{ "Event": { "published": true, "date": "2026-04-15", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-04-15", "timestamp": 1776297782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "fa1e7519-1c1a-4124-8b32-77ce4d9824f4", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d4c26a2-38fa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776278445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278445, "uuid": "eb097961-e846-47f4-ab79-1c747c8e083c", "comment": "Malware payload (Mirai)", "value": "936f8b58ae4593e209b454eb07a2e206", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278445, "uuid": "0f3530ec-08f3-4d26-9dfa-e4064167fb14", "comment": "Malware payload (Mirai)", "value": "00a7036fecd5c4b42887ce28b961573c1e0449ce233e7b3f70c3ab0801fce089", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278445, "uuid": "9aa033f4-19df-4210-bd73-95a2b83990d2", "comment": "Malware payload (Mirai)", "value": "0bdf18fd01c89f778fa29aba66d9a9f2cbc9612c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278445, "uuid": "93e6f2d5-94ae-4481-b419-2f317c060955", "comment": "Malware payload (Mirai)", "value": "ac4bb6d8b0741dce7802ba004fc166f6aeab0fc00077f02bdfb303b6956a476e7d23a9582de6558a4a8c9b2298c655ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278445, "uuid": "b9baa472-929b-4b5d-af80-e666d06a239e", "value": "T18543F116D1356EA7E3501C7694AD1146BF22DEB9B5BD213B23180A1E3F80806EF5A2CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278445, "uuid": "01a1931d-bec3-4657-9a3f-e466b6add3a5", "value": "768:+oY/HEtFo3q6QsaGOOWPNRV3w4B2qYPWqSZ9q3UELeHbBXw7I0xQAZCkrdBrBSY3:+oMn3twOQ5gGCLGNX/iZCEBryYjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776278445, "uuid": "80ac51e0-46bf-46da-81f2-bbac122a03d8", "value": 55276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776278445, "uuid": "bdb75396-15e8-422e-b10e-99fbfe5ed502", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278445, "uuid": "b79c9379-ec57-4e0d-a90d-41bc1323be8a", "value": "FGx8SNCa4txePA.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a04570-38bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776251882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251882, "uuid": "12cda0f8-e7f6-4ec3-8bcb-a7782e4e6853", "comment": "Malware payload", "value": "a7456d8e7704edba2a40b54cf232ff82", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251882, "uuid": "0a6d3d9e-a2b2-4814-b010-234f7e97a574", "comment": "Malware payload", "value": "012dab3023d95a96f2c21db763264bc26655d57e4a32243aba0d52cc99464102", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251882, "uuid": "46268c16-344f-42eb-ada0-ad523a7a39fb", "comment": "Malware payload", "value": "93c0a347cdbe1bf4b1ee2e008a6902e6949b40c8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251882, "uuid": "c33228da-589a-4bf0-87d4-641974d074ff", "comment": "Malware payload", "value": "0db2b544d56f8dd8d7d95c689b29c54aedd4f3880bebc88596b8c8ce6c6ec9dbdb23c895976360523e3f199224bace38", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251882, "uuid": "fa8fd9ec-4a3f-4a7a-9ffd-f64f6a9085f3", "value": "T1EE95F25189C43FA5CFAC161990FE220DA3E15E8B501B798AEB33FD46AFF7604521B0D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251882, "uuid": "8a9adb76-df55-4046-83bd-5fe32bc84432", "value": "24576:dhIkD554a2HSzro6zBwIZUDZQpuM6dhIkD554a2HSzro6zBwIZUDZQpuM6+r:skt6vvyDkt6vvyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776251882, "uuid": "e34bab71-ec77-4f30-8f4e-02beb447a60c", "value": 1905234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776251882, "uuid": "5c394229-10eb-44d2-9bf8-7de621749906", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251882, "uuid": "fbc20aef-c89f-4932-9c6a-d6f9b3316454", "value": "xe.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a2d6a25-3880-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776225853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225853, "uuid": "03722a23-b6e5-459d-8792-fed8a16ad03c", "comment": "Malware payload", "value": "f6c8ac5bec88f7be234ae34349c835ef", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225853, "uuid": "14704cbe-acbd-4dd8-9a25-1ca6434da0ff", "comment": "Malware payload", "value": "01460ca3097d15e400a7f6c209cacc732b3f5e570b29e3c8ab1642d5e7df1575", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225853, "uuid": "0a2649a5-7aef-470a-b363-44183fc94962", "comment": "Malware payload", "value": "98132691708a828bb52f1714193136463b3dca41", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225853, "uuid": "c2a2b128-e212-455c-9560-d3424c0f202b", "comment": "Malware payload", "value": "e7ee6bd6a831ecd0bef8605f1a622a01aefc61311e0e749594c94bde6c71a510534821f064d4fe6bfef1d07e06efc1df", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225853, "uuid": "0c4d10dd-54f5-452b-abf5-cc7ed94ed8f7", "value": "T1D9B633A5AD57E9A2EFC950B30E7728B4CB0F10DB721231B68725D5176A4B3C22314DAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225853, "uuid": "15056d64-4372-4235-957b-96ea2b0553b6", "value": "196608:5HWYmz3nNFmwmCbiOCsEzzY9qwz0tX8v5Wk+CdUFvFQwmGdfXthsdoPboYJZlh:52YinNFpmCbxCsgwzE8IMdUFvFQQZtoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776225853, "uuid": "d1b8314c-3417-4f50-9bf1-da92a30e2456", "value": 11332568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776225853, "uuid": "f2fb4f43-8211-4cfd-99a9-4bf2cdce2619", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225853, "uuid": "c65adfe3-392e-4161-a3e0-4a1619bce3e9", "value": "bot-x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "202460b3-38b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776249888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776249888, "uuid": "571daf94-6e70-4b1c-a2e8-91ce70062b19", "comment": "Malware payload", "value": "ee70d9cc5bad399c8379d44fa2473aa4", "object_relation": "md5", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776249888, "uuid": "f644e409-5163-46e8-829a-2c80134b8e26", "comment": "Malware payload", "value": "02e946ffee92f87e689c249be80821c0f5ef18a46591f8a7b4d3a3825f6a12ff", "object_relation": "sha256", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776249888, "uuid": "55fa0c1a-eda3-4ca8-a0ed-30e0486248ca", "comment": "Malware payload", "value": "61a389a5e136377e77df0bb5d07e60c6a8770480", "object_relation": "sha1", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776249888, "uuid": "2939d841-fbc5-4ad7-a99f-dca11a0a2d9e", "comment": "Malware payload", "value": "a315fa088a403a127ac18792ad52dfc75b8a13e162605f5e8b6f611f187334ab850226c975df3689cc19d55bdca038b2", "object_relation": "sha3-384", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776249888, "uuid": "8ad0c672-9db5-4c64-a46e-e689ee64f6b8", "value": "T1CB333CD7ED05217C864B5EDD3B7769832432DB166924AE08D802BCFC063BCF5A09E769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776249888, "uuid": "f245ab3d-0509-43a7-a27c-6a7e4ff4de4e", "value": "768:3Qbin45be8QM4FTxnpcBaBV6nwLMtduGIg5YV/3aviKu1Bo5vxpicHnW1zEk2nGA:kin4uGcMtLHwzx3941vFid7haYDl1FWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776249888, "uuid": "15c67b52-cdea-4a66-aefb-c0469e2f1364", "value": 54210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776249888, "uuid": "545bc5e1-20db-4527-b65a-693a295a1f06", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776249888, "uuid": "59df9159-10f0-41ae-937c-41c74c25aea9", "value": "02e946ffee92f87e689c249be80821c0f5ef18a46591f8a7b4d3a3825f6a12ff.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7abb9fa-38ce-11f1-a769-42010a9c0008", "comment": "Malware payload (N-W0rm)", "timestamp": 1776259565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259565, "uuid": "2f7c54e1-1249-4f1f-916c-cec0902a16e1", "comment": "Malware payload (N-W0rm)", "value": "b68c1130e05c9ad0ea775608d081c31a", "object_relation": "md5", "Tag": [ { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259565, "uuid": "f937dd9f-d5ec-4804-bd3e-6d441135e266", "comment": "Malware payload (N-W0rm)", "value": "0379f27b831b654c5c583e92c60c1aecf54e1ebcfc615e57969d06681d58d329", "object_relation": "sha256", "Tag": [ { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259565, "uuid": "3bec7078-d91a-4daa-a207-61cbb9fcea89", "comment": "Malware payload (N-W0rm)", "value": "8554e34eb658ecb68b989dfe8dcd5f43d24c501a", "object_relation": "sha1", "Tag": [ { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259565, "uuid": "ad49b698-db2e-4acb-bece-52cafaf2b313", "comment": "Malware payload (N-W0rm)", "value": "cdb2226a8220786baeac275f224abd762ce7be36836c443157ee46c93db88c86b4dd133cd43c108a18ece06d6c01e98c", "object_relation": "sha3-384", "Tag": [ { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259565, "uuid": "57a6950c-7eb1-4dbe-b62d-ea35c21c3c4c", "value": "T133245B616EC93025BB72777C9BF21021C50EBE529F27844D22BB45C9AB33B8985D13BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259565, "uuid": "52a792a9-ee0e-40fd-9a31-05dbc53927b6", "value": "6144:NXjt+HWOD90FQwN4qw3GiBzzbSGcGWhW6DWQ6Tu:NztkWOD90FpN4XGiBz3C46aNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259565, "uuid": "15ab6da5-4763-468f-9038-a836c80d19aa", "value": 222472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259565, "uuid": "11551dd0-6618-45d6-af77-685e717a1fcd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259565, "uuid": "99d83bcb-d788-4e3d-8918-c3ea5f033604", "value": "Product list_MR-15-0434.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b89c3aff-38fa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776278491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278491, "uuid": "9342a561-6430-486f-8e3d-de61cf9550a6", "comment": "Malware payload (Mirai)", "value": "570011c82cfaea3329ba5895717b728b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278491, "uuid": "f1b70dd8-1010-4db8-9a78-900453d6410f", "comment": "Malware payload (Mirai)", "value": "03a87400ee5bb9777560b965d9337d1c0c727634e0f1248c725e378559482cf5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278491, "uuid": "3a6d56be-7d17-4e87-9ffe-5f43dae07526", "comment": "Malware payload (Mirai)", "value": "a58d78999133182a372eb02b1adc695b4c406503", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278491, "uuid": "4789cd6a-b4ff-4cb1-9e09-d5420e491084", "comment": "Malware payload (Mirai)", "value": "715c4d2d3cb3f65016584e46349ac0d18fdcb8446cc325ce5ae96d878029258d30124996ba405f31886b13f4b68cf31b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278491, "uuid": "bbdabb2b-d4df-472a-8287-a476f310900d", "value": "T1EAD2D17C78149A80E9F514361435D2DB3F632AF8E2D93A7B6120676C39C79190BF8BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278491, "uuid": "267221ef-0c86-488c-8675-46fd6f6c3d8c", "value": "768:H0beLCMhEsL8aAuqRVCB38PRKXk2cs3Uozm:H0iv85PumZwrzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776278491, "uuid": "83fcd57c-e62f-4621-bd1b-1972a09a55d4", "value": 29636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776278491, "uuid": "153e5f42-37e8-4f86-8ebf-be88c77d80ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278491, "uuid": "ed2e914f-9a10-4484-9711-21c76d96d2de", "value": "FGx8SNCa4txePA.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c65d7d-38bc-11f1-a769-42010a9c0008", "comment": "Malware payload (CobaltStrike)", "timestamp": 1776251856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251856, "uuid": "7a6d4c7f-66d2-4020-8122-91a56da78697", "comment": "Malware payload (CobaltStrike)", "value": "e337dc31d924cc81916ff40bb3385ffe", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251856, "uuid": "265a9b48-17b6-4846-bcfb-fe7abdedbac5", "comment": "Malware payload (CobaltStrike)", "value": "03ca7bcc97fccc10ac293492afc385f3d50916060d6692a8ccc631176f7fda0a", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251856, "uuid": "e11916b7-1bcf-4ed6-9d32-4e31d4a73e36", "comment": "Malware payload (CobaltStrike)", "value": "65e30a6fa951e7a9443686513fea806c1ab83b20", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251856, "uuid": "6a5baa42-39a4-4fa2-8def-4d32a7454fdd", "comment": "Malware payload (CobaltStrike)", "value": "2515c0817ac7d157af01db35868f586ece27a965350a80f82048f13c8d1428be65ce625ba78236d8b85bde6df2bceb0c", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251856, "uuid": "712314c8-4166-4b07-b806-eff0a429b167", "value": "T1A5D55B1BFCA118F9C1AED23589235556BB707C851B3227D72A90F2B82FB2BD05E39714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251856, "uuid": "7b57681e-9442-4cf4-86d4-b8361a1381e2", "value": "3ea0d4f44f2a32cf20db9a7e00271489", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251856, "uuid": "5eceb391-fb66-4713-908b-273a22d6ede5", "value": "24576:114dUZMYCHH2OSBpHVn6Fjp2ExEu8YuKknGLAPzJ14j3E0Gi3fP3t9WrnpEE6uW:114qZMYCHH2Ok6FjpbNTKWSgjhb7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776251856, "uuid": "45b692e0-05b7-44ba-80b8-8dcce7ad737c", "value": 2799832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776251856, "uuid": "d38cf1d1-98a1-48f1-b597-b84b5f97504f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251856, "uuid": "7645a357-1e02-450f-a723-aa6105019464", "value": "Dokumen-perusahaan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09df8866-38f0-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1776273903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776273903, "uuid": "ad7b3ad9-3361-46f3-87ae-498544ceb94b", "comment": "Malware payload (LummaStealer)", "value": "8cb8301f664e1e42dee8b7032fa321fc", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776273903, "uuid": "9b4b7314-9777-44ee-b04c-fe2218f9a19a", "comment": "Malware payload (LummaStealer)", "value": "03e6f4f49cec3af38bbec9ed64c195c7a85a630ec989efb3669f04a2993c1dd7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776273903, "uuid": "e3034225-da78-4003-8aed-408305dc319e", "comment": "Malware payload (LummaStealer)", "value": "f732e938a8fda479886576df82c611f9540db42c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776273903, "uuid": "ff0e9727-6baf-4995-9226-bf826b604c5f", "comment": "Malware payload (LummaStealer)", "value": "afc71376febb093b795f8e4fa2fed5182fca6152b15ef1c745fdcfbd72754a1229f2ecaa9b696badae43208582a9a566", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776273903, "uuid": "00ae33ee-fe33-4c61-bc10-b30566067814", "value": "T1D4854900FD8794F6E8061B3655AB62AF2735AC090FB69A87EA447F79F9723D11C32344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776273903, "uuid": "59d9c0e1-2db0-4abe-b231-8dfda65c4042", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776273903, "uuid": "2cc080c3-d716-4977-99e4-8e398736b1e8", "value": "24576:ew48NqvO9qOoJQ/LEMC16tzKJt1rROu/3srGurkU+zE7WdUGYV5LWJfINPsb3gWH:elCY8tzc7qEDbQWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776273903, "uuid": "822d1c47-c994-492f-bf4f-de9719a20920", "value": 1762432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776273903, "uuid": "2fcb14f0-2811-4e27-92b7-cd198cb66385", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776273903, "uuid": "96462f9b-e955-4ed7-88f5-6c5fe2ac11a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "497e2f1e-389f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776239220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239220, "uuid": "bc2dc81e-8e39-4274-b158-72d891cc8f40", "comment": "Malware payload (AgentTesla)", "value": "52847b3ade5bf05016c79c6c75059ac3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239220, "uuid": "6c816c19-38c5-480c-b6a6-43d7808b279a", "comment": "Malware payload (AgentTesla)", "value": "04479c87f9174eec4aea4c9c8d8ca63ff1b8c0845918a1ed6bac784d2f405209", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239220, "uuid": "5881665c-40c1-4949-8239-267fb55e0a74", "comment": "Malware payload (AgentTesla)", "value": "2c5e88c59279ae2e43b101a41e8d53f2bf269924", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239220, "uuid": "888c06ac-4ff2-44ac-9f9f-33385acd2bc3", "comment": "Malware payload (AgentTesla)", "value": "cd81f896c6c613b9eea7c2884f1da30705f1a941c52d6b05aa2c22ef39626e5679aaff680513cebf9abb4530d953da0b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239220, "uuid": "a496a140-2bca-4d9a-960e-3bacc3840602", "value": "T117D5F303E16274A6C1452100A1F8DF00E50DDD2865B93BFE7EB9CDF0734997BA89EEA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239220, "uuid": "ce88db66-a196-4486-a0d4-30427580eef5", "value": "1536:VER8YU1gEi3YNVWwR3HOPRsgwvRhZ/Q5QEhgmmaN6xQ8m8Wvu/sO2ydvoRsgwvRL:V9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239220, "uuid": "b24c8a8f-1e4a-48c4-af67-770c3da7e8ab", "value": 2890310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239220, "uuid": "fde0afd1-a76f-45a0-9321-70f79e2de0f1", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239220, "uuid": "a5bf2218-0574-4ce6-8776-a0fae829042d", "value": "Consulta de compra NPI202604007.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0b8466-38ce-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1776259515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259515, "uuid": "c7aed007-26f2-4b94-9e86-7625978a2d28", "comment": "Malware payload (MassLogger)", "value": "7de3d736dbb8a831d233ed35997fd14d", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259515, "uuid": "8bf886f8-c03b-44e5-b08b-d159891838ef", "comment": "Malware payload (MassLogger)", "value": "0457c03d79b8d12822ee5d90b01b4f7b1b43217dc9aa1ce8916e425189298336", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259515, "uuid": "bf0a150c-f065-4319-9cb9-b6a2abc8d07e", "comment": "Malware payload (MassLogger)", "value": "14e59cb78e9a1e789c8220d1be26e52cdb7e08aa", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259515, "uuid": "c3407c1b-8519-474b-8585-34e9d8347bce", "comment": "Malware payload (MassLogger)", "value": "53573e967d2c1da0dd27fb14938336cfb8889f4941be5846b03a516b34e524cb03f23377adaa77a15b47cb90b87fbc7e", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259515, "uuid": "4060ba7e-af0f-4e2f-96fc-c1a12d59d4f9", "value": "T1FBD2723ECA845FF00BAF61E6298F7E5195190713B6352A0EF9CDD49D2B2D250CBE50E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259515, "uuid": "fcbc496d-7fae-48d4-87dd-24003b3e98f4", "value": "768:KG0gmdNm0gd2Lom/oPhfL8fgERHQupMolAZfGqq:DmdNfgd20m/oZz8fgERHQupPAZfjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259515, "uuid": "7d44a32e-a362-4c94-b850-0b69ef479730", "value": 28955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259515, "uuid": "5cdf5eda-9b36-49e6-b410-dbadf092d3d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259515, "uuid": "62755909-75f5-49c8-becd-eb6a4cf3a2bb", "value": "rocc3478k1.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce80cf25-38d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Patchwork)", "timestamp": 1776261777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776261777, "uuid": "efec7c4d-bde4-4b76-967d-f67727dd97b0", "comment": "Malware payload (Patchwork)", "value": "dcde2aa7d290cf696c8070207577610e", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Patchwork", "colour": "#4DDC96", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776261777, "uuid": "7a556421-5733-4bf4-b419-7d78f6e14cb7", "comment": "Malware payload (Patchwork)", "value": "045d995dee9b3fba080415be55c932f245582c44d70243fc3fbf0174fd3495bd", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Patchwork", "colour": "#4DDC96", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776261777, "uuid": "987d1473-70ae-4d43-b2b3-f9baae27094e", "comment": "Malware payload (Patchwork)", "value": "5cf716dc70a0de1656b933c5ac2b1b56bae29f7f", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Patchwork", "colour": "#4DDC96", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776261777, "uuid": "49e8536e-e283-478e-8add-0eaf2bfa25b5", "comment": "Malware payload (Patchwork)", "value": "1f09ada6e4ae521f3bbf56dfb888ab3a88d4c7568570dac2ef2947adaf0dc54296d9595cd6402b00c0751c5baf00f08a", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Patchwork", "colour": "#4DDC96", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776261777, "uuid": "23618e75-ec79-4076-9085-56367b44fe11", "value": "T17A717B0427F60254F7B34B3EA8FFA25155767D5CFE319A9D02A0D1480CE5619E83AF2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776261777, "uuid": "973a009b-f271-4cff-a120-7d1a12c42df0", "value": "48:8oruaFktOJRLurzOAGitbD+sqddKHYd0Y9XuHQBqiYLq4:8orXgOzurzOap6sXTY1um3YLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776261777, "uuid": "4682fe29-d429-4f19-bf00-8329899c6b64", "value": 3762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776261777, "uuid": "31f65e4f-3b16-42a7-acce-25d7629b244a", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776261777, "uuid": "038befb0-37b3-4dc2-9a85-5ca56b806f67", "value": "Report_2026.