdc785402f160d5c4b6b6349a8f378", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Renxing-Information-Technology-Co-Ltd", "colour": "#79D30A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773920072, "uuid": "0d000e1f-4587-4abd-90aa-88b49568655b", "comment": "Malware payload", "value": "f042b510f67620272140417df73d16136b2b0b15fb28145cd1f058ea40c282fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Renxing-Information-Technology-Co-Ltd", "colour": "#79D30A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773920072, "uuid": "e613f803-fbdf-4b3d-9d86-d7f7fd76b158", "comment": "Malware payload", "value": "e5ff45f599ec0fdd5d1a4069fb9ec75ea16fe9c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Renxing-Information-Technology-Co-Ltd", "colour": "#79D30A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773920072, "uuid": "c63f1089-b180-4255-823d-162e5c266297", "comment": "Malware payload", "value": "53145962bb679d46729f9c1ce7dbde0c56cd007bce3176f9f2e0ea52c206fa08c39c4e75e7d5fe3b9c14a7b1bca438c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Renxing-Information-Technology-Co-Ltd", "colour": "#79D30A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773920072, "uuid": "1a7fbc10-2ffe-4886-bfd3-2e3f89444809", "value": "T12F641825135C7E06E59EAA33D4F5224D63B5B0B5E8C3CB471444AB680FD1391AE32BAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773920072, "uuid": "dbb6e15f-f51d-47c1-aaa9-9cbf2882535f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773920072, "uuid": "64c8146b-7a76-440d-9ce9-64f3e0c24f3b", "value": "6144:3H+hR5STrHzELDoeiGVGujebRH8Ug9jMF6WZwNDRI6E1AQ/s0ekVIX9kc9rOP6V9:CR4JriBhqhFVIzy6V9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773920072, "uuid": "5f5f7f0a-387a-4cb7-8808-3b825c1ae149", "value": 335616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773920072, "uuid": "192f1a1b-40bb-4d2f-bd69-9e71b6e87342", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773920072, "uuid": "43149c61-77ac-453c-b303-45b997a04200", "value": "images.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e774c2bc-235b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773901305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773901305, "uuid": "d59379d9-8e5e-4912-b38c-24ddac059763", "comment": "Malware payload", "value": "c31c27430f5a3c13f975d8421a9579ea", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773901305, "uuid": "960670a3-1f41-4242-896d-071ef3730d4d", "comment": "Malware payload", "value": "f1a61ba0d48427b0f386a1710a8ec59d836539f92da5747213234d78b6595e50", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773901305, "uuid": "3c9587a7-fc91-4820-867d-07338d694fb5", "comment": "Malware payload", "value": "f29bc4774ccf387067820ce47db2921d57a4c84f", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773901305, "uuid": "133a75ab-db52-482f-9761-1bf089f66471", "comment": "Malware payload", "value": "f3f62e974587ec7285c8495d6ecfac0710667e40d3ac3e47b04658e190e027f81a43cf4dfb3aa9a822813fe9c8d11d07", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773901305, "uuid": "e05f1f8a-ae2f-42d1-b6aa-318072985c46", "value": "T1F58383456E021F0E0585DF2FDC7E00D73CB8B621761E0FA2ABD2E965188C15F9676E8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773901305, "uuid": "54d5d5fe-7521-4526-9263-847a24df1297", "value": "768:r1lqhSNG71Mvv/O0AV1hO86HrllFH/5fTu:rDzNGKve0c136HLFd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773901305, "uuid": "35213b8b-754d-4678-9de5-f01560624518", "value": 81075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773901305, "uuid": "f2812347-fca5-4b61-91c0-6f4e87f6ffe3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773901305, "uuid": "ca210020-5ba4-4045-8e1d-fded51673492", "value": "yani.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a020c71c-23b3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773938981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773938981, "uuid": "bbe385dc-749b-4fc8-b5a6-55cd783e8e0a", "comment": "Malware payload", "value": "3daab85e693f6545ed547b14ef0993a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773938981, "uuid": "95f8f470-b239-4ce8-a5aa-5fa4a3daedb9", "comment": "Malware payload", "value": "f1a9ab1bd8b2d3738c6abfcb2b84820efa405f09915884da57aa421fc42dafdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773938981, "uuid": "164d04f4-eeda-41bf-9228-835c751e3aea", "comment": "Malware payload", "value": "c2cd27f149f8d17891a9901c52da9735be188906", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773938981, "uuid": "caf6a2e5-137c-4cb7-b3e4-34cdec4910b6", "comment": "Malware payload", "value": "d4fcd21fa35e6ac0408fd3414bfe788e57e5024b5c5efa00978411cb0254386ccd78cf4bba94429287672fc037d3747b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773938981, "uuid": "6521a532-e6ca-4a0d-a602-66929a1b757b", "value": "T15F187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773938981, "uuid": "ea4fec0d-157d-48ca-9f5d-01921bb32290", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773938981, "uuid": "ddb013f3-fe9f-4a31-a536-2b8a0040260d", "value": "786432:bAZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW:bAZui3zQz2jOZKft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773938981, "uuid": "e98045c5-109d-48bd-a229-b96ea3c38494", "value": 90254336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773938981, "uuid": "665e018d-a961-4780-936b-dcce7b7c337b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773938981, "uuid": "7c009f17-1e6b-4ebc-a77a-1cd0beda547b", "value": "KIDDIONS MENU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b23c0fb-23b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773940691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940691, "uuid": "6d991fc1-2c80-4910-a288-6cef8d5df5ae", "comment": "Malware payload", "value": "4af4dad466b7455435c30140f7ab4583", "object_relation": "md5", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940691, "uuid": "98743537-adf7-4cb5-a9b9-d6505512b18f", "comment": "Malware payload", "value": "f25743da00820fa4f4870ce100d28caf7c1e12ded844c4118dbfc77c2aff7319", "object_relation": "sha256", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940691, "uuid": "6f9b7b9c-69cf-4083-aa08-dde22a7063f3", "comment": "Malware payload", "value": "7ceeb0b3e891c255c7be9f83fb3b35410ebad977", "object_relation": "sha1", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773940691, "uuid": "a9ebd2a3-06ff-4972-a7f2-8bab365f55db", "comment": "Malware payload", "value": "2228ae72c50813296b67fab07e6f3cba34a31387f59f50451c3b5765668c624d36d4958ffb921e37f4000bf0bc4d8ca9", "object_relation": "sha3-384", "Tag": [ { "name": "Eos-Mist-LTD", "colour": "#C74D51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940691, "uuid": "a406d8a6-77ef-44f7-aab9-b43bdd7b6ca1", "value": "T1FEB5E03FB28B653EE06E5A3A7AB2E210583B766165134C5696F4C84CCF250B02D3F797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940691, "uuid": "59372445-b0ce-463f-8ade-701dcd1c7d05", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940691, "uuid": "da6ffd16-37bd-4319-b354-3669bc108e41", "value": "49152:+uI5hHKMJ0G7fye6CBcsZNoNUYqFZpXD5Q:+5/HxJ0/esseqtX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773940691, "uuid": "a16bd67d-6c43-426b-8799-2df1b875ca56", "value": 2396984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773940691, "uuid": "9e9a3d33-50dc-4827-9276-03b5f39be1cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773940691, "uuid": "93fe5db2-2b36-4307-bd6f-3b027752c6ca", "value": "f25743da00820fa4f4870ce100d28caf7c1e12ded844c4118dbfc77c2aff7319", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ac71a1-2353-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1773897792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897792, "uuid": "c5b62c10-1298-4d5a-95f6-ac7a5cceb10d", "comment": "Malware payload (njrat)", "value": "2ea90ec8bfd24b2d47e2e044aed5213c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897792, "uuid": "9af19a67-381e-47b4-b37c-5f493e9e54e4", "comment": "Malware payload (njrat)", "value": "f4055ea661a1c992c1ca50e9d623c71925dd95603c6d445080682d545a9f249b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897792, "uuid": "69e1d98a-0688-4bfb-90db-880df099defb", "comment": "Malware payload (njrat)", "value": "49c5dfb700d3a967642a2f2a8b42f8f2113c06a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897792, "uuid": "3971ef26-9005-4f8c-8e0b-8e6872a10822", "comment": "Malware payload (njrat)", "value": "a2d818d1d707edc5411bef4d6c36423cb8dcbcc1c75bd5c49208830e103e38cb8744f6cf9e95e2903e45b6ad82196709", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897792, "uuid": "53517d42-2525-44e8-a421-178736a121da", "value": "T1CBC34B9EF7419958C61E0EB38863445C42F9C9F76537F76B2AC81EE29D2688C8D8F1D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897792, "uuid": "264a8f6b-7571-4492-91ea-4cddae34087d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897792, "uuid": "cafd74cb-f336-4d78-a2e5-43b8b5cadf4e", "value": "3072:Vm3CLZXcpktDGHyVuo+2yBFGI7wUdbfWx:VmSL53luvBFvMUdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773897792, "uuid": "d22d3f27-9529-47f5-82a4-9a87b0fbb876", "value": 118272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773897792, "uuid": "f3a2d708-bc16-4e3c-88b2-5838b971b27a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897792, "uuid": "b8ad6576-b4d5-4f1f-9f2e-5863e3edc27d", "value": "HazeSMP2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ca66ad-23b4-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1773939341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773939341, "uuid": "8c6d4e24-f422-44e2-b9c2-e23fae456ab9", "comment": "Malware