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da26791-38ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776257723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257723, "uuid": "6b7e4d3c-01bd-4051-85ca-962128c08e82", "comment": "Malware payload", "value": "4447efc903329f4916656a99161c7725", "object_relation": "md5", "Tag": [ { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257723, "uuid": "99dd78ee-90be-4a19-a235-e47f142a43c2", "comment": "Malware payload", "value": "050537a47b5463e96a9f3e7ba79c607017faceeb668cef8aa1d5e11a19ff4990", "object_relation": "sha256", "Tag": [ { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257723, "uuid": "300b18d4-0cb0-4c1a-8039-62c85f4dbc58", "comment": "Malware payload", "value": "366b830464c0d609b94f8f2f460ac37474eabf67", "object_relation": "sha1", "Tag": [ { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257723, "uuid": "2e25520c-278f-495d-98d9-b2fb08c9eec6", "comment": "Malware payload", "value": "fa0f0ca635922eb011335652c5ce9e047eac52a57dac488d4c7dfcbb44ff00a9c72e28033a5bb8ba0bec5c12603056cf", "object_relation": "sha3-384", "Tag": [ { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257723, "uuid": "9cfe02fe-478c-4078-984d-7006f537312e", "value": "T19118E147F6428CA7CDE55470A55ED277B3223D6CC352A213AA44B7287EBB7D44F2A380", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257723, "uuid": "54308f9a-f270-450e-8108-526fda189d6b", "value": "786432:Qx8hpRVAgfsVI0mke75jT0ZfR7LzfvfWyYEL9aoW56k1mApPfjO72Qm/fvpJc:jf9R5fyYLT1Y72QsJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776257723, "uuid": "361668d1-8c80-4d86-b098-143bb94921a7", "value": 87819084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776257723, "uuid": "54b20fa1-af11-403b-bcd7-57f95557e33b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257723, "uuid": "0f5064a2-4936-4520-b1d2-447bc6fefcab", "value": "050537a47b5463e96a9f3e7ba79c607017faceeb668cef8aa1d5e11a19ff4990.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01902e5-38cf-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776260116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260116, "uuid": "24d38df9-4574-4b8d-b885-c1c785d58a17", "comment": "Malware payload (NetSupport)", "value": "f6e2c5c4c8827691e5c3a7716d6a49d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260116, "uuid": "94e52cb2-337d-4362-a0ca-dfa6b18d1596", "comment": "Malware payload (NetSupport)", "value": "05264c0d02cba4c2cff50fcc150d710a828ae00da9e68889dbf4c1a95b9ee224", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260116, "uuid": "d8f43a2b-bb88-4500-910a-e2377bc87f9a", "comment": "Malware payload (NetSupport)", "value": "24d38175b1f2b7bfad378a75028329344c86113a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260116, "uuid": "e5c7cbb4-9fd4-4eaf-9772-080372ec184e", "comment": "Malware payload (NetSupport)", "value": "85329d2f9e5b6b6cbc8d5c8e120b6a6b362c039686bd0a46956c74910c0b236ae77e2fde5ed70ba9fb9cebcf140a9cac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776260116, "uuid": "0ae3dc88-06f0-4d65-b869-10b8efa60b41", "value": "T131F55B0BEDBD8CE9C099E27444336116BA65BC400B3163E72BD5B2682F737F0987AB55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776260116, "uuid": "bd2ac4be-e652-44db-943b-4b667002833d", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776260116, "uuid": "f2183b71-e4b7-4a49-9828-21a16300e7f7", "value": "49152:gTK2B2MxdjxWo/0QoAVHHuRB1UI7JvjWMQclx/R:gTX/jDcAVWUI7M98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776260116, "uuid": "390e3dcb-5f33-410c-a92d-99a76cf5a895", "value": 3448328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776260116, "uuid": "64060188-402d-4746-959d-1ec767143468", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776260116, "uuid": "fe505041-8cb8-4e28-8c57-b0955cce68b4", "value": "SecuriteInfo.com.Variant.Ulise.596178.28042.32130", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea4e87c1-38cf-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776260106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260106, "uuid": "0a97c868-187c-4979-ad50-615b971e1c1f", "comment": "Malware payload (ConnectWise)", "value": "b86393cdf59d4b569fd141000bca4b29", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260106, "uuid": "02eda6d5-683f-41ae-976b-338df57a9f0a", "comment": "Malware payload (ConnectWise)", "value": "0584a4d9b81532aa96c0fd45d8cd4afe67c473bb65a02ca3770d1e3e9ec28073", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260106, "uuid": "c7372a97-1e51-4885-8e7c-5fffd8fe3086", "comment": "Malware payload (ConnectWise)", "value": "38545cdd2c72093fd680332ac50d5a4aa0098ce8", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260106, "uuid": "d0153267-f662-4e50-be62-61e01166dc08", "comment": "Malware payload (ConnectWise)", "value": "1b6e13e4c871ea0b56e7e4acbb4d02dafe544d406ffa1803968d883f2b0be4d80b43e04e0e5b343115ecc0eabbd579d7", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776260106, "uuid": "6333d946-3887-4fe3-bc8e-b632e85ad8aa", "value": "T18785F03132E9C139E2B21A39E93A96F15979BC64DA23804F53747D1E3970E8096B3773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776260106, "uuid": "8c78aafd-d927-4f9a-8111-43c2314e6b4f", "value": "49152:MHU5PpiTE7gLqTlrs1GLM7RGVozXGHvZ/NTHMu1g:UU9pOE702rs1ouR/GPZ5HMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776260106, "uuid": "b6140060-e329-4120-9e77-39565b67819b", "value": 1871872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776260106, "uuid": "fd8c54dc-062f-48de-bb90-af58b4c6a19d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776260106, "uuid": "a434a234-8701-4018-9e1f-08c0ee0b80d6", "value": "SecuriteInfo.com.Riskware.MSIL.ScreenConnect.Heur.5034.17013", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4432e0ab-38f2-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776274860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274860, "uuid": "8a4aebdf-7b2d-4f85-bdbb-bc8812f29146", "comment": "Malware payload (ConnectWise)", "value": "70a29e3c9293cb4369a5af52a405b139", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274860, "uuid": "448dc94e-2686-40bb-939e-d73922dee879", "comment": "Malware payload (ConnectWise)", "value": "061ede6d0296975091702edc85aa5eb30039e30764c8bb1d52d35705e369152a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274860, "uuid": "8d35ba81-ada7-4a5e-83a3-1e7bdd9b934b", "comment": "Malware payload (ConnectWise)", "value": "14041a00b4a59a4ecec22f94b3fc41d57bb2cf14", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274860, "uuid": "148ab62b-4012-4faf-983d-72b1c283db53", "comment": "Malware payload (ConnectWise)", "value": "81059bd9c9396683d4b06013f011291cfaab51e97fcc48aed0a4d26c3e1a6df74c4a19ce39684d450c0784b29e541835", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274860, "uuid": "4696b3f6-43ee-4d8b-971a-ea4d1974f8fc", "value": "T1FBA623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274860, "uuid": "ffab8d24-62ab-4c3d-b630-6b5b32d978ab", "value": "196608:7nCtVYqI5MvbWEpKkqeIJqKRnCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkq6nCtO:DCXvI5MvHx6JHCXvI5MvHx6CXvI5MvH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776274860, "uuid": "1167406f-8452-4b65-b5ac-5c28eb8bc244", "value": 10190848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776274860, "uuid": "44f9f5a0-9acb-4a6a-8c49-cc38bbe54e62", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274860, "uuid": "71eec216-219a-4c2d-bb17-b0de24c96751", "value": "ScreenConnect.ClientSetup2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18539006-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776239567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239567, "uuid": "f3d14b7f-ccbf-4a3a-bf69-0706fea88c2d", "comment": "Malware payload", "value": "9bd339e172b80a7650f346880d3bb109", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239567, "uuid": "0df52ef6-d2eb-42b6-9b38-24ea39f4f492", "comment": "Malware payload", "value": "0651a8097db2225402965bed41144702b2120afd5287ae7f58d2b2f8ff27fd11", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239567, "uuid": "71e12efc-5249-45b7-b99b-8b72c735f88b", "comment": "Malware payload", "value": "4fc6057156cdbf91b54705cc66affe8d9e45a41e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239567, "uuid": "98a2b7f0-418c-47e8-9f5e-b7778fe3c912", "comment": "Malware payload", "value": "c9e4e5f974ca7f8b6b1d4593e6589f8bb8030fe9822a10d2dc2764f9de7f936aa16be3f6f8dfde4e2c9f3ad33bb1c92a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239567, "uuid": "61944f82-7388-4662-8dc9-754b1f521353", "value": "T1DF541E38ADEA401A7173EF15AED47493E96FBB33370E485D2091038A4723949EDD963E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239567, "uuid": "fcc3d72f-1393-4e20-b056-87e0eda3ecbc", "value": "6144:VyOjQxynv9EmP6TqcOUZT1TfGfJ6Srxbos9u8xBoEdSBZqik9BVY4NvvGGNw5n:ZQxynv9EmP6TqcOUjG4SZomugBoTfqir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239567, "uuid": "061c8874-6198-41e5-877b-37d2d54e51be", "value": 296352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239567, "uuid": "90e8cec0-ca7a-48ff-b8dd-d5a25084ae47", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239567, "uuid": "39073edf-7f58-4be6-8720-b24bed0a17c3", "value": "Pre-alert.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6bef86b-38bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776251940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251940, "uuid": "4e64a122-b600-4d1c-b9c4-dc2d4acf768f", "comment": "Malware payload (Formbook)", "value": "4ba28a75679c62df2342ccef16707ce2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251940, "uuid": "14b8d5b9-fe48-4d9a-b33b-c275b2a89b99", "comment": "Malware payload (Formbook)", "value": "072001c16c0663baaefe3741453b288bf13f38e9faf43a693fae3bed70a6dfba", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251940, "uuid": "2554bea3-ef94-4f80-8ee3-185a8810fac9", "comment": "Malware payload (Formbook)", "value": "76329a85359cefc138133f343ae2f225c1046b75", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251940, "uuid": "87cce31f-9138-4845-b535-b36b32c94be1", "comment": "Malware payload (Formbook)", "value": "95c3f5ad293dccd4429465077164232c85b4c106b8d17c9d4e820d9ebc9aee3e89f8030c498e60664c8b0b21c3273399", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251940, "uuid": "a556cf15-aff7-402c-a755-076b3468ccf7", "value": "T1DD54AB8D7E506E85BC1D8A6BA331CC28647917F6762F70CE540A23E66D417C0DFDAC2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251940, "uuid": "e02dda67-053d-4e86-8046-8d87d711df1a", "value": "768:tSGmSGmSGmSGmSGmSGmSGmSGmSGmSGmSGmSGmSGmSGmSGmSGmSGmSGmSGmSGmSGD:1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776251940, "uuid": "f9e4b285-c0f4-4c17-a0e5-15ef8182beba", "value": 286817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776251940, "uuid": "d8274b50-98fa-441f-b928-5163cc00a615", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251940, "uuid": "2c71ab93-a533-4035-9c17-f880ceb390e3", "value": "goodthingsforbetterforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ccc30cb-389d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776238367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238367, "uuid": "34edc20a-35ac-446a-ab8c-7e6bd6d25fe1", "comment": "Malware payload", "value": "90bbe79101b6f3aea0a1d2aaa8f3aed7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238367, "uuid": "0bf38aa1-425e-401d-a342-83be7bc5b8d9", "comment": "Malware payload", "value": "07bf65a19f185ee51e47bbb2f82e4e6119adf880a293e4bcf313beca6269415c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238367, "uuid": "4c7250d6-cd1c-467a-8717-a7c122ee3087", "comment": "Malware payload", "value": "dd3ed10706135ef9dd7032209476ebaa215a4bbc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238367, "uuid": "c9e2129d-503f-491d-882d-83bd52cb0cf1", "comment": "Malware payload", "value": "c3e602e103748a9bd0d872e788cca13df6f1d39ee57162d6b0eaec9dcf14a8b3bc5343dbc02298a731629bb7a69cd000", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238367, "uuid": "88f69a1e-e933-44b3-8d01-09738a62abd8", "value": "T1C95320F4B77E384004E7868245093376DE1A7886AD08F71AFD2754E9A72FD6C6EC2670", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238367, "uuid": "6a9d2868-af78-4307-a7cb-e906b652b89f", "value": "1536:HG3FOwEYLY1k3YHoraymieQChkId/w7CS7l7S:HG1Ow2IraymZhoz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776238367, "uuid": "c355240d-1daf-4217-9d13-d6caca7ce56c", "value": 63054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776238367, "uuid": "1af0a5fe-0377-4955-bed9-14cf3b6da948", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238367, "uuid": "238e8dac-9ff9-4773-aa46-869dc483be25", "value": "SOSTENER.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41cdf949-38ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776259394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259394, "uuid": "527362da-65b8-4f07-8bcb-25626f19a558", "comment": "Malware payload (Formbook)", "value": "41aa8344d6ebbdb1710946d4fda6661e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259394, "uuid": "fdaf1954-5058-464e-bd23-901e0e57c4cd", "comment": "Malware payload (Formbook)", "value": "0801218cdfbcd063548445e707ab1e0abbca664077c21330f4103fdc63eec331", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259394, "uuid": "e30ee53c-25fd-40d2-8c78-0b5ba2b50542", "comment": "Malware payload (Formbook)", "value": "e87d429fd4e9e272d049d1b2a0854dcb6fea9f45", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259394, "uuid": "5e88cbf0-4175-4bef-bd7d-f107fa7e277a", "comment": "Malware payload (Formbook)", "value": "ebd443e4cd1baf8dbf6dbfb46e30a4b0cfd1bfc7fcdfe42d096e70067d9357159e9ce9884379e872c143317759357c94", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259394, "uuid": "57a1a42f-d529-4f19-8f46-416f92f9360d", "value": "T1839502118AC43FB9CFAC5A1980FE161D63E04E8E5419798AFB73BD4ABFFB6044117198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259394, "uuid": "bd45e042-d913-4f65-a202-1c0c08c6e897", "value": "24576:SxP2zfZDNIpEGf4tIpOGCZLV+4CynOuOwdlN1vGSpTJ4sdyIPCrwAwdtyck:SYzhDNIWoaltZnRPCcyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259394, "uuid": "bf74d167-bace-4884-9350-d66c74d3cb3c", "value": 1999715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259394, "uuid": "2e097e32-8675-4a07-82fb-a8f9eeea1434", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259394, "uuid": "0f377a0e-4ebe-4cd5-89cb-9bf2831c3111", "value": "offlinejs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d0c6982-3899-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776236596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236596, "uuid": "f909af77-1fc6-439e-a738-2ffa15ec1fec", "comment": "Malware payload (AsyncRAT)", "value": "7191f2fdd2e2dcb928e0ff6a1cd1e622", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236596, "uuid": "c631a2c0-6560-4a41-be16-20c08da539b1", "comment": "Malware payload (AsyncRAT)", "value": "08e41de61e3905ec85a0054033b69a51e9bd4ee9e0e565bf57c82e27821ff468", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236596, "uuid": "40f477bf-92a4-4039-a86d-4521ed474997", "comment": "Malware payload (AsyncRAT)", "value": "00b8f3f46e3042ba41e57f6a4445dc9bcdc34474", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236596, "uuid": "339aeac7-e9a4-4d87-ad52-dcd76a815c1a", "comment": "Malware payload (AsyncRAT)", "value": "be81fd135fd13e26d330ff05334ad64a100be656657997f3a01dd334f1675d741fd2e17d84028d2c382d6b47143ceae3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236596, "uuid": "5833b878-4526-409c-8956-023ab44421df", "value": "T1E3E49C208E466B1CEA3D0B78D072155C37F4C857E25ADF5B3FFCA1B0AAA3B81C85A515", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236596, "uuid": "3cf2100d-e510-41b7-8132-5309fb356123", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236596, "uuid": "10cd8caf-ad38-44d0-bbca-3d85f1a86fa4", "value": "12288:VC6kf1/17X04hnvK/BeG+Dae5zumekWRFRfs:4nfbTthC/AGMaElK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776236596, "uuid": "455cc366-f3b7-4777-9519-bb292b81b810", "value": 699904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776236596, "uuid": "3136fe89-d274-4c7d-8897-3bf99b83bbb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236596, "uuid": "d7352283-1e0d-4c45-bc1e-4b2f9ed11b6f", "value": "COTIZACI\u00d3N.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ab0f10-38fa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776278479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278479, "uuid": "62196ea4-d6fa-4bb0-bfae-508655c63d0a", "comment": "Malware payload (Mirai)", "value": "591fb7d669cd04f336d5d43d04614dd4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278479, "uuid": "ae7b107c-b1b1-492c-8a50-51af88246122", "comment": "Malware payload (Mirai)", "value": "09eefc7212485cf37ffdc1b8e5663015feb435ee78ffcbcdb5009afa8cc74d63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278479, "uuid": "c2a0538b-b4ce-4675-8016-1cfada584a7e", "comment": "Malware payload (Mirai)", "value": "86d7a6ef87b50dc0c49796e4f3f4ecd700a60839", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278479, "uuid": "1545684c-44ef-4c2c-9263-b88ba3e10487", "comment": "Malware payload (Mirai)", "value": "3a3de743c81e56367a3175a55f09d8a9256139eaaf00732948b8430bc5c61dc91c3787bdd7599d29663c8bdb7ccb7867", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278479, "uuid": "12160432-ebe6-4997-b7b2-53eef477701d", "value": "T11CC2D138F4423DCFDBA2B8B01CD2EAC697772F8F2A614DC297919B70465654256D0BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278479, "uuid": "d257ed3a-4c89-4817-99f9-80fe01b83d91", "value": "768:47ZgG5QPFUwzAc1hI+wc8yzbUOIn4uVcqgw0906n:oZvucIhff8yzAOc4u+qgw090y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776278479, "uuid": "cdd64f32-db10-4123-baff-c679aaecdfc7", "value": 28100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776278479, "uuid": "1fb14019-72e1-4b13-abcf-f9e452703245", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278479, "uuid": "453986a5-9cd9-4878-8001-f1392b30ee48", "value": "FGx8SNCa4txePA.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81112bf3-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776239743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239743, "uuid": "18a4fb60-9cc3-4050-be67-be3ffe646df0", "comment": "Malware payload", "value": "67e6678b1b7b99c91723131ea1f1b47c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239743, "uuid": "41e84dd7-8064-47fc-86fa-5addcf01546a", "comment": "Malware payload", "value": "0a3ecccbe6255c347cba33f6433abc90cd0e4c487abd741429a16619cfea7c14", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239743, "uuid": "9d6a4b92-039c-4c02-bcfc-46631f4dd4a6", "comment": "Malware payload", "value": "f6cd4f5934bcf7007497a3d372362958e3303203", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239743, "uuid": "a8580925-983a-41ab-bf06-2e13de250baa", "comment": "Malware payload", "value": "48222990a7ee375ba6709c4184e986dbc559557acb2553e4e59d214e48c6896a190f11b58e1050a1af2ba03789291a55", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239743, "uuid": "a1ab2921-6182-4b5a-891d-e7f1ee59612d", "value": "T12BD5757BFDC206AA5BAA1FA12F357D472D063F3F697284047579E9E125631E00A438F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239743, "uuid": "c7fc14d1-a86d-4c8e-a73d-236aba650f15", "value": "192:5gubICWb9lg+uhF1ulxlz5h2bnRdKEuBwUtUWfuRutkdvGx2zINU7uPWuCmVFWMe:5guM9sELQ4QGBimOvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239743, "uuid": "d5d31374-d4e3-4d49-a86d-17688533d57b", "value": 2824266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239743, "uuid": "19b2047a-ae44-41fc-ba87-77e9721288a0", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239743, "uuid": "e7bf439b-3790-480d-bbf9-6f821f3f4357", "value": "Advance payment transfer BE374390.