payload (SalatStealer)", "value": "37c654db6616e241e1f1d1b6c58a0186", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773939341, "uuid": "9581da78-48c8-49c5-9ad6-db9edaa7e9e2", "comment": "Malware payload (SalatStealer)", "value": "f435070744c41dd8cd85d41b6415d9ad4dd28552e8fcba9092a0fce04d0a31fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773939341, "uuid": "8dbedddd-0402-4b88-a2d1-24f988481af5", "comment": "Malware payload (SalatStealer)", "value": "fab48e5c5be3ba10ae63097ec7aaf506ca260f0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773939341, "uuid": "2f9f3dd0-e1a0-43e9-b97c-378aab8e5e05", "comment": "Malware payload (SalatStealer)", "value": "4c983a6a1c07b16fe6c0ff233c30ba756174c398142679657342a685122ec68f25679f339853ab51449e93529c322b81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773939341, "uuid": "4a8f2cf8-a4ee-47b1-98b9-a6d5032a9e31", "value": "T19EC65B11FADB95F5E9035831006BB27F23315D048B28CB9BEB547B2AF87B6A11C7A345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773939341, "uuid": "b82f2d78-52ea-4e17-80a3-d744d9ee8a12", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773939341, "uuid": "c4312e35-d98d-49f5-93cf-f8729ea45571", "value": "98304:hWu5DliUqr9vh4C0W5D4r4A8hwElEIE2:nDsvjPWF8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773939341, "uuid": "8ae1cb5c-ceaa-4120-b54a-731369659925", "value": 12577792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773939341, "uuid": "4858cbc9-e729-4e70-81c9-b2681df679e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773939341, "uuid": "45a9d7df-3514-433f-a4fa-201309e79074", "value": "installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb6bcf36-2353-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773897822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897822, "uuid": "ff9f440a-260a-402c-a3d0-06ca94904c72", "comment": "Malware payload (AsyncRAT)", "value": "10b6d98468d227a02991eb5b2966cb9a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897822, "uuid": "4da5810d-ccb1-43b9-9ba3-c279e5a2bfad", "comment": "Malware payload (AsyncRAT)", "value": "f4a60426e768c4723e92933e7dee55f9272bae511d581e7c388e95ea8754b594", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897822, "uuid": "ebc35052-5bf6-41b4-aa32-f7436423e663", "comment": "Malware payload (AsyncRAT)", "value": "83db68010e6348ce2663d3e5f2b589d13ada367b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773897822, "uuid": "0aca415e-2911-43d4-849f-c787dabd0a04", "comment": "Malware payload (AsyncRAT)", "value": "9062da8973306e8a2befcc8202740cde7765dfbdea7d23836a324df7ae20f8d880784523db4e8adb10b4e4ac026f4fce", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897822, "uuid": "c9d8b175-48e1-445f-a423-f86bbecdc55b", "value": "T1EEF2290473E84A65E1FE1BBD9D3192008375F9479E23DB9E1DC0509E1E63B888F64FA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897822, "uuid": "ba2dc297-ae67-468d-a39e-da91c3c1555f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897822, "uuid": "2b3c4c2e-d36c-426e-8c93-df9ffa04de67", "value": "768:K+eXJ7EMTQvi/hnNVJbHBwySXKmtN/p+:wJVhJbhwHHtN/p+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773897822, "uuid": "2136c889-544c-4c0a-b782-10ee820033c9", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773897822, "uuid": "7f430bc6-7af5-4304-b76c-56dbdaeed3d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773897822, "uuid": "a5f6a039-34f5-48ca-a0b1-3b16a3da15f6", "value": "RAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44cea515-23c7-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773947418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773947418, "uuid": "9dd7452a-aa31-4070-b56e-3afe30e766a0", "comment": "Malware payload (AsyncRAT)", "value": "0747cb326d49150592588a04b2c803a0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773947418, "uuid": "ac17e32f-ffa5-434f-8090-785274292690", "comment": "Malware payload (AsyncRAT)", "value": "f622737668c513f985371efab074a144515a44e2f38216d46a60fa17e190f301", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773947418, "uuid": "54cad69f-be21-4f1c-9475-5999dce6ce64", "comment": "Malware payload (AsyncRAT)", "value": "33509ddbd2f7d91287b9b1b61ec193c37fa9e42f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773947418, "uuid": "216c89f1-0bfa-430c-9948-f625dfb7b43a", "comment": "Malware payload (AsyncRAT)", "value": "c307ed07e03796b0214f3ee96ec9cb5c7573cb3bb00835bc159816392a0fb78d494100d4de0608e179cea127f1311a22", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773947418, "uuid": "bbd0238a-6b88-415d-a627-eae7ada58a9f", "value": "T1BF730255E7E90C92DAE11BFE50A2299723B2F4339527CB2B1994809E7AD7BD0FC4D201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773947418, "uuid": "ff7ea9be-3fb0-4480-a902-e32989e0bbb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773947418, "uuid": "3ae84ab0-91e7-47c1-b056-b2a25d6fa4a1", "value": "1536:cK5VllYeAUT7C5RrQ+yhxTqyvQHZxtXm4RiVLJqzq6YaJ:F5VllYe47Axu5JU3qW3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773947418, "uuid": "8b21aaf3-a9a3-461d-ab0d-93e6fb67eeaf", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773947418, "uuid": "02f2fe89-bba3-41d3-a430-8943e8814bbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773947418, "uuid": "4817890e-6981-4f4d-bfa1-43b5f74672c6", "value": "0747cb326d49150592588a04b2c803a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "669f6a59-23b4-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1773939314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773939314, "uuid": "e99ddf51-326c-4454-8712-bf5dfc42008c", "comment": "Malware payload (SalatStealer)", "value": "c19daaf9d543291fcc474480ce723b9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773939314, "uuid": "64ed9a7c-4a1a-40aa-b08a-59cb967f904a", "comment": "Malware payload (SalatStealer)", "value": "f67a9f79d2adf2ed0b74c2ba2f8b841d4b86830f648fa63b654839fb5eff2049", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773939314, "uuid": "4a2f019f-02ab-48ee-a0bb-9454816e53fc", "comment": "Malware payload (SalatStealer)", "value": "e74b0249e269a1e87170024e1dd61d0b54ec541d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773939314, "uuid": "18dd85db-73d5-4d58-b8a2-1a0dc2613044", "comment": "Malware payload (SalatStealer)", "value": "20fe38092f8daed1808ca98449f85190cc8353033c5d2b008ad4e01647427441716ef1dabdb5ace0392a3241939344e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773939314, "uuid": "e8984f90-5dc3-4d71-9887-12836ba23e04", "value": "T12BF53328A1345AB6D8BF6BF410FC5D1910A22382B1ADC94B7D1F9FF908912F61F36794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773939314, "uuid": "b66780a5-54c2-4249-b35b-6d2055547a72", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773939314, "uuid": "adc0c9ca-f63f-4e4d-8132-f1a109e8ce64", "value": "98304:p37IS/jDHTD/9gSZdENqvIPNeqEWXc2yW2w:pRHzD9gnNbxyfw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773939314, "uuid": "bc5987a0-804d-42ad-9bd7-2a3155394283", "value": 3595776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773939314, "uuid": "3655e54d-4431-490f-a5fa-6dd7bb3d0358", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773939314, "uuid": "9888f295-dd9c-411b-bdd7-3fcc06ae57e8", "value": "installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4bfa3d0-233e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773888765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773888765, "uuid": "bf6bb0f9-8bb5-40a0-a35b-e0fcd8801571", "comment": "Malware payload (Mirai)", "value": "65a0281b7f36cee9c52c04f539ceda42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773888765, "uuid": "d55ff202-2f80-4e72-8871-cb46e4845eae", "comment": "Malware payload (Mirai)", "value": "f7427d1ceea9ba34056691a20a10716dc14fbaf38759146e15cc18f7a3ead600", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773888765, "uuid": "31642c91-0b0c-4d43-8297-b013caf53b72", "comment": "Malware payload (Mirai)", "value": "cbc4b0a8df2602c60475a537bafcac7e456b15b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773888765, "uuid": "8f6877af-443a-49c4-bbbc-1acc1b7e5c32", "comment": "Malware payload (Mirai)", "value": "dbac88d709b67dc0f0705a2a8efe26eac86d4a6bdbc66d2279a328a59effba137102acbd73195cb49ed0739ed3349327", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773888765, "uuid": "e64161e2-dd23-4a2e-a19b-d97f4362a25e", "value": "T19893BE32E868AD98C1808534B5F4CF7A9733E86061972EB7459AC6795483EECF1493F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773888765, "uuid": "f5b69f35-bb72-41bf-87f7-6fe5619d5da4", "value": "1536:YAQj22kenE1LxXL+lka6RVHOfq8o3MWKP/4Ojv8fCtf9YXiC3Z:YM2gck/GfqrMpPhv8fgySM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773888765, "uuid": "a38fb2d4-c5cb-449e-ab0e-a8ce1181b41b", "value": 92680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773888765, "uuid": "e0dcfb28-bcfd-4445-8dc6-838cb686da8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773888765, "uuid": "ec47471f-9798-4037-8dc8-4ca485410f45", "value": "tux.