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d7719a-391d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776293328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293328, "uuid": "f7528eaa-e78f-42a7-86c1-34e519f29642", "comment": "Malware payload", "value": "2fbb4ae9e24f96b29a836c297b5d87af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293328, "uuid": "81262d9a-049d-4fd0-a554-2246ce9bbf61", "comment": "Malware payload", "value": "0a420f2779dc2b65ca5ac612b9d2d506fca39a7b2f1f52378156927a9dee72b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293328, "uuid": "4e433d5e-fbf7-4bd1-a103-01615cdbade6", "comment": "Malware payload", "value": "71816fd2ce101418342289e5329a92a49aed24c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293328, "uuid": "813f7e77-8265-40b3-8023-18c5e0b7ddd1", "comment": "Malware payload", "value": "f41ca949f767622eabcea3669d574996eb441ce4d8ebb0a36ad0e4afd5dd976cee7eb32948da64f08001365251f14da6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293328, "uuid": "56caeba6-90a9-4f50-b209-b8ccdc5d6d65", "value": "T19FB30945FC505B17C6C652BBFB4E428D7B2A1768D3EE72039D256F30378B96A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293328, "uuid": "3a25b964-ebd2-4fcd-a87b-436c64f9a9cd", "value": "1536:EfivcFrQAEbBU4VhbFjiTwSrtPKXOqL2rZw5bC56lD2wywdsheT4qp4c4iAdtvl:hv0rQRU4/YsSrFjKkrl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776293328, "uuid": "fb64b610-b3b0-4dda-8253-0baa0aa4a3ad", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776293328, "uuid": "21a518dc-d59c-430c-9c86-e17037c4149a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293328, "uuid": "1a0bb06e-623f-4dfe-ae17-54725279be0a", "value": ".Sassy.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "142ee117-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776239560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239560, "uuid": "f1159971-ada6-4a13-8593-c81402664701", "comment": "Malware payload (PhantomStealer)", "value": "ad0295504ff5b9e02a982d9af560e689", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239560, "uuid": "83a2ee4a-f6ba-4982-a811-de04ebbf5ff7", "comment": "Malware payload (PhantomStealer)", "value": "0b73a8077e6e7af876a24f2df658861b39c9d1cba64439d17bf8a40d4cfe67a6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239560, "uuid": "c5f8ef8e-6d6d-40dc-afb9-4d5aa533a04a", "comment": "Malware payload (PhantomStealer)", "value": "368d8284a279bd3acab1502108d7ce3ef7131563", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239560, "uuid": "7a040fb0-557f-4dc3-b7f4-faecd5bda36a", "comment": "Malware payload (PhantomStealer)", "value": "949852571b957f24a75986f7118cdc10680247c51825f378ea4f10f91a197501d5a5fd3c22451af6f9e0fda8b8fb8484", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239560, "uuid": "ee247c29-d117-4bc6-98c8-904cf9e14d8f", "value": "T14A26021189C42FB9DFEC5B1C80FE161E63F04A8E5056B58AEB33BE47AFE79441207199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239560, "uuid": "53f2889b-bc81-4ed5-b8ac-87a46da7908e", "value": "49152:DE1sHXWvCKFy0MZDtQzt6rJaxqlaIYa8LqE5sP2BJfjy+FxiGhql7ZFh4NM:L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239560, "uuid": "f69bc222-df60-4229-8461-9cc060fda578", "value": 4624973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239560, "uuid": "69664c48-4fce-4def-ad96-d4c51b0b09a6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239560, "uuid": "39661178-0121-4c35-93ca-7b484a56467d", "value": "New order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d54331-38f1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776274408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274408, "uuid": "a40c0172-2842-4e80-ac37-0c8744472ce9", "comment": "Malware payload (Mirai)", "value": "89afa1de4d736c8f634c70a18375f08c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274408, "uuid": "0cee86e2-efc6-4717-9d19-0f08386923bc", "comment": "Malware payload (Mirai)", "value": "0d16a11fca728a923259cd3f2a79b46262504101745f2b483ae055169c4840ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274408, "uuid": "fbf94a94-6ad1-412c-b261-6df0ff5c6f7b", "comment": "Malware payload (Mirai)", "value": "fd7711632715c3cdf7219b97cc3044bd744a4f80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274408, "uuid": "9af714ac-f775-4cd4-b658-377f68d013b0", "comment": "Malware payload (Mirai)", "value": "232d71b75952ab7e526731c1f4e1d11093b8815550d5c007699ab801b0c00e563b39c99139aadd024519f361dee0982f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274408, "uuid": "3e28e2b8-50e1-4b9b-bbf1-70251acf58f9", "value": "T136D30956F8819F12D5C151BAFE0E124E77131B7CE2DE7202AD246B707B8B8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274408, "uuid": "f59ce1a6-8a16-414e-8feb-0c6194cd9891", "value": "3072:NBJUX5jrcXyRwabo6CdGWDBVEeTYKhyHqLY:dkRcX6wak6CZBVP9hyoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776274408, "uuid": "0a36c0e9-5079-41e7-ba26-664067efa4ba", "value": 134524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776274408, "uuid": "0b11856d-e7e6-448b-bba7-65db8e0c7280", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274408, "uuid": "3f855bdd-19a8-48e9-9241-9fe0aa9df244", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a8b61ab-38e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776268025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776268025, "uuid": "47a1883d-2521-4ca8-bab4-a0a4c296c950", "comment": "Malware payload", "value": "996e1d75f2ead4534cc65d4515867a91", "object_relation": "md5", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776268025, "uuid": "93f4961b-80b6-4bcc-931b-7bf84dbb398d", "comment": "Malware payload", "value": "0d26f2dd1631f3bd84cb8d2a300596e25031368cfc06a80e91c2105fd7fe75e1", "object_relation": "sha256", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776268025, "uuid": "c080615d-6a81-4d55-84c2-726638e22a3c", "comment": "Malware payload", "value": "8e86989bad9e0001e1eedde41941514d48c6afba", "object_relation": "sha1", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776268025, "uuid": "f28d2ea9-d485-413c-b6eb-ea9b1b2a7778", "comment": "Malware payload", "value": "a57c63f00cd3496ce69e6dc1da58fa644b06d02b0851be5af713a47a5dd26d9168fa8b009502e2f06035e4fdb5c16459", "object_relation": "sha3-384", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776268025, "uuid": "9a924128-e6ec-44c4-86bf-f3328ee40f2c", "value": "T1E4B63343484ADC840BE5C97229BD089052295E17F6FF9BFF0A75EA8C208B42D4E7D779", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776268025, "uuid": "fccda36c-52c1-4c29-9cf8-51fe346cad41", "value": "196608:oh95b1EhGvjKPBB/40Ww+sUiHaXLNbVOA0QVpV0GqYn8eGOSxQgwKkdS0yTC3:oP5ZQGOH4/wsXLxVOA0FGx/SKpKkdSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776268025, "uuid": "cbd9d228-8c6f-44db-b968-c30f5e5a7afe", "value": 10729430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776268025, "uuid": "89fe978e-ef3a-4d1e-a96d-66f6bc4bdc24", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776268025, "uuid": "e6f91f9d-6762-4723-b934-ea1a6bfa5b0b", "value": "0d26f2dd1631f3bd84cb8d2a300596e25031368cfc06a80e91c2105fd7fe75e1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da41c93-38c6-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776256058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776256058, "uuid": "7420697e-d259-459b-a6df-43648dcf7dab", "comment": "Malware payload (AgentTesla)", "value": "c5ce401ee818b423d2ca8ef271ab7565", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ftp-crescentegramas-com-br", "colour": "#ABA7E7", "exportable": true, "hide_tag": false }, { "name": "sativagina--crescentegramas-com-br", "colour": "#B9AE42", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776256058, "uuid": "dd6f8880-885a-472c-b16c-86e54476ccfc", "comment": "Malware payload (AgentTesla)", "value": "0d653099e96f69fae8c7ef48f727f86c5a097d218950db7f635f01e6236ae04b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ftp-crescentegramas-com-br", "colour": "#ABA7E7", "exportable": true, "hide_tag": false }, { "name": "sativagina--crescentegramas-com-br", "colour": "#B9AE42", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776256058, "uuid": "292a32aa-bd6a-4b3f-8d0a-53d2ce716870", "comment": "Malware payload (AgentTesla)", "value": "7c090da2c4475c4e5fc3e964a6c3af9238550b83", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ftp-crescentegramas-com-br", "colour": "#ABA7E7", "exportable": true, "hide_tag": false }, { "name": "sativagina--crescentegramas-com-br", "colour": "#B9AE42", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776256058, "uuid": "29abbb72-27fc-4e98-be40-d7650d549d92", "comment": "Malware payload (AgentTesla)", "value": "b711ca5d293b4f9fde86c875a641c94ae4ac6e5a74b30b6211388aaff916ff01d150eea62336a9e7b25672b9e2b17635", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ftp-crescentegramas-com-br", "colour": "#ABA7E7", "exportable": true, "hide_tag": false }, { "name": "sativagina--crescentegramas-com-br", "colour": "#B9AE42", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776256058, "uuid": "9875ca85-949a-483a-b279-d069ab10ebfc", "value": "T1C5816CDBEA4EF771C56583BFC0A0351B0E140AD90EE2AB4495378042E24A69F28E59B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776256058, "uuid": "edd3a724-a717-440b-aeee-fffabf0b1dab", "value": "96:5UpkTRfRL4yTyXRNUbVygaoBDIs0nWfMpqH9kMdgYvYok:JEUaIAnWfMIH9gYva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776256058, "uuid": "1a867b81-86a5-47ea-88c3-1edad5c284bd", "value": 3828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776256058, "uuid": "fd0f03ea-ca16-4b05-aa97-2f366878bb34", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776256058, "uuid": "0a306e97-8a70-4445-bff0-a68e50307165", "value": "SJGCPJXFHDPFTDJI.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a200ad-3901-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776281224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776281224, "uuid": "12caf791-ad90-4224-a121-71a7d0285782", "comment": "Malware payload", "value": "d373e0f39b3c38a32f2fb8816e5059c7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776281224, "uuid": "5ec41a45-f476-4dbb-ac11-fbb51fd70f46", "comment": "Malware payload", "value": "0e700e3150840d3b985303efe0fc523a671d89bde346aeeb9771aff888daa971", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776281224, "uuid": "c6b8b6ce-7f7a-4ecc-8203-11c7c1b17892", "comment": "Malware payload", "value": "1d8c8f928af3192796c9e556195b7d3c22fc8e8f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776281224, "uuid": "95926602-7eed-4fcb-9106-45ec040e98e8", "comment": "Malware payload", "value": "47e1b42c1a6a3bb677892c2062ab5e79e3c7458203eb5f72c93c3b2434664d818088953f75058e6d92af39dbd2f81b9d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776281224, "uuid": "e94c2d4b-b81d-4182-a52b-dd4959b1feb8", "value": "T12D136D6526953C25AE99883B5C7F2F0CB9A983E1304491DDBFCA3CF18C55A9CE318B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776281224, "uuid": "a4cbd640-20d8-4709-a008-15be86c5ec92", "value": "768:bes9NyXsZztCtC9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bzHusZUco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776281224, "uuid": "8f58b515-2944-4861-a73d-96b4c8769b97", "value": 45510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776281224, "uuid": "15d8ba0c-bec0-4f52-a2a6-16adfc13855c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776281224, "uuid": "090e6b30-44b3-46b8-820b-f20dff7de3c8", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a60151-3884-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1776227920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776227920, "uuid": "830a0101-941a-4591-baee-d2251cd584c2", "comment": "Malware payload (Smoke Loader)", "value": "5993c6480febcd5fe79e98d10c581b4c", "object_relation": "md5", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776227920, "uuid": "a86ca94e-f8a6-4f2d-89e4-f1399d1385be", "comment": "Malware payload (Smoke Loader)", "value": "0f9c97adc250b2ab1c1b19aa2bd99ac0b8f54e07aaccdfdaf347a258a81ef932", "object_relation": "sha256", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776227920, "uuid": "3c013fb6-e268-499f-8d8d-05779f5f835d", "comment": "Malware payload (Smoke Loader)", "value": "186b34eaa911cba8ba142d2d3ffd63ce338b1826", "object_relation": "sha1", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776227920, "uuid": "bba41032-b1fe-491a-bf56-a932310cf051", "comment": "Malware payload (Smoke Loader)", "value": "77d356cf0bffa7879f13cddb4277323404b9ae610777e68261387c4cb79d5f898c59d924236b7bf66fd655e2de7d6167", "object_relation": "sha3-384", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776227920, "uuid": "91ba9e50-e258-4424-85ec-be273b94ff8b", "value": "T11CA54A0BAC9645FAC4ADA3318CB69192BB70FC480B3123D32EA1B6742F767D05E79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776227920, "uuid": "b614775e-0485-4360-b329-3cf7b091e1a5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776227920, "uuid": "418e3f85-6342-42ad-bc8e-223ea3670367", "value": "49152:Sc1p2GGGphm0P/zRbNCw0Fyo9tc328WWrUaHR2X8Fp:S4YZKoaHR22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776227920, "uuid": "edc89f1a-a939-4250-9f77-713efe66da66", "value": 2224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776227920, "uuid": "e40c5e11-8baf-49d6-8ce8-5ebfab8e8aff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776227920, "uuid": "683e5c56-e8b0-48bc-ac8c-470d7b4cdeb3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a293fcc5-38a6-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1776242376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242376, "uuid": "40bef5c1-fe13-49bc-bccf-ea2504a56544", "comment": "Malware payload (SalatStealer)", "value": "01b7d5fffb651c50cce6e8678ca7ffe8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242376, "uuid": "4c4996df-ac8e-4d9f-8a04-8bb51037ab08", "comment": "Malware payload (SalatStealer)", "value": "104a6e20357893b7b18baf722e6828c4a874137a0034435f078100ab65c21bef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242376, "uuid": "849402e1-c314-4b6c-998b-604723f7de95", "comment": "Malware payload (SalatStealer)", "value": "e8c802129d626243950f81f31ef210b63516a340", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242376, "uuid": "e5b1585a-9794-45ea-9523-a68272108258", "comment": "Malware payload (SalatStealer)", "value": "11d0b64c783d880c8c8cc75301b5d7c8ae26ae5e28e013cdd1424de46a407eccd386e955ee27ff017c33af75ffd660d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242376, "uuid": "f2c1a0f1-3d15-41c0-b1dd-eea5a3a64846", "value": "T1B0F53315102D2CB7DE5A74B0AB3D309761A62CC557EFB64B41FC9274FB878AC9093E12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242376, "uuid": "dff3a234-ec07-48d9-b2b7-3acc0169af85", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242376, "uuid": "4fb9aac7-0913-4854-9b27-c9c7407df5f7", "value": "98304:KZpouXq6TmBi9vpVIFjqkka/O47REQ36ZpKZbCjdskTIk:Kj9TGi9vp2KKRLQMpYYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776242376, "uuid": "1fc95f05-472f-4582-87f8-b9c28e502569", "value": 3546112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776242376, "uuid": "ab40e42a-b152-4664-bcc4-46d57a14f565", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242376, "uuid": "345232fe-56ee-434c-8d3e-44ec43da1224", "value": "SecuriteInfo.com.Trojan.PWS.Salat.389.18514.14972", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bd55d57-3881-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776226313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776226313, "uuid": "49917189-3c9e-428c-a447-85c75452f430", "comment": "Malware payload (Mirai)", "value": "d1891d8b0ce656c66ab86f3d25954451", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776226313, "uuid": "07f0902d-cbd7-4e93-a29c-ca7ab353013b", "comment": "Malware payload (Mirai)", "value": "11fff7d4c7e60460c9f27211964df7dca64b318fec736298cac7342fefe464ef", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776226313, "uuid": "304786ce-c0da-4475-93fb-50fb2d168f57", "comment": "Malware payload (Mirai)", "value": "9adc64a40f047d55c8f0742cbb9162841b185838", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776226313, "uuid": "74816ef4-1ad2-4532-8437-06865242af02", "comment": "Malware payload (Mirai)", "value": "056b9c55e2596adcce4b8b9b44f7cb293d5f937c6fe1190cbc7cbe4dfe9c05d3d7a854cfb66de5a9ecfb327b47a02863", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776226313, "uuid": "fe1125a7-40f0-4e53-b193-6030a4eaa75c", "value": "T17041878947F4238EF1C48E07FC998D756196A4A016BC5A00E0740DF2E3BF887B6F5567", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776226313, "uuid": "5cf6879c-1eec-4738-8df6-80b5c3b09201", "value": "24:fvpbEGELH2kEkECv+cE6mfvvVE36v+cE6F1RFvgRTgRBEgR/zgRiIvW4WKEWkWZm:RXIH7ytnB1A+rbdUteO0lZ1o9H0fmI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776226313, "uuid": "98e08742-308e-45bd-8aac-4c39b6a8e5d6", "value": 2160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776226313, "uuid": "f3b1c2b3-e40b-4c38-a605-b05a77f65633", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776226313, "uuid": "901c2e45-9d35-4642-8e55-46dfb8aab61e", "value": "Sassy-Cats.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649a5c1e-38c7-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776256446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776256446, "uuid": "4c2c8b9b-85ff-48d2-b6a9-fb3c2f6d9206", "comment": "Malware payload (NetSupport)", "value": "e0f0b293cc67e04d948ec6a50c26fd5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776256446, "uuid": "9d2e2e0f-9388-47fa-8b65-2387da7d556e", "comment": "Malware payload (NetSupport)", "value": "1255530b25af66b3cf0723ef98718fd940f33d42b8f350511249bda0c8f77313", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776256446, "uuid": "e2d9e475-ad9b-4b5e-963c-6830c1d4f775", "comment": "Malware payload (NetSupport)", "value": "acf4e42dd7229a62a4f404200e87af30567b33db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776256446, "uuid": "ce55e16a-ba0b-44c5-9155-228b7b73d89f", "comment": "Malware payload (NetSupport)", "value": "fbf258706c857cdd447b53e248b7c5e494f605a7b0363436089096dabe14788f40a52747b902818d08bf79beb91ab0fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776256446, "uuid": "31fc9337-e081-4034-b896-fe9c4dabf210", "value": "T13FF55B0BECBD4CE9C4A5E1748433A5527E6478401B3263E72BE0B3682E777F0A975B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776256446, "uuid": "e41f44c5-2dd1-4cf0-a22a-836f7b70b46a", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776256446, "uuid": "73819e80-07d3-4afb-93e0-4f2a72f9fab3", "value": "49152:GbBsvqVufGsDobdmAKdeN8nIcGsqrj+lOxl0TQclLjKzj:Gds3P6mlPIklOxl08Wu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776256446, "uuid": "72a5df66-a8f2-4104-973f-791b2e17c7ec", "value": 3472824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776256446, "uuid": "beb8176b-7dad-470c-9c99-b7711d96bfad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776256446, "uuid": "52593c71-c066-41f3-b9c4-3a6b7f46cff9", "value": "SecuriteInfo.com.Variant.Ulise.596178.3880.22699", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc8f6a5-38ae-11f1-a769-42010a9c0008", "comment": "Malware payload (PureCrypter)", "timestamp": 1776245727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245727, "uuid": "4199d8e7-7634-4bfb-b798-d71956417347", "comment": "Malware payload (PureCrypter)", "value": "0756ac5b9e8d3502bca2892c1e110269", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245727, "uuid": "e1949018-ae27-4105-bad2-271f96bdab73", "comment": "Malware payload (PureCrypter)", "value": "128c8ef96e6e9ff4d2727b23f68cfc66fb089777de37965c153cde889f1cd7ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245727, "uuid": "b9ea8a2d-7ca2-4855-9fd2-297843f24a49", "comment": "Malware payload (PureCrypter)", "value": "cb267260fb1941876a30247227cb62f468ed6e75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245727, "uuid": "58349a53-8c9a-4a0e-b686-89fb66614cbb", "comment": "Malware payload (PureCrypter)", "value": "95c8601fc237d482edd30684cc6b5f69545eeb9a5edd9b463e5ed3c69819fb44a6333893016adbc697f337bad7597c33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245727, "uuid": "339b62fb-0e8d-44c5-becf-416625a139bd", "value": "T1EEC33B70D78CC793C5BD5AB95472520003F5EDAAA812FB5B5C98B4E96C333861A3326F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245727, "uuid": "ef718464-31a4-441b-9fff-6f9a59ef9ed6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245727, "uuid": "70e16f51-17d2-49de-91a3-f352df697eca", "value": "3072:ssKxGH0zQTfotl/bMEZH1TLGWjzCiu1L7pw/iqWMuc0n7N5N7nSY0MCEXlH9XykK:ssKxGH0zQTfotl/b/TQiIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776245727, "uuid": "b310bcff-ceeb-4efe-951e-a3801ca884f5", "value": 119296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776245727, "uuid": "d5268f4a-6ff8-4c15-a3cc-724c83c76541", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245727, "uuid": "e944d9c9-a75f-4a8d-b8f1-d286f062fd5b", "value": "SecuriteInfo.com.Trojan.DownLoaderNET.1163.22154.27689", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "713d6b50-38ec-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776272358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776272358, "uuid": "a7332466-ebed-4efb-8337-27920fbc08fa", "comment": "Malware payload (WeedHack)", "value": "d10a619145bfd62a5f65584b4cbcd033", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776272358, "uuid": "ed9e3d53-e810-4212-a665-bbbe9259f7d3", "comment": "Malware payload (WeedHack)", "value": "14118a6070f89baafd5f2aeaf2df7535a8053f99944453584f0d1efeb6501ac3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776272358, "uuid": "ee2dddb6-f888-4124-b4fa-4f979dccaaaf", "comment": "Malware payload (WeedHack)", "value": "984176e90d1358ae9bd5147de4357db2110f6e4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776272358, "uuid": "6b5ea8bb-67f0-436a-81e7-59df3203be1d", "comment": "Malware payload (WeedHack)", "value": "69377ac54a058f3a4911bd80c4ec8c9fb5808b1825462da7f0ebbb6ee80731337017e7f87e0b0ff857b12822d2b2bb3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776272358, "uuid": "22ee5e90-121d-4631-afed-618a1c47c881", "value": "T17284E0433AC45B12C1A44979D4F764300BE3F087B6BBD7492E99578A1E127FD8E4AF88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776272358, "uuid": "99360e3a-6087-4a2b-b1e6-25e737ebccd2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776272358, "uuid": "c35e9eb9-8ae4-42d5-9756-89e1d9dec6b6", "value": "12288:N7UIuQDloSZh93j+6lwxzr/W11xFVc6By:2IxoQhtj+mazr/Ixzc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776272358, "uuid": "1dab6f16-029b-44b1-b332-458f8ceb6adb", "value": 396288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776272358, "uuid": "06bafb1b-9663-4c05-8cdc-0db34fd97deb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776272358, "uuid": "33fc9c3d-65f8-4f76-8a53-095802d9ca87", "value": "Pjibf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc72bb11-3889-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776229964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776229964, "uuid": "24445a9a-e55d-48de-8fb8-10083e3b4d3c", "comment": "Malware payload", "value": "f5d5cdc2dd40e821a6c6a1d6e16b1b1a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776229964, "uuid": "75879a27-ab1e-40a5-965a-df92b2766fc9", "comment": "Malware payload", "value": "146b367de6aed9258e89358d08c2aa77770bf79e8eed1c0e30b8435117ad6b86", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776229964, "uuid": "e73cbdc3-0fcf-4c74-92f4-66a4aada9601", "comment": "Malware payload", "value": "4c2fa6c3995b910b32fbb64dd2ef8634fc0176b6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776229964, "uuid": "07a04000-9ca0-4303-a28a-c7f925120b0e", "comment": "Malware payload", "value": "7969f3b6fa84a7f7ca9fdb57f5c1943744ab34b6e9dc32a8ef3fab00aa2dc23018d4da1b0777f3d151bf1b3209ec4649", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776229964, "uuid": "c9df1ec4-280d-40a1-a013-bdb56704a74d", "value": "T193137D6966857C24AE99883B1C7E2F0CB9A983E1310451DDBFCB3CF58C49B9CE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776229964, "uuid": "9ed5ee58-c75c-4c3e-98c7-ccc3228c1e25", "value": "768:bV+19GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bV+mco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776229964, "uuid": "9e573371-8c96-4916-9546-eb334584d2c7", "value": 45518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776229964, "uuid": "aaf1e170-9e72-4833-8f90-6214cfe6177d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776229964, "uuid": "19e1f6c3-a87f-4dba-8191-22ecd118087f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d9b5085-38e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776268111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776268111, "uuid": "4555b107-4a22-46eb-9335-6f948c4e9982", "comment": "Malware payload", "value": "01737d88581d76b0332104ad7f07a66b", "object_relation": "md5", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776268111, "uuid": "ff173c53-b2ba-4858-996b-72a105cc7f57", "comment": "Malware payload", "value": "1486ea9dac80ac5155e8ba011e577834043118f2079e586dca7ae3d7e5b738fd", "object_relation": "sha256", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776268111, "uuid": "78ee6f67-d8d0-41aa-993a-84443c19d306", "comment": "Malware payload", "value": "13419ec18bf363ab6ee39774707af42dbc32549f", "object_relation": "sha1", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776268111, "uuid": "3919d841-0d2c-427e-8390-68cf58c9de9f", "comment": "Malware payload", "value": "d7065ae23a0362dbe0d7e3ba4fb11f4595f6e05e0d541144af2a6f5cf582eac1e0e84fb0858f443bd9b785c5503553cb", "object_relation": "sha3-384", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776268111, "uuid": "0e773515-62f9-49fc-87ab-65419acb2338", "value": "T1A7B6333B0985EC9BC66552B7AC369406D810ED728F057366F91F0EF990BA5AEC7F0630", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776268111, "uuid": "8d85ed3f-42d1-4b5a-8d5f-21137235b61d", "value": "73fd795305ba2cea7522dfea1b76c92e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776268111, "uuid": "b725b376-a0d3-45fd-9299-a6e483422401", "value": "196608:7OJ+FAuoozI80BaT0k7XJiPTB6teOX+kSyZp8Nroo+ssNmaj8+4sut1rVPxL8S89:y0noWI80Ba37ZGTB0eoZZp8NEo+bNljJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776268111, "uuid": "772d7660-b286-4623-b5a3-d92d901c32b7", "value": 11325456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776268111, "uuid": "cbb7b33d-2b1b-4475-a8e0-09c433d3f23e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776268111, "uuid": "d770ac9b-3da2-481a-a916-0afa2ded2cb8", "value": "webview.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1206800a-38a6-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1776242134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242134, "uuid": "11c69b83-46e3-47bf-83bb-17d515a6d795", "comment": "Malware payload (SalatStealer)", "value": "71747cfe72b9614b018c800ea6c9ef1f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242134, "uuid": "3b64c94f-728b-428e-a789-dde1f595f6cd", "comment": "Malware payload (SalatStealer)", "value": "154b7e0a5540460c1c06d755a34403adf5e44a80ec840c9bd37416f8d0eab91c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242134, "uuid": "09be5810-329c-4f13-9923-5eda65c5d3ea", "comment": "Malware payload (SalatStealer)", "value": "6e3e6b699e3ce3384f4d1791f7375aac1d05c3a9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242134, "uuid": "a2703d74-7abc-4579-bb12-a48f052ceb15", "comment": "Malware payload (SalatStealer)", "value": "8fdbe6af88c0c55972e307eb9075283206b166c1a09101bcb1f250514ed68b25ce01e6bca52305abc54bf6f352f2c2c5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242134, "uuid": "c79629a6-b7c4-47ab-988a-ae484293eb2b", "value": "T13E863388E9932D79C5FA41B1149FB37ED3B11E06480A9DF7DFA55CA2BE3A3011E18706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242134, "uuid": "98e2c338-3c93-420b-81d2-b06f0bfbd447", "value": "538eb3298e8e105e35151c037ea931ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242134, "uuid": "7a0c5df4-1c04-41b6-bc86-4526ecf904d4", "value": "196608:KuaP5c2TdbUreBTsNXsp/klcwfhYFNAu9ZxVs/8ci2bppeNBWq1:7aPbTdbtBgN0YhcAu9DSiopsNBh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776242134, "uuid": "15a6c4ec-4bf7-4173-b509-5f1fce2426bf", "value": 8444928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776242134, "uuid": "8881aff5-8801-49dd-baa7-d47c25629977", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242134, "uuid": "307df117-5be0-4d9c-ae79-fc751addceb2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e599bc79-390b-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776285868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776285868, "uuid": "b7138560-5fda-452a-929f-358d029b7202", "comment": "Malware payload (AsyncRAT)", "value": "7ee0293386a80aeb3a80dcc68d8c7239", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776285868, "uuid": "eeffd5ae-ad4f-4d58-bf37-e83a539cc3c4", "comment": "Malware payload (AsyncRAT)", "value": "15928163a98a3e4e0360472563fff515a93a5eeb1135363e649fe1188dc93d34", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776285868, "uuid": "bbfa72cc-ae65-4c6a-b141-6a81adab441c", "comment": "Malware payload (AsyncRAT)", "value": "ba357ad4a4adb58f42cc81f00f6c9b4f2ec3b329", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776285868, "uuid": "97ec4cd0-920b-4ef0-9e14-d0c50f9683f0", "comment": "Malware payload (AsyncRAT)", "value": "afb441b4404a48d037c701f7b2578c9c7a88cae9ad6e345c968c8e0fa7fc66a859d20dbc3875ad378786b006d1bbc8db", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776285868, "uuid": "294431e2-8a11-48d7-90b4-8e0f43bbb1fb", "value": "T16776330C8C4C6C45EDC64EB52AA62F79A4111FEB50B4657C309AB69EF1F188AB73D370", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776285868, "uuid": "68e21df3-0aad-4681-b2cc-a0531f5078d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776285868, "uuid": "d39c84e9-a4fd-40a3-adfb-73f7f4020dc6", "value": "196608:1v3K+q1QAg9d7d/xJqGVNb+SAhohw7i3xAVPvyl:JK1Qb99d5JqGbb1RqgxAQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776285868, "uuid": "8d02353c-af3f-4837-afcf-c11b6043f900", "value": 7291904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776285868, "uuid": "5f16f8aa-33cc-4705-98bd-5e7634c0daab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776285868, "uuid": "f2a36bb5-900f-4edc-b923-99e5c2be79cf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "441f2d17-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776239641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239641, "uuid": "b8725c57-6abe-4ef4-8b4c-9dba4ee5bb18", "comment": "Malware payload (AgentTesla)", "value": "4e8b8cc09c0695186359a9a2d968e6f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239641, "uuid": "46ea3909-edb6-4ff8-858f-dde76259f686", "comment": "Malware payload (AgentTesla)", "value": "1598957a65b6264bafdc2e90f3c350a9d73c7cd5a2e2607fae83fc3471926b41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239641, "uuid": "c7c53768-668c-41d6-90a6-7fe1f52b5132", "comment": "Malware payload (AgentTesla)", "value": "d9b7be766655cf506808e0f78c1a85ea9f6e96c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239641, "uuid": "095ee3bb-c0fb-4435-b14d-ae8164baaa3e", "comment": "Malware payload (AgentTesla)", "value": "ff07dd5f572f15a2810e8429eeb31be17d6248fb63ac86fc298638d4f528310ac095aae274eba6e6a954d0f665ef08d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239641, "uuid": "95fb9d4b-9a15-4e76-b6b2-aff8be00aa6b", "value": "T1C68286158E05DFF00A3D36A1659B781AA9100372B5392C4D7D8FC5AD3F3AA60CBE15EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239641, "uuid": "63c9758b-7ca5-4130-adf5-f1fee74ca61f", "value": "384:Ka8Zi+zfatTiAX9g7Mm7o/QCnoMhTGwoBkIYw6wwwlGeJn7dn:Ka8Zi+stuE6yqyIYEXGCBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239641, "uuid": "52e9e3d8-415b-4036-b759-ffb2df718e88", "value": 18317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239641, "uuid": "7844b13f-31b8-45e0-8d2e-2c34d3f8a5c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239641, "uuid": "5b78932b-a447-40bf-8659-c605741a77a8", "value": "XL-83635.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c26e2fc-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776239547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239547, "uuid": "ae5092e1-68b0-4678-b37e-e33ed33c39d0", "comment": "Malware payload (AgentTesla)", "value": "b7ccb4e14d7b0a07240f281d04904c0b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239547, "uuid": "bdec09bf-a119-4782-83af-43a360df6301", "comment": "Malware payload (AgentTesla)", "value": "16f765586b9c9e5114601c4f4883bbf7f259f8b8e811b7099a8d907a056fc311", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239547, "uuid": "08b5f2f1-5876-4aad-8f6a-56c3593e024f", "comment": "Malware payload (AgentTesla)", "value": "4741e7859e63056170c0794edf0e4a0c22be7ca4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239547, "uuid": "bbb9447b-f4fe-4dad-aca5-2866eab725e6", "comment": "Malware payload (AgentTesla)", "value": "00858217058fd009ae9ec50d1bd074e0e98b1a3224c252fc5b43a1c4f5232717184e459dc58c1cd3d197d0e0597f6c7e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239547, "uuid": "386d8460-2522-467d-a30f-fca5b54ba38e", "value": "T15884F19871C87EE9CB6535261CBB2109F2B5CCC160489949EFA2BD4FFE71F04902A5BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239547, "uuid": "c344b73e-17f1-42a5-9a6a-3bfc585be09c", "value": "6144:By3ykknqNd0lmg658m0qBYtpus4p9+pboTFJTaR/dEwC2Yis6e1CINs6BT57YM:fqNdqmgAYVe9YoTX+pdDC2VUBT57YM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239547, "uuid": "e04bbdc5-a7c4-451f-a6b5-242c6152fdfc", "value": 393680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239547, "uuid": "52a05da8-a874-41aa-989d-052da29074df", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239547, "uuid": "9fe0a3d4-c1a9-4966-94fd-4dd7cfc4ec07", "value": "e-dekont.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c850d20-3912-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776288725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288725, "uuid": "007ecd91-3cb7-4a0e-a25e-3e4d042617ee", "comment": "Malware payload (Mirai)", "value": "96cf9e5db325977a182f2cabb733ca21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288725, "uuid": "81e0d420-753f-49dd-8eec-796d9aeade67", "comment": "Malware payload (Mirai)", "value": "173af8c8680cdf956849932df46300f3aee391bcc5aca2610fbb4e909f7a71e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288725, "uuid": "dd151daf-eb0f-44a3-952d-bdbcabc23d4f", "comment": "Malware payload (Mirai)", "value": "6f3722ee1cbdb34ec0f20aaca485bc2969d02c56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288725, "uuid": "7ce2834e-facb-478b-a88d-c1f5c87ff558", "comment": "Malware payload (Mirai)", "value": "3d1ee3e6d3ba9ad33af30155bdc0436ffa35b36f932dd7d765993fb4f9e7841ceb1f2dd7ab183e05ff986c816f0941c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288725, "uuid": "1869a66e-1893-4e80-9728-e72a8be77b12", "value": "T151938D02CDB4ACA8F07AAD7110B5DDBA4727F505A91BACFB3C46C2511047B94F5AABF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288725, "uuid": "f70081ee-997d-43b8-b01e-dc43db68bf16", "value": "1536:DXB45JRnEw+NFeu6vc333ggNfNm6c9+qdwh9Y743v2CTtA/P1nCb+R:DXBeJ/+NFeXv03ggRN3GFU3v2YtU9nC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776288725, "uuid": "baa5081b-37d8-42b1-a754-b79c3d65fd4b", "value": 93628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776288725, "uuid": "07aa152b-8a42-4c9a-b8ba-a098003fbaa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288725, "uuid": "813eb32b-66ce-4081-b77b-60c903dce5a4", "value": "splsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d750c48-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776239737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239737, "uuid": "0897e4dc-4eb0-4ad7-b0fd-3352fa32168c", "comment": "Malware payload", "value": "94e028635c11df124add0764868d0f52", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239737, "uuid": "46fc9191-d855-44a9-9cfb-473f6405b382", "comment": "Malware payload", "value": "1772fd3b338fec1770b1dec4c254dacd701b4ed16d635d8ea70511135c8d09e1", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239737, "uuid": "f77459b4-4708-4d0f-8f51-aa246c64d5b7", "comment": "Malware payload", "value": "a0615012c4dc0eae5dfceae009938cf039ab3f76", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239737, "uuid": "eeb03f6e-b6a4-4f7c-a2b8-f165cb3ddf24", "comment": "Malware payload", "value": "db880e6295f8bc16ac15e6086cb919ecc4ef59d52f8b940be90c3a88c8f1a27226b870bfadcc2eb4d252ed68842b8192", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239737, "uuid": "825a3d72-8ada-46a9-b07f-73679c6b7ec0", "value": "T165245A3223FA8611F2BAAD088570625A356F7EF33F47A41C61AC19CE5BF176096E4347", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239737, "uuid": "9c0f3fc4-0f5c-43e5-98e6-f00bab60db6c", "value": "6144:DlddjILmoyoym8jia2XzNHKIvYG8Suef/7gVZ:DbKLGoym8GaCBKIvYG8SueuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239737, "uuid": "7d4f9667-add3-445c-ad62-2d319bb30244", "value": 225066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239737, "uuid": "4b084d21-cc62-4bf6-b447-efdc269f1fae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239737, "uuid": "e420cd58-9552-42d1-92e0-98b0a19d52ef", "value": "Product lists.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef7a9a7-38ae-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776245753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245753, "uuid": "52179604-5692-4160-b3ec-3842855a4aa7", "comment": "Malware payload (NetSupport)", "value": "025d037f4a1a1c3dce38da7c0e887fa3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245753, "uuid": "b1a1f6b5-3f6f-4b3f-89a5-92aa0a9e8010", "comment": "Malware payload (NetSupport)", "value": "179b989b1eead7bf8d7090049ec976a3784dcddbd3b4023de8fe01be54fc8064", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245753, "uuid": "56e15255-56af-4829-83e5-7379d89b35a2", "comment": "Malware payload (NetSupport)", "value": "a4a829aded49b108dcbfed6907438d0eaefae158", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245753, "uuid": "4a7e0cb9-559b-4be0-abe4-a1283d0875e6", "comment": "Malware payload (NetSupport)", "value": "7019716954bce480f0f8b8eea183c3cb64e56b6172a8133309a1a9048baad4bc95c8dd070c796d8cd226003fe776a2f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245753, "uuid": "a4876c6e-b239-4f9c-80e3-2627f129ba65", "value": "T169064A07ECB94CF9C499A6748473A216BE607C402B3163D76AD0F6682F337F0A979B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245753, "uuid": "da44437d-89ca-4abf-a93f-e7e1ce1a60af", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245753, "uuid": "bb5f3aae-d80a-4a66-9c41-612cd8419ee7", "value": "49152:QkwI6wq0LtGfCS2jf2TGvmsMn6SNmAjMQcE+FYste2cX:Q4k/seb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776245753, "uuid": "05b96ebf-07e6-46d1-807d-abba73963972", "value": 4002272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776245753, "uuid": "1b4fe6b2-188c-44f6-8dcb-bb5e1008f14e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245753, "uuid": "33a6b872-007d-428c-a0f0-31543f41b9cc", "value": "SecuriteInfo.com.FileRepMalware.21398515", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e002b2-38be-11f1-a769-42010a9c0008", "comment": "Malware payload (CobaltStrike)", "timestamp": 1776252767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252767, "uuid": "5c98c879-92be-455e-a1bc-70e28a7bc53e", "comment": "Malware payload (CobaltStrike)", "value": "471bcb6c43fa97ede55e4a5d1c38f4f3", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252767, "uuid": "aca9df9f-d9b1-4563-880d-aabb864bfc81", "comment": "Malware payload (CobaltStrike)", "value": "179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252767, "uuid": "646889d2-d6e2-4d9f-ad95-46efa0c67a90", "comment": "Malware payload (CobaltStrike)", "value": "e7e3f71efd74c7b3017184f1ca134d44742a6d7d", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252767, "uuid": "69b70908-41b5-4803-a80b-1b6aa23899d8", "comment": "Malware payload (CobaltStrike)", "value": "39a55388c67a8354afae715905dbdc53aed3228cdccd17988fa4ea60e584f6c4fe5e0dea70a50b435e35cca6d133bd5f", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252767, "uuid": "4d8c0b1c-4f6b-4667-9534-577cd66fe9b9", "value": "T152459E52FB82F0F1EAC602B251FF6BF65C283B19872994D7A1D01D995D201D33B3EA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252767, "uuid": "3bf24d35-9644-4f84-90e6-df07babefb86", "value": "9538fc851a72468837432fabd2e04769", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252767, "uuid": "ecf461e6-f0fe-44ee-a947-466eabcb2d04", "value": "24576:9GeCIqoPLPC/fRBJjvXw1Fc9ZS/ri0fXHQ9PjQl8NIfydnr:8eXqoP2XFTX/8wijfydr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776252767, "uuid": "3ca718cd-4046-435d-b8d5-4a0f957c14cf", "value": 1213992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776252767, "uuid": "947fd7f5-0807-48b6-8821-843d8fa05cde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252767, "uuid": "b1931c50-ce39-461a-86e1-6b59d014e3bc", "value": "179dcccf0614360e520b8c450bcda367884251d0daac46583af68a4182b855f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d34607f-38b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776250447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776250447, "uuid": "580cf3f5-365b-4c2e-ab71-391d9d0152a2", "comment": "Malware payload (Mirai)", "value": "4d8d90cf39fbb94c9537add6dcd8d0f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776250447, "uuid": "3f4ccdca-bc20-435a-aeb9-877276e88421", "comment": "Malware payload (Mirai)", "value": "1896769158b3e9d6b9c64587bf1d4549304091a241646c1361324480fe49ae02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776250447, "uuid": "1a03a4a4-7897-4f22-9756-d3d91e2374f4", "comment": "Malware payload (Mirai)", "value": "304a435ac7b20afcb47da5416858a5c6ba4f650d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776250447, "uuid": "abce6ca1-92cf-4fc7-84b9-ef398c746e03", "comment": "Malware payload (Mirai)", "value": "7009e7b83d93f6ab36c3651696bf1ee8d03a1e62b7d9e2f489c96541ba6ef2ec0f0ea94f1bf83d38443acb631645dc8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776250447, "uuid": "b885999d-3420-4f22-a997-376136639b5a", "value": "T174143B45F8818F26C6D412BEFE1D018E33272BB8E1DE72129D205F65778B96B0E7B506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776250447, "uuid": "e9f3f1b7-d519-499d-8df4-2e1fa3e75922", "value": "3072:Bxld3W5IAC8t3zi3eRzhKVC4UhVSH3X5MaPlambCp4u63DJ0/Gxoohps:BxlQZtjBhQ2o3X2a9aNI3D6GxFTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776250447, "uuid": "63e42943-41a0-4bb0-934b-1c8313aebae2", "value": 207676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776250447, "uuid": "6f7e32c0-644b-4e94-a883-3aaf9263ec70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776250447, "uuid": "8cbfe1e9-9a5f-443d-ad18-b324bbca8c03", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72bd674d-3912-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776288682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288682, "uuid": "d9e6551c-f7ac-4ae9-9007-6d7d7dc650db", "comment": "Malware payload (Mirai)", "value": "eb228215f89f19ec95baffb7f2aac664", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288682, "uuid": "dc4f48d4-9dbd-41cb-9f49-19e21a382b28", "comment": "Malware payload (Mirai)", "value": "18b6f291240a98103a3a4dd12ae63202b3d009fab5d5f49fb90deac0b495c77b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288682, "uuid": "b0429631-e767-4a65-b472-53661e17f1a3", "comment": "Malware payload (Mirai)", "value": "d4fd80364be23bf43b25136180295c50dada2424", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288682, "uuid": "69655d0d-7094-4e07-93d6-d75f00619e1f", "comment": "Malware payload (Mirai)", "value": "90fe918ea58746299c4fa2163140df2b6473b51213a82e9ade220a3518d296b0328e2abaeb0b63b010913a073de17cc2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288682, "uuid": "ba187482-ed77-4bb2-8206-e0e192cf055e", "value": "T13A835BC49213DCF2ED084235217BF3336536E9B90078FEE3FB5556B29415AA4B28B64E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288682, "uuid": "e20f617a-844a-4a7e-8eda-465218a0d8af", "value": "1536:ZrS+mh9rsJ9EVmbN8Fajugn34vi2d/UgXhA06t6XB6h9fHLw4p40F1kYhdSWyQR:Ze+GlYqsbNUFdvXsgXe06t6XBcfHL9Vx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776288682, "uuid": "0feea535-18f1-4cfd-9fde-841e839d6fd4", "value": 88304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776288682, "uuid": "61ff1e15-d5a7-4cba-8ed5-1016836328b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288682, "uuid": "5a65cd11-1ab9-477f-a9a5-7a5153761652", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ad65fa-3894-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776234620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234620, "uuid": "9a8331d5-ad85-4711-b10f-6e12a2e7e77f", "comment": "Malware payload", "value": "1e9f934b9153635e6c94d4d67fce41fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234620, "uuid": "28978d32-24c0-4728-991a-f25f54bb15ea", "comment": "Malware payload", "value": "1a27c447e6c9a49ad22661a5c39b4f7dd5ba5f0c647c78f80c5564e00cf294d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234620, "uuid": "d14d5519-73aa-49d1-83f6-c858e1264461", "comment": "Malware payload", "value": "4068ea44ded8bae9241154b796de17deaae96620", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234620, "uuid": "57281955-018c-4604-847b-8c99711fbf8e", "comment": "Malware payload", "value": "f17ae03282a498f8ff8fd89e24dae74fdb936b9507a47205024a6202e370a7856d99b4446296b6294578f22abbad0ec7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776234620, "uuid": "41866100-af86-439d-8e30-843a86b7b5eb", "value": "T15A464A47FC9545E9C0AED2348A628263BA727C495B3023D37F50F7682F76BD0AA79704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776234620, "uuid": "3afe80a3-9859-4538-8ad0-c6ef8856c79d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776234620, "uuid": "1575e225-7d57-44c6-9df7-e29d8adc6085", "value": "49152:dQZphQVGszEBNELqVIbXfe3D4BNGMf+5EmxSmVp+XreMhd:XVl2RD4B+EqYXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776234620, "uuid": "61b332c3-0954-4b28-b4a3-917e4b179c7d", "value": 5423104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776234620, "uuid": "ee9fb0e7-df38-4ff7-8707-87444b2fe0e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776234620, "uuid": "100c3fde-c7df-4670-94ec-0073e0d68107", "value": "1e9f934b9153635e6c94d4d67fce41fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f61044-38ce-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1776259510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259510, "uuid": "402d87b5-7acd-4a45-9b7f-95b373d1a36b", "comment": "Malware payload (DonutLoader)", "value": "141e75dce7a34b3dc72c2930f78b89da", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259510, "uuid": "2754aee0-e422-42f3-b095-f03385c14ce1", "comment": "Malware payload (DonutLoader)", "value": "1b5e3ca2e7315340690614af58d442221e3a00f451c6f206f053773ddf80c72b", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259510, "uuid": "f4294ae0-7701-4684-b600-2a7a715c2de0", "comment": "Malware payload (DonutLoader)", "value": "97ce8400ccbcfb3a84c8212ea1c3edb55c6757e3", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259510, "uuid": "04af99fd-d5ff-4bfa-893e-f1a6678eba03", "comment": "Malware payload (DonutLoader)", "value": "837eabd926ccbe781ebb8b4b06ff920150fff760e1177cd0c8201901e7d6aa0f3bdbf046669ab9852bcd03ef74b2bf9e", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259510, "uuid": "6152282a-d895-45ad-8ef5-68271b102eaf", "value": "T147667214C27CF62E78EECB2ED02AA670984E345B1A4CDE5E306F816C1D92F6351594EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259510, "uuid": "749e7fdf-c307-4fce-adb5-03272df16f0d", "value": "98304:VWFcTjAEXSIAIVl56b5YfUanseDAaxC+H18pTk4eXOqSYUJxR+:MGtAIT56+f6eK+H18NDHYUPQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259510, "uuid": "c243eb53-a0a5-48b1-a374-c0b4d03d1915", "value": 6800646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259510, "uuid": "ad36b835-a546-4511-bb27-b7843885e402", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259510, "uuid": "d12d0304-b201-4d34-9c0a-95966c08d90b", "value": "Doc0010005239.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "769e466d-3894-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776234572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234572, "uuid": "4176c103-7e88-4049-9c85-4838292cfa62", "comment": "Malware payload", "value": "9c6c01f60725e63ad7b989186e06b588", "object_relation": "md5", "Tag": [ { "name": "Dienstangebot-Klement", "colour": "#522A09", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234572, "uuid": "7b46e201-ec8e-4f86-934b-567977dddd28", "comment": "Malware payload", "value": "1eba35c9e02246b59aedd4e9b822e2485ccc593bfe67eb714d0cac0bc08bd266", "object_relation": "sha256", "Tag": [ { "name": "Dienstangebot-Klement", "colour": "#522A09", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234572, "uuid": "744aa7a0-93ee-472d-84a2-a18e95cdbd62", "comment": "Malware payload", "value": "83a9b0eba73c86af8431ef7844611c6adc097659", "object_relation": "sha1", "Tag": [ { "name": "Dienstangebot-Klement", "colour": "#522A09", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234572, "uuid": "259dbb09-9ae6-41fc-a45d-1c19a17a63bf", "comment": "Malware payload", "value": "3fe062ef7cb673e4ed26deccd803f6c45766d857cd2fc6b44dbd5f9aef0c811778b1b1ce4e3746673a20f1f6dcb7a6e3", "object_relation": "sha3-384", "Tag": [ { "name": "Dienstangebot-Klement", "colour": "#522A09", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776234572, "uuid": "f0d3ad3c-0e99-45b4-9551-ebb59e79adf8", "value": "T14931AA6315BA05BFDADE30B3D0D24601D4C26EAC40266710F4F8677E454000F6D97DF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776234572, "uuid": "280716b0-556e-4066-949b-90a5ae027614", "value": "48:lSdEC+eKIeea05F/yDRTSpRVavH6CVee8F8qint:lt9R4MuHVwH6CVe9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776234572, "uuid": "7c8a0202-519e-4e6a-96fd-f3bba33707ef", "value": 1618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776234572, "uuid": "0c4300ab-cb61-47aa-a110-544887dc28eb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776234572, "uuid": "9db60a6c-e66f-472b-83c0-c7f6555bdfec", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "471dce36-38ce-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776259403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259403, "uuid": "6a884d3c-dffd-4eca-985b-cc3f3fb8be00", "comment": "Malware payload (PureHVNC)", "value": "4a5c32ec568199de0542f8c44d7849d1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259403, "uuid": "292c5e1c-2514-484d-9ded-7cde1d37ecb0", "comment": "Malware payload (PureHVNC)", "value": "1f09085d69f59c49d58ac2223dfb09a5b3f33d76fee6a77c99e342c1d0d6a4e8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259403, "uuid": "5f09b3d8-2acf-4dca-ae19-b95c3328751c", "comment": "Malware payload (PureHVNC)", "value": "69c182b1bd7aeb48e74e0395f47fbed1843a062f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259403, "uuid": "a7fdd2a1-afa0-4673-b77d-4c1134af79bb", "comment": "Malware payload (PureHVNC)", "value": "5dae7ca0424aef2bd01424302d5ff1fa4dbd94ea519daf88d77cabaa58e6a68510e187aa4a1813ce491a8734b4c556a5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259403, "uuid": "3a0582f9-d05c-4076-b7b0-e45298bb063e", "value": "T101643038ADEA001AB1B3EF54AEE47497E96FBB73370E985C1081034A4723945EDD563E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259403, "uuid": "f78d0c6f-14cd-4e02-8800-8c1ea028c6cd", "value": "6144:ZJQh0fXnrzbAB1N2e9CGu8Uje98laou46P4em9dEC:ZJ/fXrzbAB1N2HGulojoxVecdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259403, "uuid": "1f06ff3b-d171-423d-9228-ccd1116b714a", "value": 312212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259403, "uuid": "c5f0fe50-8bcc-4b21-af89-405d78f0002b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259403, "uuid": "9c1867b1-dc95-4a59-bbe9-907d12e9e163", "value": "NEW ORDER--GO23B00526.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67417214-38f0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776274060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274060, "uuid": "72588c07-96e3-4083-87e2-31b0d77bc0ed", "comment": "Malware payload", "value": "06a7ff3ad60580c222780b1c3ca8db15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274060, "uuid": "f287c8d5-79ad-4242-ab6b-ae5d0bd7a019", "comment": "Malware payload", "value": "1fe351bc4667f19ed55a0dd3b3ccbf974353e1386e503fc1c42335a7d34e111d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274060, "uuid": "2647c2a9-0509-4b82-a25b-b2c1c482c8dd", "comment": "Malware payload", "value": "28f5f74c3916cb40412e9a8f80c484f5f0b682d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274060, "uuid": "36eb9111-34e4-4933-93b4-8e720b06675f", "comment": "Malware payload", "value": "7bcc2da42019f9b26da1d40811ec8af0d550762e2fe6af25f84954ecbd7764fd9b7901e80534aa65edd94507d043ee4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274060, "uuid": "6c0edbda-251a-40f1-981f-d5b8fb8190b1", "value": "T1D3D5707962B6CB4DF681B723D0738A9F67ED6017E28B2FD35D98636109084F2857E8C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274060, "uuid": "68cb4bd9-7bcc-4899-bff6-ce2556259996", "value": "192:epGopGopGopGopGopGopGopGopGopGopGopGopGopGopGopGopGopGopGopGopGS:iD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776274060, "uuid": "334da3ae-4b3d-4005-bf6b-c5a765a4151b", "value": 2840337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776274060, "uuid": "90a3b7c0-a877-46c9-a616-3ab4730bb40b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274060, "uuid": "6db992b4-3851-49a5-9d66-d2b051f73aa9", "value": "Contracts_doc.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68fba8d9-38ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776245716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245716, "uuid": "00449392-4c69-433b-ba6d-3b38d2836203", "comment": "Malware payload (Formbook)", "value": "d72444d43128781aca00861cbff9bcb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245716, "uuid": "0c04e1ff-d2b0-4bdf-866e-ad93f4428678", "comment": "Malware payload (Formbook)", "value": "20b24b43f6ff60c5c1bb21c38dbc1499d50b7cf875569257da991ab76d62a494", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245716, "uuid": "6b556a29-7d4b-4603-8ae6-778bae6d55dc", "comment": "Malware payload (Formbook)", "value": "6c4c3b7614ee3b5a5abc619af764105ec1106c8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245716, "uuid": "b7eef256-9a12-499a-b706-e366204eacd6", "comment": "Malware payload (Formbook)", "value": "1578d4a612839e0cfd1c40c047ed54247b38542b59ea6f81b26b9113693388a29d95ad219c35ee7211f0183ff96f74b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245716, "uuid": "d9091dd2-b2ba-43da-bd7d-c1d0c5a96436", "value": "T1D305F1E03E36B31ADE610A31E569EDB582F92EA8704179F759EC3B4774AD2109D0CF06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245716, "uuid": "5af36988-0200-4c13-b9d9-8f0c914e1d57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245716, "uuid": "eb5a6d79-db2e-46bd-82cb-5d668dcd181d", "value": "24576:/dzrlPwCeMNtmOjksTlYMMtwkE7HMnnEVwQs:5lPkMdYMMtwxz9js", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776245716, "uuid": "54989c96-7943-4e94-813f-7a36a4576e6d", "value": 864776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776245716, "uuid": "3162e25a-7c37-4587-ab0b-1e812a4e4a3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245716, "uuid": "483a168a-035c-4048-9585-4c50f8e6db6a", "value": "SecuriteInfo.com.Trojan.PackedNET.3184.12004.27998", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21f0bf8-38fa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776278480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278480, "uuid": "641f1f34-bd31-4f39-b037-1c2f4d858d9c", "comment": "Malware payload (Mirai)", "value": "1030367d261f9d7a331335540f0c426a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278480, "uuid": "9f3abdfc-8eda-4bee-9d5d-0042c9a17386", "comment": "Malware payload (Mirai)", "value": "20e0e6aafcb3d11b4cd9928772465c5489048dee54db859d6d1ee6c9d8e86435", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278480, "uuid": "b0e0e3d6-ccf5-492a-825a-c867d5315476", "comment": "Malware payload (Mirai)", "value": "59d303649cd85b15a0cd5d245964f231598f4936", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278480, "uuid": "f7fefec2-bb11-4785-83d0-8b77d3a87a2c", "comment": "Malware payload (Mirai)", "value": "885c2524d421fa95c932a2e85001839cee6246c9f63fe5e45447bf7b552c0f37eb3a1c4e98e5d2cfcf4752a07d732061", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278480, "uuid": "85432c6f-d737-4fb6-bbff-b149ba7af5e0", "value": "T12073F956B8814F21D5D5027AFA2E118E331317B9E3DE72229D209F343BC662B0E7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278480, "uuid": "19f2ede2-281a-4fa5-941b-b2361e5b07ab", "value": "1536:/ln0TtPAkKSC6zFBK9hA7Clz4cannTcBIcixMK97gGHM5zYonC:ItAbS7P/cafMK97gGHMZRnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776278480, "uuid": "861033eb-3df7-45ac-b46f-150275147c84", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776278480, "uuid": "cd488a8e-1bac-4f1d-b2af-ff9a4c59a721", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278480, "uuid": "f47a350b-edac-4d83-aa00-842fdc1645b7", "value": "FGx8SNCa4txePA.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f362b6d2-38f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776276013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776276013, "uuid": "85084691-5749-490a-a86b-73e0898a81ad", "comment": "Malware payload (Mirai)", "value": "d59dea3524b0189da40e63db205275b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776276013, "uuid": "5eafb22e-157c-4de5-a0da-727f9779073f", "comment": "Malware payload (Mirai)", "value": "20e5c7074cc49830891480707507148eeceab9c4e907e0fc288e70d27a7cc9fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776276013, "uuid": "9a91aeaf-8abe-4d6f-b997-4538e52b13b2", "comment": "Malware payload (Mirai)", "value": "95eecbcfefffa81308854944dacfcb4d4f44b980", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776276013, "uuid": "5d940883-2d0b-474a-ade5-89eeb3c597ba", "comment": "Malware payload (Mirai)", "value": "f0a8688d9509f48ac76c009ca7fd38d66b78bd3013ee56b7379a5df5f549ef0a3ee8bfdaaae3733fe6bcb800d720ce02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776276013, "uuid": "24679cdc-34e5-4d05-9338-85295231395a", "value": "T15BC39EA7B34F2450C82507F81FC767AD2A2325019D2B9AE77C5E373E1A369DA5C053E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776276013, "uuid": "0029f3e4-7a97-4ae3-835c-dde48c71ae03", "value": "3072:TLcXF4K4NNbNmbcqMhfmftJqIomCgLCNJ9OAbzmq:TLc6fmYqMRCgI3fCNJ9O9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776276013, "uuid": "9c943f9b-4b88-4d59-bb29-c9e1a55e058e", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776276013, "uuid": "eac46bae-03ff-4f71-ade2-c70048561cdc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776276013, "uuid": "1e4de158-0aa5-44cb-b88e-d930b96d79bf", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837eae62-38ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776245760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245760, "uuid": "d4c013ee-8494-4a83-82e6-548e5730eccb", "comment": "Malware payload (Formbook)", "value": "721e38fb31c87d7b9338c1b2d4e50ce5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245760, "uuid": "a8ba57e0-0310-4aec-a0e3-f3ee5b2b7666", "comment": "Malware payload (Formbook)", "value": "2119f966c3d9382f741907abca4d5ceca439f922aa758b31ce98209763cfd86e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245760, "uuid": "d0201d5a-6df9-4510-acf9-ff3b2a45402e", "comment": "Malware payload (Formbook)", "value": "d7b7381c70b90721685db999a7eb2d45d0b9f9d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245760, "uuid": "205f6c66-bcec-444d-9cbf-479c73855884", "comment": "Malware payload (Formbook)", "value": "af7af68f2ad945ce5399a4d478954bf8c00d06a8f69d62c8d8c8edd365d0f3548ca2b224535568e25be6cbb8c2a42409", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245760, "uuid": "a5bfa236-102e-421f-b36f-503e440887eb", "value": "T14905E1D03E75B719DEA14A319178DEB682F51E68B010BEF619DC7B5B349D220AE0CF06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245760, "uuid": "7430f352-6a4e-4446-942b-a9eef56c0d65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245760, "uuid": "dde26d97-9305-4892-88e1-76151099072b", "value": "12288:aK/KxUBxV3biBZa/SQ+2cXP4zI1xsxJhdw8kzbL8Gx0xZbrQjyGJPztq0rlRkR:PCuBxV3WZGN+F/4+0Jhu80LHUZ01rlM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776245760, "uuid": "c19d5835-2f6c-4b2a-bc22-7ac232fa2b60", "value": 819720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776245760, "uuid": "3024ccb9-bf16-402a-b1dc-ddfe3927a063", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245760, "uuid": "c4d153a5-0c8e-4966-8012-7e16b464aef2", "value": "SecuriteInfo.com.BackDoor.AgentTeslaNET.18.25868.17095", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "262b86e1-38e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776270514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776270514, "uuid": "d74be380-3c6d-458c-8e84-d3b4a0ef5567", "comment": "Malware payload", "value": "d5ef62ce9b699d2bff90d9b83138a46f", "object_relation": "md5", "Tag": [ { "name": "antesdissovaidacerto-com-br", "colour": "#F48290", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776270514, "uuid": "0531e195-520c-4b1e-a946-43382d87536a", "comment": "Malware payload", "value": "2216e13de2ed490004e99ba074159c38959c4e93e145201b99408a0a8eeb391c", "object_relation": "sha256", "Tag": [ { "name": "antesdissovaidacerto-com-br", "colour": "#F48290", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776270514, "uuid": "0c6d86a7-4a83-4b2e-a1bd-ec2346591ed8", "comment": "Malware payload", "value": "d6c6a0d77d4bd0637ec89b1be69300d9372ec35b", "object_relation": "sha1", "Tag": [ { "name": "antesdissovaidacerto-com-br", "colour": "#F48290", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776270514, "uuid": "1f363e00-03ab-4dd8-8c31-7afeeff31884", "comment": "Malware payload", "value": "0f2df6c7b1d5ab2a2733b957f49f0b4f50481cd7c6634372eba568c6c51ae14f00e8370111f3f9402abb8c4d5d018d22", "object_relation": "sha3-384", "Tag": [ { "name": "antesdissovaidacerto-com-br", "colour": "#F48290", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776270514, "uuid": "c91b2f68-4474-41e2-bb6f-2d061f991c28", "value": "T166389F12A7B4C42BF90E5C3353AD129F94E7B41A7D5EA338E2894B8F0C61C6C5B86D17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776270514, "uuid": "86083a56-b160-4dcc-895b-0652adf4b425", "value": "82c0493807f3b15a01497cf9d5f88eb8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776270514, "uuid": "da027a3f-8071-484b-94a4-cfb6d557a7e8", "value": "24576:DHysFeU1yGv0PIqeK7crVoB6BnrHdByLl7HQcbMxAok89RFfm:7e6hAIjhvnrKplwmEne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776270514, "uuid": "5bd36b5e-7877-46d4-92e7-6d7dbe1cfbb0", "value": 102935024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776270514, "uuid": "bd7363f6-0f34-428d-ab9c-9511d848c115", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776270514, "uuid": "d9cefaee-2905-4d67-9fa3-5eedda12af6f", "value": "libiomp5md.