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f34a9eb4-2395-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773926236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926236, "uuid": "2583c1ef-c8ce-427a-b908-aa14f3fc1012", "comment": "Malware payload (RemcosRAT)", "value": "ea75aea94e876a5632ab1514ae1fdb52", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926236, "uuid": "b956097a-9b92-41f7-b0ca-bcf95d9e1245", "comment": "Malware payload (RemcosRAT)", "value": "f79270a415e26725c61169ef103dd803a1d8338809bcf0df406efebbae7b93c7", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926236, "uuid": "6c7f99ee-e291-4505-9555-b95b7f77ac97", "comment": "Malware payload (RemcosRAT)", "value": "3604d2b6e9f7e5488b416d2f5e5cb278951834cc", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773926236, "uuid": "ac5b987e-eba1-4f2b-af80-4f7f9297130f", "comment": "Malware payload (RemcosRAT)", "value": "ce34fb576674cbb1df34c1f5ae09edb181965827a1ce788814100b545adbe9698d22ffacec03be18b7227e7d406a40ea", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926236, "uuid": "4531e133-44ee-4bef-8656-252f19137812", "value": "T111652307B2169A9FE26915344592F01382609EA1FDE6DE0FB285B36DBC37BB0437354E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926236, "uuid": "7f8b7b61-2635-4992-b097-7b48a27c9ca5", "value": "24576:TnExti4Pfre/o5lUExti4Pf8Lg7/ot1bT1lT4ZI744:iA4be/oDA4h/o7bT1l37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773926236, "uuid": "f998b294-5a0b-49d4-9041-aa0c3bda8aa2", "value": 1461248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773926236, "uuid": "966d0505-129f-4347-9899-88634d8cbbc7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773926236, "uuid": "58d82ca3-e13a-44e8-b795-8005e3a05872", "value": "ea75aea94e876a5632ab1514ae1fdb52.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "348316f3-2373-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773911313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911313, "uuid": "dfe36fae-9ae0-498c-8af1-3519d2855279", "comment": "Malware payload", "value": "d85feff07140d94219c12e7abeb98b40", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911313, "uuid": "8f6bfc96-23c6-47a9-8f05-b05837a59e26", "comment": "Malware payload", "value": "f937d2d81b0c5a205a1457e200b29229224ea5181f83b556def1b40716d26f17", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911313, "uuid": "d5a6c16b-cb68-4ac3-8d3e-7cc13563eb0f", "comment": "Malware payload", "value": "02c80f36f18286b02c09f98ab5475b0f4bfe4d8b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773911313, "uuid": "ed31775f-b904-42c4-afe7-9d3cfce8bcd7", "comment": "Malware payload", "value": "8423676e9e65c5ad034b6e4bc622d31ebc6a081fb740bab587b7c7acdc8de583e17ecf122e804fcf718eecfb30a36180", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773911313, "uuid": "67a4e7c0-0401-47c0-a2a6-930bd22c24a7", "value": "T141925CB906496C79FBC0CE799F3C7F0CAEE582C42128E39DBA1F39705A2065DC609359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773911313, "uuid": "ac0ac717-f931-40fe-9edb-edfb3cd47d99", "value": "384:gsUncuxOLnVYMS/zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:g6uQL+/zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773911313, "uuid": "86f80c4b-ed76-4550-80af-ac0a18e70e93", "value": 19491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773911313, "uuid": "44466b58-2a85-4394-b399-ca09fb0a1669", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773911313, "uuid": "6372c9c1-ebec-4bd6-ae9c-9612ee77161f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "751d4dab-23cc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773949647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773949647, "uuid": "4d1071a8-7959-4075-a8ac-378f318ab3cd", "comment": "Malware payload", "value": "a6dcb08599b33d8f8d823148b8763c20", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773949647, "uuid": "dbf6f091-4098-4897-9335-8d090a35371b", "comment": "Malware payload", "value": "fa72b18f53eeca7273818be2bf00b8bc14de8b33ff417e40ec97feabbaa33de0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773949647, "uuid": "00fb2400-16d7-442b-9ade-f94a4678d507", "comment": "Malware payload", "value": "9573a16a6a22a1565616bf8aa5f4036e24e024e8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773949647, "uuid": "bec68a23-2422-4eda-b4fe-afe9070b7271", "comment": "Malware payload", "value": "cb8ccfa06d000379811619b72509c053d0ea2a2abb936697e083eeee4e955a7ee80c62f3099c17d2bf581be00a6e4050", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773949647, "uuid": "11b3f9c2-3f1c-476f-ad79-bbaa0dbb23df", "value": "T167B31947F3A254BDC926D23087AF5233BB72F4191135BB1F1754CB252E22A60AE2DF58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773949647, "uuid": "ec66434e-1b79-40c0-b98c-5376ce9cb639", "value": "e89bb95da66a716bca82ae2a53c61388", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773949647, "uuid": "3e8f8e67-87a9-453c-903e-3984ed331456", "value": "1536:S1Qa95kDNkkkB0vcz37G62FjuH8LNGtCzP2QzSg4EyaCaaXh3r9:MfYDFxczrGG8s2A+WJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773949647, "uuid": "cafa6719-f996-4646-9560-5292686a29ea", "value": 