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71dd0be7-38c8-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1776256898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776256898, "uuid": "934c463c-b97e-4a41-9795-650c908a3ded", "comment": "Malware payload (njrat)", "value": "b3338c5cd452204442d2017ef82fb3fd", "object_relation": "md5", "Tag": [ { "name": "aso-ddns-net", "colour": "#C9F308", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776256898, "uuid": "eb82e781-5681-4d34-a7c5-70ae4326707e", "comment": "Malware payload (njrat)", "value": "2247dabbce0440efd334eab9cc815629b3154d0f732782b463f6c74e0c13e31d", "object_relation": "sha256", "Tag": [ { "name": "aso-ddns-net", "colour": "#C9F308", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776256898, "uuid": "284a4c83-7ab4-459c-8d62-f92c9e40770b", "comment": "Malware payload (njrat)", "value": "ad46d2191ce1d2f08049e1ed3b68de097b036470", "object_relation": "sha1", "Tag": [ { "name": "aso-ddns-net", "colour": "#C9F308", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776256898, "uuid": "075dac9a-d259-43ac-8993-e5be299618f5", "comment": "Malware payload (njrat)", "value": "0345c32a03a1a1aed55e14bd9d944521c178f756a0d2c23a32f85bc54bd0ba74ae66c1e16032022980a18cd75146a914", "object_relation": "sha3-384", "Tag": [ { "name": "aso-ddns-net", "colour": "#C9F308", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776256898, "uuid": "f0d608f6-55ef-4395-a991-22695c36ab42", "value": "T17976223851971832F3A0AABF8BD5E6B7B3187D123479EBD920C643234A5E546F5810EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776256898, "uuid": "edefaba6-76f6-4dd3-9a1c-a7a29eff2e5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776256898, "uuid": "7b934192-1e82-4ad3-8c5d-acfbff78ff5e", "value": "196608:btAvkXpBQPMQnwNfGfavPbPA2Rjt8BJ29QLBTZ:XBUMQw4azAItCNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776256898, "uuid": "d921e481-714e-46e2-8337-fefdda7f1587", "value": 7325696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776256898, "uuid": "f2caf74e-0451-4ed6-aeee-9674efddb5f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776256898, "uuid": "45cc828f-7af0-4fcb-aedc-d0a1cdc1636d", "value": "2247dabbce0440efd334eab9cc815629b3154d0f732782b463f6c74e0c13e31d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce0b8d6a-38ef-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776273803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776273803, "uuid": "1ae55884-1ee2-485e-9cae-1915eb25c261", "comment": "Malware payload (Mirai)", "value": "71b715981a55e9113d3cfb1c13fd7bb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776273803, "uuid": "4eb1c339-77bf-4518-bd9e-7e74f01eecd4", "comment": "Malware payload (Mirai)", "value": "228211a3d2d50f8b72360b37f92bc4bea715996fe205c51b9180511f7709a9a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776273803, "uuid": "5fd18e1c-c274-4dd5-b8a3-9c8cccca65bb", "comment": "Malware payload (Mirai)", "value": "8ad2fcf7e4ab26a855eede0e9ad2876a62b0d0a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776273803, "uuid": "88d8ee5e-b0b5-46a2-b638-5c1c3ea06679", "comment": "Malware payload (Mirai)", "value": "9da9da12f8eb374c1ead0cd86e6f7a59faf4a8b85c65a355dfedd57fe06b61e5ffb61508f9ab6e1cf8c4bb907fe4bb49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776273803, "uuid": "1c5851e9-572c-4f66-bd2a-193576a66356", "value": "T181F34A69BA0F6D41F1C2C3F8DA8C87E13E1735E3C67A8DB1790252EDDBA39D95980502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776273803, "uuid": "8f6ddc51-520b-4ce6-91b3-b484b4b70d9c", "value": "1536:qS/PGXZLLYIj4KHuTyHZZMqcMu/orb1B7QsSc21sTyMAQPMkXEn5p5M/LW:D2thDZZM7QH77ScusTyBQPMkXxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776273803, "uuid": "0ccb5548-e523-4abb-896c-60bd499f11b3", "value": 161640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776273803, "uuid": "b9bc4171-5b3b-453d-bdd5-4437cfa063e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776273803, "uuid": "b290fa04-966c-4be2-9dd0-a9a23decd127", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04915e2a-3898-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776236098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236098, "uuid": "ff40a6ee-c455-4400-a98e-fd25d32e3a5e", "comment": "Malware payload (NetSupport)", "value": "308681bf3a6834b3da9e06e3b6137791", "object_relation": "md5", "Tag": [ { "name": "5-188-86-165", "colour": "#DE80D8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236098, "uuid": "7407fdde-7b0e-4a81-b417-a1d73e351cde", "comment": "Malware payload (NetSupport)", "value": "23124ce6f52dfc0905c53aa9e3b491657c3692072272bb6eb7d0911457a4a92c", "object_relation": "sha256", "Tag": [ { "name": "5-188-86-165", "colour": "#DE80D8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236098, "uuid": "d07e1219-1cf7-4ef8-af25-1220b9a518fa", "comment": "Malware payload (NetSupport)", "value": "c25204fa0b3e79ecca71f47b3644d4a585ddbf26", "object_relation": "sha1", "Tag": [ { "name": "5-188-86-165", "colour": "#DE80D8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236098, "uuid": "c2da2413-8e43-46cf-83f9-5fbd7587f2cf", "comment": "Malware payload (NetSupport)", "value": "9f4bffe35b4d96fc694e983d8f326bd32c54a3b7a8d7ffaf0e1512afdff09a6f5b4d9f3a85194357de212b2f7cbf1fff", "object_relation": "sha3-384", "Tag": [ { "name": "5-188-86-165", "colour": "#DE80D8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236098, "uuid": "02621701-6933-4bd6-b2ad-c985a3722efa", "value": "T18412AE0DD7C448C6D0AFF5755B848115CA37EBC80AD6044A1AF973C8BBC2EB75222375", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236098, "uuid": "3f17ecc3-2fa9-470f-86a4-5e3e1a817143", "value": "192:im6R9rpWQBMrH4Rmyca9fbpkjXskAPyXXlKaO/Ax8/dI+A:v6kQBMYRm/wksuQJ/g6dI+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776236098, "uuid": "e854e898-6980-4fa4-8a5b-34e248a807de", "value": 9537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776236098, "uuid": "029825cf-66ec-4997-9d1e-91f7e39b9b93", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236098, "uuid": "afa128ab-6c72-4ed3-9b39-31052a010044", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4914c6dd-38a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1776240079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776240079, "uuid": "30025593-f809-4898-b110-a82eba9093f0", "comment": "Malware payload (Joker)", "value": "3d0b8cea362ae82cfc7bab99f6bf055f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776240079, "uuid": "4874d629-3cff-4a7f-9607-0a1025d7cca5", "comment": "Malware payload (Joker)", "value": "236e1627789a508edd56ea995602bf4a36f86a65d383bc35eeab7b878dcd4ebf", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776240079, "uuid": "1774589b-252e-4c68-921f-25a44aeb34f8", "comment": "Malware payload (Joker)", "value": "67e04c187a38ba06eced4d657393cabf8a4e2a79", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776240079, "uuid": "6d19b2e3-22cc-4e78-b168-f9d9599f2054", "comment": "Malware payload (Joker)", "value": "e22fb0b94731eb276d47acbf5ba111de3093328d970376314f6d0205de79c6c4a878f7e5a04c12dc1de0b4f64b56a687", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776240079, "uuid": "1d489bf2-fa7b-44f7-be3f-ecfa7e0068bd", "value": "T1FFD72353B5C08F0AC07F9031E5D62E2C99569D4043398B4B9619BF3A6BFB70F6BA5384", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776240079, "uuid": "f21e3b42-2c87-4c4b-97ea-182d07cc39f1", "value": "786432:FqPZCFOgWmBRGLVtYM0Fmcr3Q3tufpcVqEXfTfccI1KAj4SSNXHbrHZtZ9Yd+P4h:FZ68EVmja8UrLI3rSBHHB9s+4YnGMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776240079, "uuid": "a85f0bb3-326d-41b5-996e-4fb8822abf04", "value": 61415085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776240079, "uuid": "e03956c8-d0ce-4904-9a3f-307a7100b4a8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776240079, "uuid": "47bfea50-450f-40c2-a52d-452e7b800233", "value": "com.drut.conta.carparking.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6951b751-3916-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776290384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290384, "uuid": "19672b2e-79b5-41e1-8790-55cca89d0c7d", "comment": "Malware payload", "value": "893d84bd5acbe4357c7d4da2810ab453", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290384, "uuid": "aa67bc52-df14-46d8-b30e-5fbecb9cd248", "comment": "Malware payload", "value": "238eeea51b2d53ff08b3129fe6d6be75a13c12090e4063a1455fad614054d4b3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290384, "uuid": "3ba93b3f-fe01-4150-a2c8-298a23db4791", "comment": "Malware payload", "value": "c86c59c72030e3d4b4274bc498c5bef485a7a3d3", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290384, "uuid": "566b1f8a-b530-4522-8780-0a06785aedb8", "comment": "Malware payload", "value": "149c50b6d3a25a09fc5cfdfe23db96c0a1f306ad221cd45ef0fd7350db6c3dce7abefba218427d379442ce9b177cc555", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290384, "uuid": "943359f6-5517-4387-9ab5-083f647f418c", "value": "T19AD5F055FB989F4EC8F393760C3A5636547AD827C7038383C8792679284BAF40F856E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290384, "uuid": "86bdbe54-9577-4797-a68f-c3817fa6bebc", "value": "49152:NcjJbgYzJrksfW5gipFKVRTTS0iSkXjFUkSwR0Q1+aBbNGAurPChbpCinv6QQ0Zi:NcjhgexLfW+i+VRnhsakiUBb8Au2hbcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776290384, "uuid": "fbc8cfe7-58a5-4253-90cd-f2c72f16d255", "value": 3016263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776290384, "uuid": "f90a27dc-cbba-460b-a1d7-a781e4628ba8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290384, "uuid": "e6bf019f-1222-4ef8-9a03-bee3e2abd602", "value": "sagawa.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3232a453-38bb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776251207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251207, "uuid": "66e518a5-0c4d-427d-bcca-75698e088528", "comment": "Malware payload (Mirai)", "value": "e6e397dfa4d5b3fba710a2905f50a0a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251207, "uuid": "66cfff5f-88d1-4d57-9434-d8dcfd48b11b", "comment": "Malware payload (Mirai)", "value": "23c1328e77ef4011fdb962bfad2679a7bf339bd13a795405c343bac7ea65dc94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251207, "uuid": "b42616cd-de37-4a69-aaeb-dcd8abaa3fef", "comment": "Malware payload (Mirai)", "value": "82f7bd60e4b14a2cee32758913ff3bfef82954d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251207, "uuid": "0cf31828-b531-4c0a-a053-3ea340e96734", "comment": "Malware payload (Mirai)", "value": "30265b35378437a078a795617fd887b62ccb24b1b9cba85a1d209d000746744203be3482d066914c2bef0072ae5111e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251207, "uuid": "7cfff509-5f9f-433f-88af-17fd56b634e2", "value": "T1FE4302D4C2D25D96C58DC13604FBF9AF1942256DF45CCAF601502A63B8A7FE33AAC293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251207, "uuid": "9b2eb06b-6f4e-48ae-a9bc-b095c3402c5a", "value": "1536:vTnGsuaZDUWEQ1zxUIbOr/irASAdoeOwJv7nouy8Ey4:vjGjaZAWWiUXdvjoutK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776251207, "uuid": "7d93b187-95a9-48a7-bf8a-d7d830cce52c", "value": 59200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776251207, "uuid": "987060c0-7977-450a-98c5-6f085232a075", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251207, "uuid": "bd5e9d6a-1732-4e11-a0c8-5d70574fe185", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73cbd999-390b-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776285677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776285677, "uuid": "28a05aa4-df40-4e75-aadf-e8785e451f9d", "comment": "Malware payload (RemcosRAT)", "value": "1cb3cea0c8f5c5694a2f885ee010c210", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776285677, "uuid": "2434c185-c153-4723-8c03-5d26f2214aa0", "comment": "Malware payload (RemcosRAT)", "value": "242fa6fe46dba02d3638c2a4907fd19d6de540daf9a3c690603eb316ce1f0d02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776285677, "uuid": "2e1047d3-c10a-4f70-8cf9-c54e3e7e0f38", "comment": "Malware payload (RemcosRAT)", "value": "ca4c1e2345f020e1d200c1b8395aae0a1b7389e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776285677, "uuid": "82f78d8d-e714-457e-b4b4-db4d4b0c3659", "comment": "Malware payload (RemcosRAT)", "value": "c38f4f72c25728e4a6499bd6e1b4e004a6c8c804c976cd975ac4538c487eddb5c3d7ea709bb21cec5a3e0c4f8e409c0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776285677, "uuid": "1e9741c1-2f97-4ca3-94fe-69ecab68a58e", "value": "T156B4BF01B6E2C172D57660300836E735DEBDBD2018369D7BA3DA1D57FE30290A739AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776285677, "uuid": "398f1bd0-c889-488c-8da4-aa0a84b2a608", "value": "737fc4be4f9f7d7c06c790667c9f7669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776285677, "uuid": "437af932-0545-4899-b8b5-52e44196334d", "value": "12288:Rg2cpfSUy6oFGNfZvCcXmw0z38qsPZ0WG:Rgdfty6oFQfNwz38JZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776285677, "uuid": "05acd2dc-d9f6-41f8-b35c-f18975d76ed8", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776285677, "uuid": "912fd066-47d6-4e1b-9086-c8896139a43a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776285677, "uuid": "d47c1a33-8301-4db3-97ad-b91beb103531", "value": "242fa6fe46dba02d3638c2a4907fd19d6de540daf9a3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2624b918-38ce-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776259347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259347, "uuid": "5d132ba9-5567-41da-8e22-da824a9d268c", "comment": "Malware payload (PhantomStealer)", "value": "8659d537af3b64df1de1be4c98a7492a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259347, "uuid": "12309c01-726c-4edc-b89c-df58ee80e4cc", "comment": "Malware payload (PhantomStealer)", "value": "2457e6fb404a2df5e0e9e989adf2b6b8cd56bd07a156c9c3854851f582945b18", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259347, "uuid": "d0b46061-f5c8-4c8b-b017-c19fe21ab97b", "comment": "Malware payload (PhantomStealer)", "value": "2fc3ba1a6f69fd42e8543e3262c71d9c973b1d35", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259347, "uuid": "11bc8685-5744-4e7c-9188-308f72952858", "comment": "Malware payload (PhantomStealer)", "value": "e1072cbe6e5db7022bdaa0b2ceacc66da6eba510828757cc9a3a68c94ca081e4ec2b84c07b4765fc441845711a73b969", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259347, "uuid": "7c282830-9fb2-4c0f-ae82-aa65d8b79bfc", "value": "T1C826F21189C42FB9CFEC561890FD160EA3F04A8A91567989FB33BD4BBFF7A045207199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259347, "uuid": "248281f6-3033-4f17-b292-673fe02ea5a0", "value": "49152:Jee4di+iAf2fgZPtODkoZVJfPLRNfPjfaJ0015oA4E6zoS2SxUbwy7:g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259347, "uuid": "53fff074-08fd-4de0-8050-912fbe344bb6", "value": 4674166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259347, "uuid": "14d1c437-7cd7-4e5d-a096-fa0b70020133", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259347, "uuid": "8e3be6bb-40ff-4b4c-89b5-a4ab550ee168", "value": "order - 19008.