112128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773949647, "uuid": "e9b9ce63-922a-43c6-b2c8-73a6abe9cfe4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773949647, "uuid": "d79dd983-3dac-4744-b402-82517d1a2e46", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ec034a-2398-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773927198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927198, "uuid": "b1a83ee8-90d6-43dc-8a0f-38a1fd504d66", "comment": "Malware payload", "value": "4158559f4b2940754a381ba38523bd60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Speagle", "colour": "#A458F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927198, "uuid": "07ecba5d-567b-453e-a523-2ab0a84b808d", "comment": "Malware payload", "value": "fad8d0307db5328c8b9f283a2cc6f7e4f4333001623fef5bd5c32a1c094bf890", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Speagle", "colour": "#A458F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927198, "uuid": "6dbb85f3-f65f-4320-8757-e2c6924a3f2c", "comment": "Malware payload", "value": "cf85e4b3ace7641adb350079b9e974f5f14d0c4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Speagle", "colour": "#A458F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773927198, "uuid": "b4aebc15-90f0-4830-9949-48307e5bd4fc", "comment": "Malware payload", "value": "b431296969c5747270be622d9f29806a7c48d3434c0284c792018f94a2e74823c4a725e5b20c1341f1dd048ffa07f293", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Speagle", "colour": "#A458F0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927198, "uuid": "62a4fe4c-bd8c-45e8-bf26-ec950d90cb79", "value": "T1CCF417163AC9E823E1ABCF70D5D1399D9BA8D012A746BFC7116181E24E43391FD8A47F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927198, "uuid": "9f896afd-c797-49ed-a4f7-8641037fd38a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927198, "uuid": "19ec11b2-7476-4849-bb23-30c6a4afe10c", "value": "12288:XxTFn4THI2Dl6gskdrr2vR9P8JpBSt+mfJ8DfAmFT5NAd8FjnFrgR:hirI2DBqvR9PYpwja8mFFecFrgR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773927198, "uuid": "ee72e5ed-c09c-4444-af05-646fb8ae42e1", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773927198, "uuid": "aa8033a7-7fd5-43b8-866a-ceb48304c463", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773927198, "uuid": "70b4fff2-1f46-4bdc-bd71-ce424d02d707", "value": "U.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f19d267-23a9-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773934631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934631, "uuid": "1f61ec77-f4c8-4e3f-86bd-8f0d8286ac86", "comment": "Malware payload (XWorm)", "value": "f2861264513f972d066b9b16d875861f", "object_relation": "md5", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934631, "uuid": "4bd83767-e7ad-4161-ab30-da131a0b1dd1", "comment": "Malware payload (XWorm)", "value": "fbd84c13f92b04ac2fca4748fdfb04468d6fb22f361a0fd1a7551ce9762597ef", "object_relation": "sha256", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934631, "uuid": "eaf98312-c71d-4cf1-be50-81c3f585322f", "comment": "Malware payload (XWorm)", "value": "16c959b5a639eeb3494aca27a5864c2bd0cc1106", "object_relation": "sha1", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773934631, "uuid": "aa730ad7-aaf3-44d4-91b4-3c698462dba6", "comment": "Malware payload (XWorm)", "value": "bc9ce5ad489e2cfc9f4473f045f1bcf41112e6cf7bda98f17682abc682a30580c9671da5e674518c17ff42c23d03398c", "object_relation": "sha3-384", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934631, "uuid": "697029bc-136c-47d0-a93f-ed6e165abda3", "value": "T1B0630125239E58F930F1D824B99A9B1CEA3850376C557C59B3E1E3B06FD314631B0E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934631, "uuid": "f6eafc97-122b-46cf-9080-c9602764402e", "value": "1536:iWK5Mqlue2FVIanQwEI9Wuxn+sliaZLu0eFT4Tj49Yuy:5DqQe2FVjQwL9lTliasdAoYuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773934631, "uuid": "c4fbf013-dd87-4f1c-b763-16b83dd60759", "value": 68131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773934631, "uuid": "217a5a94-8bc0-4dde-872e-8d8865cde64f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773934631, "uuid": "b6803a15-fec2-4dc1-b541-28af309ae515", "value": "fbd84c13f92b04ac2fca4748fdfb04468d6fb22f361a0fd1a7551ce9762597ef.