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad9eec5-38bd-11f1-a769-42010a9c0008", "comment": "Malware payload (MacSync)", "timestamp": 1776252108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252108, "uuid": "98b28879-6f08-466e-b4e9-fd827921a664", "comment": "Malware payload (MacSync)", "value": "e68be00a43d884175f102e50a508db52", "object_relation": "md5", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252108, "uuid": "847f7a01-4827-4c2d-9dc9-8ef9f944cac1", "comment": "Malware payload (MacSync)", "value": "26133e5ab0aca6665ddf99fe9c3d260c7ac402e321047e744f3949fb795f03d1", "object_relation": "sha256", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252108, "uuid": "df129549-6987-4bac-afc3-fd79594fc5a1", "comment": "Malware payload (MacSync)", "value": "892f405cf9c72dbbc4deae0211f36fdc24f5e151", "object_relation": "sha1", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252108, "uuid": "685f9f43-e4df-4ba4-88dd-9d82f6d14cac", "comment": "Malware payload (MacSync)", "value": "749a4c84583b7456f791cfe046c00395933fd0004153af339a94b7ba44995dee43dd1e54b7582bd25617e9a5f842e415", "object_relation": "sha3-384", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252108, "uuid": "37a5a33e-f308-419a-85ce-e52c926dc6db", "value": "T11821B98B86163A7978C640509E59B339F986ABCC3A22E9489ACDC589740697C73FA106", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252108, "uuid": "f5fd3173-a6cd-4178-a5e4-277f9b577fa6", "value": "24:/tHOUEVAM7xO/Sbzc22lMBR0SLWI9MAB+f0vWS1BijrrYL+bmdDgT:RO57xOMccR0SLWI7Bas8c9dG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776252108, "uuid": "2d0b0e92-bd6c-4199-8bfe-d49451481667", "value": 1434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776252108, "uuid": "0d4c21af-645d-429f-8fb1-9214043fad04", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252108, "uuid": "dfdd1d92-5076-4f23-90a0-b1be2b8d13da", "value": "26133e5ab0aca6665ddf99fe9c3d260c7ac402e321047e744f3949fb795f03d1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e752f192-38cf-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776260101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260101, "uuid": "83bce232-2ca7-410e-86d1-61cea2347608", "comment": "Malware payload (ConnectWise)", "value": "f89e864d8e19eb4ce78117265a7b572c", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260101, "uuid": "b54d4c64-41b9-46d8-9308-7d531ecfc2a9", "comment": "Malware payload (ConnectWise)", "value": "2648d53e4c8ac63822b99f2b79a80770e2c2c33212232bde298a6f08d1a33d49", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260101, "uuid": "59a4e59b-f504-4dee-8a98-8fdf89283ec3", "comment": "Malware payload (ConnectWise)", "value": "4b3169538684e965f4e927d8f087eed60402e6a2", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260101, "uuid": "e9f8f337-431b-46b2-83a3-ea89d50f8534", "comment": "Malware payload (ConnectWise)", "value": "33252f051622104161102907ee2549a30acd3b86a318465c63ff04a43b081bd9ab6a3adf3038fe6cbff89fe6c6bfd56d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776260101, "uuid": "f20b4618-40c7-4a77-bd6f-8456f45625e7", "value": "T19295F13136E4C039E2B21B35E93A92F15E79BD24DA62C05F43643D1E7971E809AB2773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776260101, "uuid": "fa5b76c2-5088-40e7-80fa-77d61a6d330e", "value": "24576:5NGryn8Y2KWeNXPKPC+j/4TkfVub1emjS4t3nHRRlUhWMUUGGHpYLgmdF8gu7ura:beyqkXSPkYYb1rSuRlUIXGHpYLgSL1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776260101, "uuid": "80a0bb9b-35cf-4724-b3c8-104abb75111f", "value": 1888256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776260101, "uuid": "95677680-133b-4da0-8ec2-db4a7cc448c9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776260101, "uuid": "dee0fcd4-8e7a-44d1-a560-e0c9d4954133", "value": "SecuriteInfo.com.Riskware.MSIL.ScreenConnect.Heur.18562.21764", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cde8433-38ce-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776259520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259520, "uuid": "0eb3c348-eb70-4d9c-bfb4-85a3e6adcf7f", "comment": "Malware payload (PhantomStealer)", "value": "f2db0e92c4ea22e8909c855dfcad3ab5", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259520, "uuid": "fdede26b-6de0-4d8b-9357-62e7278fe050", "comment": "Malware payload (PhantomStealer)", "value": "26f376b50d02bd8fc0d3e12eec55e97f2b24ca221a8463980bcdfc380bb683d5", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259520, "uuid": "df94c380-0d80-4d8f-901a-78d9b16ee459", "comment": "Malware payload (PhantomStealer)", "value": "859e235675a77949aa705609acd26b5a3e24751e", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259520, "uuid": "fda33acc-38eb-45a5-92fd-3ffe63e127cd", "comment": "Malware payload (PhantomStealer)", "value": "b4a747cb03a4815cc1c285da5c3c10f101578f45f74989df82151a40ab04dc1b6ef9ef5728902bcf175f730b68e8270b", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259520, "uuid": "3454e6ef-1ef5-4099-93a4-dec2a8047d63", "value": "T1ACB20F3DC9849FF00B6B31E2B56F7A16A9540323B5382A4DB8CF81993B35650CBB51ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259520, "uuid": "47b8d6bc-eda7-4cec-9992-36e5682a3e2c", "value": "384:K38ZiRIafccaRctqia3c+aVG3YSccl9ONY3gKY/37oJFqWd4Synwv63LRlV1gx6R:K38ZivV7aMrzV0gxAFqX8x6/lTcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259520, "uuid": "b4133549-2c95-4cb4-b252-7634e0356cdf", "value": 24211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259520, "uuid": "3af88d87-cb4e-4814-837f-827eb518a7da", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259520, "uuid": "582b4329-e280-4c81-b032-0495e83c5437", "value": "fdm.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "114ffe3d-38a7-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1776242562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242562, "uuid": "62c1efcb-5497-4018-a20b-ef445153c8e3", "comment": "Malware payload (SalatStealer)", "value": "66a8d0e010f2c5fc8ec4b391356bdb66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242562, "uuid": "c4cf3040-7122-4364-abd3-f955f2abcad2", "comment": "Malware payload (SalatStealer)", "value": "2736be1bd234d0a7ced4976356702df6ead3a294ca1ad8ce8dd124b09cf6e465", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242562, "uuid": "7f96f238-3375-4239-bb99-2b79022de706", "comment": "Malware payload (SalatStealer)", "value": "471f21b52ec4f155190d4bbf0b657a39e8097aaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242562, "uuid": "f80bed07-e4f3-4fd6-97b6-363dc30bb9e2", "comment": "Malware payload (SalatStealer)", "value": "7f8d453feccb6f9df805c594756de421e0828c1cd24f868b880017666f04193fb1d8b374ed1a6d8107c427de32ebfb0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242562, "uuid": "a9b8fd3d-f108-465c-aac7-b28e885e9dcf", "value": "T11AC65A01FA8B58F5E9035831515BB23F63306C048B28CBE7EB587E6BFC77A91197A215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242562, "uuid": "885bf82e-6ff2-4367-a867-9d4d850b6a4a", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242562, "uuid": "94164765-bd36-4c3c-b0b3-28b98d515045", "value": "98304:al2NPB+sLSAocV+cfxqy5lE0py1r0c4ki5+UYhPsNLQEx:XPI7cfLVpRcI5+UYVsNLpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776242562, "uuid": "bc19d06b-8e99-4d55-872f-0fe0ce912910", "value": 12317184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776242562, "uuid": "832c94cf-eb98-4dfd-a498-032cc96deea4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242562, "uuid": "9175fd7d-de19-422f-9f65-c08d284ecd89", "value": "SecuriteInfo.com.Trojan.PWS.Salat.389.11339.8821", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a46f0c30-38ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776259559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259559, "uuid": "fbc39475-33e6-4105-96f3-6af79a8a0489", "comment": "Malware payload", "value": "1f46972c07a9aa74f6f5f85b9c052fde", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259559, "uuid": "82b2898d-19c2-472c-9fc8-95ef903f04c0", "comment": "Malware payload", "value": "2743ffb5f1dbd1339acc3e7dbaba3dec8394ebef6fd845c267667b9f20261df3", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259559, "uuid": "059d7709-4d12-492f-a923-631edfa41577", "comment": "Malware payload", "value": "1405265d1c320f120d1f3134e9826a2ef998d9b8", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259559, "uuid": "4f309a52-543d-472c-9e36-dd0a3cf671d1", "comment": "Malware payload", "value": "93030c203769a2026b38452b6cd3027944f4bbe1b74225af840a77c296b137d3815fd85402168c45c76afb59db0b3a19", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259559, "uuid": "b135b53a-9803-4fb4-b143-623d4f7e4450", "value": "T1A9163334F798185B07E4832AF05FAF337FAF89A3420D69A6D459E04D25CBAB5412F4E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259559, "uuid": "9e85ecbd-ae04-4056-81d5-f4c76ea078e2", "value": "49152:Q5+UKqurGteHxAbIjq5ynOQxozNtt29e7Xd0fV93o5qUlZboP/00g2ej6:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259559, "uuid": "a4250bd2-c3ba-4223-abc5-c0c467a5a07b", "value": 4387594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259559, "uuid": "974896b2-c3d1-4361-9717-e885d9c518e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259559, "uuid": "7e67af69-57e1-47ab-b17a-cd08bf5813bf", "value": "TJIJO98726Convncn_7HEUIourno69997-AVRY6O8H.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b329bd-389d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776238332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238332, "uuid": "64632dfd-8caa-486b-a385-5efadf82fc9b", "comment": "Malware payload", "value": "df972d04760bb93daf4ea5c253d983f9", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238332, "uuid": "5680e1f6-d580-43c4-b2fc-ad4f584d0a32", "comment": "Malware payload", "value": "28374f7b913f4fbd2958b577ebbe64701aec88ca9d1b2005844d0d1cfcf8259a", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238332, "uuid": "147f09af-51ee-48f8-9214-e657963b4413", "comment": "Malware payload", "value": "b4dc840fe9d6c64e4a82a15146eb7dfcf52bec22", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238332, "uuid": "16cf8e6b-7746-43a9-bf00-455f7efbd42c", "comment": "Malware payload", "value": "0490378db78c5c0fd5a4326c4c5e37cad0ba5c0ac0275255f663f31c9c46adba5e7f22d4069d9a91738698e0795154b8", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238332, "uuid": "108f8fec-43ea-4896-9f19-b71016e45308", "value": "T1A4520EBEC4D1FCC0875B22D179AAF7C2119ED713BE6B1B6CF5CC05A01A902A4EB79548", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238332, "uuid": "9c8fde98-be75-4b27-81dd-3077fb6ca17a", "value": "384:wsjQbXI9ZFoTqbhne0qGSuEd1yM3thmmt758cjtOM/Fzt3B/uXQTa/f7cRdU:fWajeTDRtbFbjAMth39TaHQRdU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776238332, "uuid": "7f7abcf5-b2b2-4911-8978-208e96ff5620", "value": 13514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776238332, "uuid": "829363a4-7204-4ee5-95ff-524e5607066a", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238332, "uuid": "f3ae83e4-5510-45ff-ad14-3d2446eb3dbd", "value": "SOSTENER.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae1b65c-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776239733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239733, "uuid": "539d4bbb-d588-4334-bf48-71f81541da50", "comment": "Malware payload", "value": "8f8f963de174c4f35dab7c08d0e95c2c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239733, "uuid": "1a283804-25d4-4ea6-93fb-1bd056c92750", "comment": "Malware payload", "value": "28fef70d5424d19080fd1c25f5827a4c2acec6f7865794202a835ff8d903bcd9", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239733, "uuid": "e947fb0b-0b59-4214-bd56-95f54c3ed291", "comment": "Malware payload", "value": "b934074432fee0f165edb0fd33a189428c6db943", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239733, "uuid": "204668dc-9605-413d-9cc8-5a0b7b601db3", "comment": "Malware payload", "value": "a1c8b29dc529d76f76f8ac3cf2e4e3b64e6eb0ad573d54a416d530ed13e61bc9a89e533033c6d190285e74231f5d742d", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239733, "uuid": "114c85f7-4c7b-45ea-acb3-010e2c52e3b0", "value": "T178B24E3EC985DFF00B6A31E6A5AF7A1598540323B9386A4D78CF819D3B35650CBB10ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239733, "uuid": "1871579d-52ad-42b5-9efe-9f93baed8e86", "value": "384:Ktm8ZiYT0PsQyNgTnU+kwfcayp9qnjhc8vLwP05/8aJ3zwyx7Giz6EYg68UmdHmP:Kk8ZiNJFkjtgGAxTttoGjdzLTh8Jb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239733, "uuid": "62c0440e-b532-4f3e-b1e1-28a60821c60d", "value": 24121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239733, "uuid": "db7bd6c3-753f-4765-a557-5de53489df42", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239733, "uuid": "97caeb5d-b1b3-4591-b033-4e3c6b1c325c", "value": "PO-termoventanas-6455365343.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54cdb1fb-38c2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirax)", "timestamp": 1776254272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776254272, "uuid": "e463892f-0c5f-4394-8e64-3486ac8189db", "comment": "Malware payload (Mirax)", "value": "a3c01da020c9ed0020fac28af7c3e665", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Mirax", "colour": "#EA30CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776254272, "uuid": "4976cc63-268d-4d1e-aae4-406d6a5625a5", "comment": "Malware payload (Mirax)", "value": "29577570d18409d93fa2517198354716740b19699eb5392bfaa265f2f6b91896", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Mirax", "colour": "#EA30CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776254272, "uuid": "d612007d-05d0-4d19-a16e-a7c5b972a26a", "comment": "Malware payload (Mirax)", "value": "9dbf1601d5d88765c576864c2d327bb8b2a92927", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Mirax", "colour": "#EA30CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776254272, "uuid": "0f8da509-737b-453e-b5f1-f729ed07be16", "comment": "Malware payload (Mirax)", "value": "1100e190596ba99597040c15c2c5dcede6f3006bfe6549cf7dab6dbfea4f557e4406633676a3e531c653d087f8fe9818", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Mirax", "colour": "#EA30CB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776254272, "uuid": "d8eddb22-47d0-49f7-8505-91b477e40608", "value": "T152A60296FBC49D6AC0F34732857952B2514B4D268F83CA875E14763C18BB6E08F4EEC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776254272, "uuid": "6366ce0b-6faf-4625-aeb7-4afd5b9c8068", "value": "196608:avjqUjBmc/5PrdlcMRZKWuJPSauzsdv0czGlAMQiLiAfB:QqSBmc/3l9rKWcPNuzvcClNTiiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776254272, "uuid": "0340768e-4156-4d86-9297-48508285fb7d", "value": 10277238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776254272, "uuid": "9f7af2c4-3bd8-43d5-bb7e-40c99e22a09d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776254272, "uuid": "96e1bdd2-469c-4b80-ad37-2f183a7f703e", "value": "29577570d18409d93fa2517198354716740b19699eb5392bfaa265f2f6b91896.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab129881-38a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Loda)", "timestamp": 1776242391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242391, "uuid": "8435275c-935e-4ab4-a2a3-487b4ec730af", "comment": "Malware payload (Loda)", "value": "2f757ea777b6fe9f96b1e19b2a1a68ce", "object_relation": "md5", "Tag": [ { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242391, "uuid": "22e843c6-799a-4ca4-ad38-4f8e76bce4a3", "comment": "Malware payload (Loda)", "value": "2964a129748354c93fc560566d2b023095ec96c6772cbd23fb0f7958308f3058", "object_relation": "sha256", "Tag": [ { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242391, "uuid": "8a00e41b-f68d-47f1-b1b0-e9323692f90f", "comment": "Malware payload (Loda)", "value": "2d4593e39bc01de225d30a86fcd8f398aba39169", "object_relation": "sha1", "Tag": [ { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242391, "uuid": "094f40cd-287f-4ebd-9764-4cd38cfb9ad0", "comment": "Malware payload (Loda)", "value": "87635cceb540cbde316e87b6b90b3fb5cebeec974c77f0b0ef39f4f3f698a24da22eb575aff9f88ffd2962765d0c90d1", "object_relation": "sha3-384", "Tag": [ { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242391, "uuid": "40904cb2-28f9-4696-8b67-a8d905916c51", "value": "T11EC633DE2C8780EADEC109F08B0B7BE713F79DA558994C3D29863588B571EB3306B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242391, "uuid": "6fd65996-122f-4409-aea6-7f46ff28f49f", "value": "196608:SIDwfCda30/E43d4xjVl8/Pg3VU5A9BwYnApS2dmBUsnpEYt73e:SI8fCdH3ixjVl8/Pg3VfgShBLn+Yt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776242391, "uuid": "33bbdd88-906a-4119-b7b2-7c4b7340aa83", "value": 11649024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776242391, "uuid": "f147b945-6e4c-445d-a4d4-7ae854a2e8a6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242391, "uuid": "f42a0196-492b-428f-b87b-5bd3a5f725ed", "value": "SecuriteInfo.com.FileRepMalware.69422265", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5c2436-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776239843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239843, "uuid": "4ee3749c-06be-4ec7-885b-74194c6e7b63", "comment": "Malware payload (AgentTesla)", "value": "d518183c93aa365d4ae8d4354d28c2ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239843, "uuid": "ee74e580-f3f1-4044-b445-f625e4e2b729", "comment": "Malware payload (AgentTesla)", "value": "2ae11e2017204b958055df29431380e1cbb96dd08f93f7358806be6061b95bc1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239843, "uuid": "5b576fb1-6e2a-4783-8773-9b83af385c97", "comment": "Malware payload (AgentTesla)", "value": "286a9da773736afe35ff9b3ba2fbb4d5dfc99f8c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239843, "uuid": "69a5c484-b18a-44ca-a494-c05ad73deb3b", "comment": "Malware payload (AgentTesla)", "value": "8aab7b70afe4a7f9800bfd3414831cf57ea3be861db348ec82892bf133f89c8f605c1d435e7d89f09e19b755febf0bef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239843, "uuid": "7a47f4ee-13a0-4886-87b7-56a70855fcb4", "value": "T14E65F2158AC43FA8CFEC1A1950BE150FA3B14D8E5019B58AFB63FD46FFB7A04511B298", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239843, "uuid": "b05ac40a-af60-43c5-88dd-f8f1f0f5a2f3", "value": "24576:vURw6tMCqQ/clderTqQBHzHtUFvOBoGGlycSpPfFwxrSnWe3da+t:ymCHC7AcUH6sX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239843, "uuid": "39b705b8-ecad-4c58-8954-e5eab636aa53", "value": 1437498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239843, "uuid": "7b9526bb-4035-48da-9be9-b14d048b567d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239843, "uuid": "d22ba156-bd0e-4245-8b42-610dfee7f87b", "value": "COTIZACI\u00d3N DEL PRODUCTO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4554427-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776239910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239910, "uuid": "c2c3152e-5e2e-48f8-a12a-56cd2b3fb11a", "comment": "Malware payload", "value": "971680a6e8f10304aee20162c0610729", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239910, "uuid": "9884f89b-2c14-4ae8-9f69-736337f536c6", "comment": "Malware payload", "value": "2c10cf76818a0fda800dac1fec0a3b0e91523e5a73ee9458ba1534d3230656d4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239910, "uuid": "c4334743-916c-4922-9d89-a859dd764642", "comment": "Malware payload", "value": "846bd29235ff32cf5254029fe198e25229e6581b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239910, "uuid": "001184d6-2114-4c93-9429-6eed8037a112", "comment": "Malware payload", "value": "be2e605dc74ecad163951d8ac96d27c0ff06b9022a1c60b61c0e8d6f162b7f180620bd7e504dc961f0cbd1e40b442c92", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239910, "uuid": "e77b1cb1-7c0a-4b66-9bbe-2f700e0718d5", "value": "T147540D3CADEA002A7173EE54AED47497E92FB763370E589910C10386472394AFDD963E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239910, "uuid": "c059c46b-600e-4a8a-95b6-42d28f54f748", "value": "6144:ZZzXVGI5wtdLgTUZCVnGLtWy6lQccNMYaE0SyYeBu8zblyESD:ZtVGI5wtdLgTUZCVgtWy6ycc2t2obwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239910, "uuid": "ae4d3896-bc4e-449f-b24c-64f21c515e42", "value": 284742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239910, "uuid": "7b3b6488-c51b-4ce5-adf1-02d79345a750", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239910, "uuid": "e4355d0d-333c-4012-9607-639cb6f8df43", "value": "R02-Supply of CuNi Pipe 00634.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "766d3d3d-38ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776245738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245738, "uuid": "b08b0653-78fe-4d29-846d-f9f6458777d9", "comment": "Malware payload", "value": "00207ec3e64fe8d5ddb49877f219f9c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245738, "uuid": "b9905001-1392-45ad-a834-725e5288696e", "comment": "Malware payload", "value": "2c2d860f3c8dcfd6d0d6085e4898cf49b1a2c8118003e0aa9f98d7a98e429d16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245738, "uuid": "e317756b-09bc-4394-9bfc-ea247bef9c37", "comment": "Malware payload", "value": "c3d266fd8fd6d60f55be3b7dc9798dbd75c474f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245738, "uuid": "286e3e51-8af3-4ed2-9e25-c70fa215f0b5", "comment": "Malware payload", "value": "506608205f2063115c1b28fe3be98cecaa0b6705ba4f2005d30382fc854cdbf6e8aa013b93ac40ab09254fd814aaa75b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245738, "uuid": "28aa3dd0-46a5-4ff1-afee-f9864ed94a33", "value": "T1F954803EF24FF403D2D8F57CE0E5521406AA5E8E3C8DA6683858B590E5B6E487A03F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245738, "uuid": "924d17b8-b0bb-4997-9965-d3e1d989a539", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245738, "uuid": "5b35b747-2b12-4743-86b5-9e4ceca638c9", "value": "3072:S587oQUjVHhZK0iuIM/J9+R3zm8SgZFEUv/LroKXXXXXXXXeO2RJ:ATxJ9+Ry8XZFEcwBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776245738, "uuid": "3a3896e8-f5bd-458f-b648-1c3301173c88", "value": 288768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776245738, "uuid": "c992cebf-c9a8-42a0-b948-c5f54ebd01f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245738, "uuid": "abd09277-2b42-4568-b36d-02c0a245c438", "value": "SecuriteInfo.com.Trojan.DownLoaderNET.1163.13623.24256", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7514310-3860-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776212346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776212346, "uuid": "53adf117-eb3f-4728-8fcb-e0e03a285382", "comment": "Malware payload (ValleyRAT)", "value": "05998cf97303bca8d8b5a3e9173d625a", "object_relation": "md5", "Tag": [ { "name": "AmsiETWPatch", "colour": "#EB2226", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan.Multi.AmsiETWPatch", "colour": "#D22695", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776212346, "uuid": "88de567c-b015-47a7-910f-de05e068d68d", "comment": "Malware payload (ValleyRAT)", "value": "2caa0eb6a0c179439afc256fb67bd611a70232aabbe11130858554f6b1f249c6", "object_relation": "sha256", "Tag": [ { "name": "AmsiETWPatch", "colour": "#EB2226", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan.Multi.AmsiETWPatch", "colour": "#D22695", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776212346, "uuid": "70b52229-ee51-480b-8965-085391bccc55", "comment": "Malware payload (ValleyRAT)", "value": "073217e30c2c56aee55b5aa74436719820e7f524", "object_relation": "sha1", "Tag": [ { "name": "AmsiETWPatch", "colour": "#EB2226", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan.Multi.AmsiETWPatch", "colour": "#D22695", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776212346, "uuid": "b831fdda-5a7a-4c47-9fd7-8049dc0e88cf", "comment": "Malware payload (ValleyRAT)", "value": "ccf84a48d3a6bc3fa23affc1a4b1a2c61a362840d3c5fc6d7a36d84aa7965ced4c7f06a7dca9c61578641cc68cebcee6", "object_relation": "sha3-384", "Tag": [ { "name": "AmsiETWPatch", "colour": "#EB2226", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan.Multi.AmsiETWPatch", "colour": "#D22695", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776212346, "uuid": "380cfba9-045b-4f9b-ad54-f31dd84cba9d", "value": "T1ECB77DD4B9ACCCD91E764A0A6E415F877C0902312387FED3F665FA89B22F6386021D57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776212346, "uuid": "2093c41a-3253-4b1c-aff9-d1951b69a4e4", "value": "668bc7640f4bff4dbced3f03b53a7419", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776212346, "uuid": "f0a7316e-6237-4c6c-8c25-e7be9b58aaa3", "value": "3072:JC8mh5Lu/cBx83oiZ2HNVZGOzHGi5x5zSZneGzPdOwUtortJ++uk+OPS7DSJfLqt:ohql8HG25+ZIrteDzuk+OU4t2j3mzOmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776212346, "uuid": "d6f098f4-8de8-4442-bd0c-0a3033a4244f", "value": 52673536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776212346, "uuid": "73dc87cd-3310-436c-b921-f0266f652ef3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776212346, "uuid": "e544f68c-3bb3-471c-b491-90175087e3b0", "value": "OBS\u5c4f\u5e55\u5f55\u5236\u56de\u653e20260311.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81dc1c92-390e-11f1-a769-42010a9c0008", "comment": "Malware payload (SNOWLIGHT)", "timestamp": 1776286989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776286989, "uuid": "af472f1a-bcd9-49cb-9874-960cfd2b1e07", "comment": "Malware payload (SNOWLIGHT)", "value": "a58541c14575de767f79f89078aad137", "object_relation": "md5", "Tag": [ { "name": "38-60-253-35", "colour": "#3E21E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SNOWLIGHT", "colour": "#36607F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776286989, "uuid": "ba8ad14e-f134-4b3d-939e-2e1ca373beb3", "comment": "Malware payload (SNOWLIGHT)", "value": "2d45e68676a7a14a1f9d991fce14f177900eda266626c5c7fb1c3efd8c3db0e9", "object_relation": "sha256", "Tag": [ { "name": "38-60-253-35", "colour": "#3E21E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SNOWLIGHT", "colour": "#36607F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776286989, "uuid": "ad061b0d-4fdd-48b5-a211-790a7ca59332", "comment": "Malware payload (SNOWLIGHT)", "value": "1fdc7b096ebec1fb01c9a82b5aff3c92db397046", "object_relation": "sha1", "Tag": [ { "name": "38-60-253-35", "colour": "#3E21E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SNOWLIGHT", "colour": "#36607F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776286989, "uuid": "b203f15f-07ca-42d8-9bcc-e7dd24dc58c9", "comment": "Malware payload (SNOWLIGHT)", "value": "54c613dbda0c2969af5d85ac5a0229821b655c784b71dbee962343d268f0640c64292564065ea57a31ef1225c5a5eedf", "object_relation": "sha3-384", "Tag": [ { "name": "38-60-253-35", "colour": "#3E21E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SNOWLIGHT", "colour": "#36607F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776286989, "uuid": "bbc13782-d2ac-4a89-9efd-5d10367560e2", "value": "T162A24B0EB3D324FCC11AC53888EB537AA775F4225AA95B291774D3353EB0A74AF35248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776286989, "uuid": "292899ae-1629-4a49-943c-35fc48def3ff", "value": "d1a7d73e0df819af6a00778362f2c567", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776286989, "uuid": "65728ee6-abd6-4a6b-ab59-719452904e60", "value": "384:vCZynL9R9f8LGQA0XSFGzhxsNXG1qw1qqjcMcdrxUhlpsrWFDWn8E:ve3LGQAfqD0XG1qUjcMcdr83xip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776286989, "uuid": "2566bab4-9cf5-466e-8ed3-2dc7ac6f0c4b", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776286989, "uuid": "9414af9d-258f-4c4a-b641-a2e3e966515f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776286989, "uuid": "b318d377-4dbb-4741-9941-d3a06016efbc", "value": "loader_v2_res.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b4c6d66-388c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776231144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776231144, "uuid": "53e59bf9-85b6-44c5-bb07-76b771a8f6b6", "comment": "Malware payload", "value": "324e68133edf3024a7ef8477a4b68727", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776231144, "uuid": "c6aea080-c9bc-4983-80ba-a12152f53d39", "comment": "Malware payload", "value": "2e59bb0360026814051d867f70f9aa801fb88f7da755a5461aa753d94cb55536", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776231144, "uuid": "a71e86f7-27c2-4035-801a-7ad33655ef34", "comment": "Malware payload", "value": "840eba3c86cf0843543dbccee3fbb21ab21874b1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776231144, "uuid": "83939529-ce61-4326-9c8d-8b1adba83a2c", "comment": "Malware payload", "value": "d490a0a8a1a8232f6405894a1cbefa8eb802453c05a7d54525bc7f47cb69d6040f74fad98670dca777a5f3756ea32fe1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776231144, "uuid": "fe7a4293-fa74-48aa-88b1-ed087cfe2f9a", "value": "T16CA2EFF1F8ECA43636DD843ABB9CA805A9CF7C2F4DAB7D2014575928411C75EA019B3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776231144, "uuid": "11006f4a-0732-415f-9f4e-29eba097b33e", "value": "384:bVc3s13isjsKG6qkSgjkjV/A4UAcGE3JNRhQuW5Q:QsyUMkSgjkjVdUAcd3JN3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776231144, "uuid": "0855ec5f-9452-47d9-8112-b9b023d97744", "value": 23096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776231144, "uuid": "d8a79dd8-0d33-4c55-8666-9f8aa1cbcde4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776231144, "uuid": "18747751-e579-4b82-a465-d47e6c3eae7b", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47bb23be-389d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776238358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238358, "uuid": "6e90a5ea-baee-4269-8e6b-48a2e00d520c", "comment": "Malware payload", "value": "732eb4c2c37d4ae07350c8b2c77882e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238358, "uuid": "0869c053-427f-4c20-ab21-0f3e240b6926", "comment": "Malware payload", "value": "2e9338feb1b56d1da46cddc5013570812236b9ea5f860d16f8d1c18ac08d7945", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238358, "uuid": "131319cc-89a6-416e-b24f-e2825eb2f7f4", "comment": "Malware payload", "value": "0943add0b660ec6ac934fe5aba4c9df9b5fcb09c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238358, "uuid": "49ad21d0-dd48-42b3-91a6-0b6a300e4e37", "comment": "Malware payload", "value": "0a9a450fa4daf7c69635851f8335b9c7b7e2dbb5a5bbe95de8fe8210a067f72acdb187e02b73b9b88ee155c978a00a88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238358, "uuid": "b4d88834-ce83-4f08-83fa-e5168c3b8736", "value": "T11BF23B487B98C22BDBAF0E7D75621A50167196621203CFD53ECC64EEFF937058612B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238358, "uuid": "8f77391c-ce66-4ac4-917f-a96d34c6921a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238358, "uuid": "4440ba69-369e-4b50-8e2a-a3f01252c188", "value": "768:DmQZqx1lYcTYbFyf8qiIQljnbaoXbYC10kow:D0lYiiIQljRbPow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776238358, "uuid": "2d0f371a-7ff8-44b2-9fb5-f7a48b1b7274", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776238358, "uuid": "eb2499dc-a007-40f4-a5a5-9764fe2022d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238358, "uuid": "0be65dcd-c921-4498-bf80-511741c0f92f", "value": "Silentum_Spoofer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c0a00f-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776239781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239781, "uuid": "5dfb5111-63af-493b-ad7f-012deb58bdd3", "comment": "Malware payload (AgentTesla)", "value": "9e344328a35cc5d0192d0401e831c71b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239781, "uuid": "8de83ea0-45ca-496f-ae0e-d306002138d1", "comment": "Malware payload (AgentTesla)", "value": "2eb0e981d79aa8407ccf4d54246cae7c343185e9326ac8b2919c3a55c6f3141d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239781, "uuid": "c8a4414c-9db9-4ce9-932a-4a13868aefc9", "comment": "Malware payload (AgentTesla)", "value": "24eacfc31d6c0dde928bcec6e075b2131a884608", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239781, "uuid": "fa97a107-56eb-4aa5-bd0c-1b89aa908c50", "comment": "Malware payload (AgentTesla)", "value": "4ee5d5eecc7f9cef142ec94897340cbfa4a8c990b5b28e67befa59418df12ff01988fb56efc4590c2595fbc99834b2a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239781, "uuid": "497a19d4-8beb-4bae-950f-b1abacb377df", "value": "T10734093DCAA9002AA1B7C214FDA60413E5377B57323DDC9C22C9128D46B354E79ADB6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239781, "uuid": "d13136e5-1036-4d60-ac71-afcc0fad3204", "value": "6144:7L3HvLQirGGpz5PKMmjZE4HhWAU6+XCS+c6sGO88nxhGevTfdb0hNEvAfv:P0EbjK/j64HhWH6+S85GjsxJL1byNEvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239781, "uuid": "200030e3-f815-4083-91bf-69b01e49a9ae", "value": 252314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239781, "uuid": "52fb4910-768d-4d6b-9fb6-1f3dddf4f39b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239781, "uuid": "3794cf70-f0ba-49cd-9162-dc99f4caf5f9", "value": "PI.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f44c4a4-38ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776257806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257806, "uuid": "8b52f5c6-8963-40f2-a8df-caa9e04a4c42", "comment": "Malware payload", "value": "5e1b9510fb8357bd6df4fb69a94f2626", "object_relation": "md5", "Tag": [ { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "livemap-back-ddns-net", "colour": "#E73106", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257806, "uuid": "3e9cc70c-cc2e-4cb0-abcc-9061a5a30795", "comment": "Malware payload", "value": "2eda2c838ea696f6ab1e74d2a1fa3c265234a32416a666f0efa3d065d0185552", "object_relation": "sha256", "Tag": [ { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "livemap-back-ddns-net", "colour": "#E73106", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257806, "uuid": "67cca727-1917-4a4e-950d-14c49671b266", "comment": "Malware payload", "value": "b2e77314113ac3703f934b434f9b153ec61cd77a", "object_relation": "sha1", "Tag": [ { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "livemap-back-ddns-net", "colour": "#E73106", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257806, "uuid": "31fd6ca9-bb4a-4c35-8b3c-cc98dd761b3b", "comment": "Malware payload", "value": "d3c8ca87a4e35d566716acf3e36891aa1b43499a258c5a5a0117f402d47e3c78828e1e50a3d10cf1aaec4fbc91e35153", "object_relation": "sha3-384", "Tag": [ { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "livemap-back-ddns-net", "colour": "#E73106", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257806, "uuid": "3e464e1f-6e77-48b2-b1f6-cf859f11fb21", "value": "T172272356F768D92FC87764B20DAA5232626B8D02CA839753694C375C78B71E80F4DBCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257806, "uuid": "fdf627a6-6bfc-4b31-a3b9-a54e11ea49c9", "value": "393216:H2Ifu8Wo34IjgF/m6RQibz6KWBVWAfKCGmcCn9zqPl519m/fhZBbM0g7:m034IjIz6iaKQBPcC92Hm/f5g0g7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776257806, "uuid": "acf49e5f-96c5-409d-a721-71206a8f0657", "value": 22228117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776257806, "uuid": "41298551-5f58-4cf4-9836-b29cfe39e101", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257806, "uuid": "bf908ab8-a2d0-420b-b978-368e40647aaf", "value": "2eda2c838ea696f6ab1e74d2a1fa3c265234a32416a666f0efa3d065d0185552.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275ef60c-389d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776238304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238304, "uuid": "d8101ef7-34ba-49b3-8902-dd0188f4c349", "comment": "Malware payload", "value": "bfcb27af7e91d65f8025bcef4245e79e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238304, "uuid": "b6f1e31c-890e-48af-b1cf-b75d9e7be111", "comment": "Malware payload", "value": "2f882fc104decbad4187a8456636d9a84b4b1d487563ada9adbcfa4e2db66147", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238304, "uuid": "2850e5dd-9e22-43d2-b563-5458a0faaa76", "comment": "Malware payload", "value": "6a6dc100b18581517d3e69f04d59ff67c48838bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238304, "uuid": "cd08dc62-fac7-4bdd-8064-2352ec04c60e", "comment": "Malware payload", "value": "f8ef38d53924929a3a319f0732b25923e776bf88ed9c3d13344be8ce5bd76bd00f3be36b1e03f76264fd37f2728bdb61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238304, "uuid": "15487b71-6beb-4415-9980-818afae2ffda", "value": "T13854C7243BFE4419F1BBAF765BF475968E3EF6A32A03951D0491034B0A32E41DD91B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238304, "uuid": "f9c2294f-4ad4-42d9-b83c-a523128afcf7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238304, "uuid": "cd980efb-3879-4bab-91a2-6306434aad90", "value": "6144:Qaoljc8M6DRDJF/gXK9CJb7Z75k6e/ii:QljfMc34X9ld66e/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776238304, "uuid": "895c2d38-d110-46e0-84c3-74889f86ff27", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776238304, "uuid": "b24e7cf4-2dac-4ff7-ba75-25b6e1606923", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238304, "uuid": "ba8e7972-24ee-4491-a46e-87ccc359ffe3", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4719a94a-389f-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776239216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239216, "uuid": "dd6ac211-b8cc-4cb5-9f2c-16bd3930af14", "comment": "Malware payload (PhantomStealer)", "value": "38834faa061faff5e2d141ae7f785f97", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239216, "uuid": "6b2cb3e1-7e15-4b56-84cb-ecaa284c6ede", "comment": "Malware payload (PhantomStealer)", "value": "30873159cc3e860c2594d2acb9c4b52a55c8f0ca9c15d6812a3915af052500db", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239216, "uuid": "e811d3c2-8dd6-476d-a4c5-09bd910d0d7e", "comment": "Malware payload (PhantomStealer)", "value": "09fcd320c29f7f8c1b7c0f1d778bdbd59fe5e2ff", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239216, "uuid": "1306fd43-a37a-443b-a16f-f7a933c27266", "comment": "Malware payload (PhantomStealer)", "value": "df6fa0d873abf5edcf1827f2773bee1c4df645798ebe3fc8fc820d192382bd675e4481012b9c797fdcad7992485d8bd1", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239216, "uuid": "c75185e3-8737-4bf3-a6a2-3897b54c9dd2", "value": "T1B333A374290C45EF2493EAB4B08867E3FE6C0A5C9FFD6A4F515487DA1A3E68734C3981", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239216, "uuid": "a145bc8a-cc08-4d56-9210-76f031f759f3", "value": "384:PacqLRGrEzdbZZe1h+c19OdO+Loh1JDZtTEM6J/LfZTxLkSt6Md3:ScqLR2Ezl61h+7dOmohHbLQfxxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239216, "uuid": "19488405-59da-43b6-9a1c-da5efadf54d6", "value": 52787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239216, "uuid": "4acae8d4-e9c1-43ac-8137-31a4e7e83d24", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239216, "uuid": "0c5cfaec-3cec-47b0-ae50-7f96bc468266", "value": "TELEX HBL DOCUMENT98423288984809.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c300738-390d-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776286443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776286443, "uuid": "9e85b8d4-cf68-4ddd-b5e2-42488771262d", "comment": "Malware payload (AsyncRAT)", "value": "84b247cb21b7fe4cd23dac4eadd9105a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776286443, "uuid": "8ab781de-db46-4aab-8b78-d74413693c51", "comment": "Malware payload (AsyncRAT)", "value": "3118da9187b9664b9e46f149689359691b5d5a580bec74b6993f301ef5d11583", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776286443, "uuid": "cbe6e2a6-40eb-43f9-85ed-44729450f3d3", "comment": "Malware payload (AsyncRAT)", "value": "9ea8786840c4e5485d8aead3453770fe57b49baf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776286443, "uuid": "9836630b-8beb-475b-b319-d627c066abbb", "comment": "Malware payload (AsyncRAT)", "value": "27bd19577e018b59e8292a3f80b2b3ae5c8f5d5daabbedb05076f2a7213c4616c5ce1387cbcf5e51c1776238d6c5924a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776286443, "uuid": "115c5f4c-a985-480d-b28b-6678b23e231e", "value": "T1FFD24C0837E58327DAEF2FF129B291010375D507D923DF9E5CD896AB6F67A8146003E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776286443, "uuid": "f8f1a25d-3750-4add-8686-641ca2fbf7bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776286443, "uuid": "d863ab94-b7fc-4ff6-a59f-c759777971b3", "value": "384:gTNpY2o+fk/KhlrWnYkHLZZ0pJDXlYECwaiU4sbRugtFuBLTIOZw/WVwvn9IkVuR:FB/wsYEwh1YETD9sbBFR9RmOqh/bT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776286443, "uuid": "1ba14d51-aa07-4846-bde9-c6c25e1fbcf3", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776286443, "uuid": "56fc024b-80a0-4f20-aef6-82096cd679db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776286443, "uuid": "649234e8-c344-4c15-9972-372e0f7788dc", "value": "XWormClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8431942a-387f-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1776225575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225575, "uuid": "efc75f4a-1408-43fe-8da4-f11cb279fc93", "comment": "Malware payload (Phorpiex)", "value": "5abf916dbf8084a69c7b1aa8f7b50bfb", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225575, "uuid": "6bd318cf-b005-4420-9842-9075720bdfa8", "comment": "Malware payload (Phorpiex)", "value": "328703046c590c713ad436b52790d9c59febb88132e380bdd20924569ebe81bc", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225575, "uuid": "6bd5f8af-7c44-4353-a218-ca481d801735", "comment": "Malware payload (Phorpiex)", "value": "cfcd823e4da10ffa2460d366f278c3ac98bbfdb2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225575, "uuid": "6758e267-5206-48b8-a18d-ef74da427bcb", "comment": "Malware payload (Phorpiex)", "value": "96b1ce1f50bf237b4c8c5184f167efdee60a413eab50f1155232867fd15c5ea35b9b1028350ce7219964a62ed8934086", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225575, "uuid": "909bbb1a-2d63-403d-bb98-2213ff4341d0", "value": "T171823B0FB9424216D0D200B49A76867BD97998B637C814EBF7D08AEE1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225575, "uuid": "5e204a7f-84fa-45fc-958a-07a593664f65", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225575, "uuid": "04449f56-2d3f-4f5c-9023-abdbf3386d64", "value": "384:MI78VGQic1fwvw077u9NHuagBhav8U9cr:dAj0769uha0UY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776225575, "uuid": "e3af509c-1978-471e-a2c0-fb1436670e2d", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776225575, "uuid": "526e0d17-6eca-4ae5-a0c2-c00f41b20299", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225575, "uuid": "e0cb8e95-79f4-4b38-ba63-8494350dac16", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a646fc-3894-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776234545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234545, "uuid": "fe4f676a-d8a7-4536-a206-a6844d2a6daf", "comment": "Malware payload", "value": "252652ed4ec0a8ec8bb8382e92340d97", "object_relation": "md5", "Tag": [ { "name": "Dienstangebot-Klement", "colour": "#522A09", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234545, "