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57dfc0df-23c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773946162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773946162, "uuid": "e1b4cb9c-2176-4b28-bc2e-10a722919adf", "comment": "Malware payload", "value": "02f0c8020fe79b7c5026ca7058bc6d2b", "object_relation": "md5", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773946162, "uuid": "076cb15d-26dc-4afa-82c8-1ef0612125bc", "comment": "Malware payload", "value": "fbf4fe062779de9044679f800b98930b9c3642f242a00458951ccabd4cf3e347", "object_relation": "sha256", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773946162, "uuid": "948136c9-6aae-44c5-906d-4fa7509f960f", "comment": "Malware payload", "value": "a612be3a28bde1baaefbc584e86437580118ca22", "object_relation": "sha1", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773946162, "uuid": "3c2dbb9b-27ac-44e1-8646-10303fadd76c", "comment": "Malware payload", "value": "a96cc77c652a2b42b44208f2fe551f5336c3f8cbbe28457f25a1460b5e2c6395fb6a35743e6f09f35ce835c99510c6a9", "object_relation": "sha3-384", "Tag": [ { "name": "69-61-36-229", "colour": "#FFD48A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773946162, "uuid": "bea01ad9-e41e-4bcb-a3a9-a0417687239a", "value": "T16D51EB0A97E40A6BF4B707316EE3035227B5FC61AF73636E59800229AC71B545E72BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773946162, "uuid": "b24f3dc9-54b8-417d-b33b-3bbac8d1db6d", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773946162, "uuid": "81626038-893d-40a6-acd1-caa7c689e897", "value": "24:etGSrmfB2JuwALu8zigklnlKeoUae2tkZfllh50LEWI+ycuZhNseakSP/PNnq:6hMwARziLltNaOJl75Gn1ulsea3Pdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773946162, "uuid": "8b454e5e-89fb-463a-9d86-8e3cfbcc6a13", "value": 3072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773946162, "uuid": "de29a3df-dbf8-460b-b0da-d0627eda8866", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773946162, "uuid": "66a68690-61fc-4a78-94e2-a0975dfa550a", "value": "bsaocvyh.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879cf34c-2393-11f1-a769-42010a9c0008", "comment": "Malware payload (CaminhoLoader)", "timestamp": 1773925196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925196, "uuid": "f10624c5-b848-4ecb-8ef2-f2eeb1c9f42a", "comment": "Malware payload (CaminhoLoader)", "value": "9b65f53c351db79acf289b3ee91ade61", "object_relation": "md5", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925196, "uuid": "7a5f8e74-366d-4053-b09a-cc5a9104c396", "comment": "Malware payload (CaminhoLoader)", "value": "fe633502f2c2a5167d699c580cb11503e3668e9767a4b0f7fa9ce42da9b71160", "object_relation": "sha256", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925196, "uuid": "f108481b-a2d4-443f-b317-2dc376e8879e", "comment": "Malware payload (CaminhoLoader)", "value": "6297bae7a955e3c63ebf51e019eb3a9433778c2d", "object_relation": "sha1", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925196, "uuid": "a6063ba1-0014-460c-a0cf-460793045470", "comment": "Malware payload (CaminhoLoader)", "value": "c04009a1e4a2cfd9fd2b69eb0dbc006d7d70d47c4f915ce35abf9b117789bd47dcb213569735d4d39ebb19ea25d7cceb", "object_relation": "sha3-384", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925196, "uuid": "b477d6a0-8ed4-4c1b-8fd8-9fce8cfa5c2f", "value": "T11BA50251FF595CE140E1AA83467F9221CC5C84B9B03E4D9DF98A4CE9874350E0BAEFB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925196, "uuid": "45d61b33-2fb8-4b4f-970f-6a6b2d94fd53", "value": "768:7OM0ywzj21UkqoQG1stKMci244zIdRzHJ1AhuoBK9JzL1IEdeUA47JjZCgxZ6/hh:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773925196, "uuid": "316ce583-0bea-47d2-b2e5-78a7b4ece4c5", "value": 2192770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773925196, "uuid": "a30ea39a-fc6f-4a94-91ee-ba70a99c2996", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925196, "uuid": "a27a399f-3e1d-4769-b40f-7b1a567c91ea", "value": "update_system32_windows-zdlwcma20a03qc4h.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "523a1eac-2390-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1773923818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773923818, "uuid": "b92d17ac-cfb2-4d76-9ed6-516d27394b05", "comment": "Malware payload (DonutLoader)", "value": "6d927db00cac59ff67032f17893c74c2", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773923818, "uuid": "af8b7dd9-8dbe-4b48-abd8-64e688fd944f", "comment": "Malware payload (DonutLoader)", "value": "ff07fa9c294fc87e44da9a67322c90be10b6bc76ab9fb837057fb3842b536e4c", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773923818, "uuid": "0f71e8ac-9686-4552-a942-97d6122466f8", "comment": "Malware payload (DonutLoader)", "value": "4c97f84538de1504b4f6344acdb19a62c10be51c", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773923818, "uuid": "2d1c1239-18f8-4c83-aaa8-53c27f2f3608", "comment": "Malware payload (DonutLoader)", "value": "2bb8b3bfac9771942709f8fcaa801e9267c95af950345dcfe179c3862e06537e8fee68ee9d48b46f3169596c5b074a23", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773923818, "uuid": "6fcc10dc-8080-4073-80da-ffaedaf3bc4a", "value": "T18C9533AA829D3A1896B1643ED0F9D2833B13346C57E70F0DD62FAB16C2464357BB4C9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773923818, "uuid": "b941a626-8062-4916-a59e-ec9632cecd19", "value": "49152:xbP7yhxWygXe6IhyRDv6W8f9j95amvIZYXcGBdm3fDcvPEs:xC6yQwgyWsl95dAqXcGTm3fDHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773923818, "uuid": "1412d860-977a-4e25-a3f5-a548ee5683cc", "value": 1931864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773923818, "uuid": "89b0b32d-68bd-4b7e-9b78-9ad72d07fa4e", "value": "application/x-xz", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773923818, "uuid": "bbf96db7-bd43-436d-970e-83f5bced98ae", "value": "Quotation 1563050.JS.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c98b13-2348-11f1-a769-42010a9c0008", "comment": "Malware payload (PySilonRAT)", "timestamp": 1773892929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892929, "uuid": "89ad1f4f-a339-4898-be78-2a0fdb98fefc", "comment": "Malware payload (PySilonRAT)", "value": "a9634ab5f14ba53c8c5b76295556183c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PySilonRAT", "colour": "#2D495A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892929, "uuid": "90ca0d72-c36e-404b-9fa5-b131a3b1cba6", "comment": "Malware payload (PySilonRAT)", "value": "ff1f467ce880b6da604b6c01cd93f38480497c88f74cef88f319dde4cb3fd3d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PySilonRAT", "colour": "#2D495A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892929, "uuid": "bdf236ae-572a-435e-ba2a-853a8b270a60", "comment": "Malware payload (PySilonRAT)", "value": "0bbfde5b0531af37f8444b9de4a1f6fc24605ae3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PySilonRAT", "colour": "#2D495A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773892929, "uuid": "e512bd46-687a-4d95-a3be-d7fbbb3c0967", "comment": "Malware payload (PySilonRAT)", "value": "11e0a375d60d340240d0cfc8e2ad9fc707c286db40d401c4228798507e0b9b1a3b33c90333e3b810958ebee475ec27e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PySilonRAT", "colour": "#2D495A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892929, "uuid": "3f8fd8cb-25ed-484d-9e12-13f103ad6741", "value": "T1AE7733C67BC404D5E4AB3436A0CB841A46A6F5A107B1C5AECAFC5D768EF30F49CA5F21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892929, "uuid": "0598792a-c52f-4dd8-969b-051fba705b42", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892929, "uuid": "12545967-fdd8-4ca9-882d-4ae30b18d374", "value": "786432:foS/oSynABQIlfW80GuO5l8dPX4Rpsnn6+lk0qSC5enGB7X:foMoDOlfW7XWlmPYps651f5enGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773892929, "uuid": "911d8546-eaae-457d-bb3f-fb253fcb4c75", "value": 34283915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773892929, "uuid": "de468c24-e42f-43e8-865a-0bb7e0caaca3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773892929, "uuid": "d0c7a72a-52a5-4946-97c0-e36c1a5adf2e", "value": "source_prepared.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f05d13-2394-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773925428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925428, "uuid": "c8db1d25-1a9a-4023-8a60-b286bcc943ad", "comment": "Malware payload (Vidar)", "value": "e03a91e26c3bdd3704b1095a255578a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925428, "uuid": "f2aa9988-d96b-4bca-b19d-68f65a9bbcf8", "comment": "Malware payload (Vidar)", "value": "ff80d67d04f59ad100ed1be935d2b77578eb4dc2f455f4c91eb3e66192372fca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925428, "uuid": "65278719-6a39-4614-a24b-d4f3295870d8", "comment": "Malware payload (Vidar)", "value": "47d0e469b9e5d7637570dff5e942f2327084f4ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773925428, "uuid": "7a474c04-ec56-4cf3-824b-2b401d8e4513", "comment": "Malware payload (Vidar)", "value": "de7c77643dca3b939ae194ed1a557aa193c7a5684400baae798af20307ebad7734dbda9a8eca23fc0de0ec6fd0fe3497", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925428, "uuid": "be7bfc2d-f2ce-4880-8099-72aae9a6691e", "value": "T151959C07BCC125B9D5AAD23289B112A17B30F8490B3137D72FA6A7B93E763E44E35354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925428, "uuid": "e60fb1b8-7fe6-4f4a-b21e-31a31e58be32", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925428, "uuid": "55abfae7-dafe-4dd1-81dc-8716cd012c1f", "value": "49152:u6i/bw9/Iz6oCdJaknmVjQg5DcBGVFgvAYgdqVK1:/E6oCdJaIgSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773925428, "uuid": "c8ab0ffd-ca57-4f59-b231-702025b94901", "value": 1935872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773925428, "uuid": "a10cf017-cade-4fc4-a92d-e5ee24e2a255", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773925428, "uuid": "bb1becc3-ff33-4dcd-803c-4027e6434be4", "value": "xff80d67d04f59ad100ed1be935d2b77578eb4dc2f455f4c91eb3e66192372fca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }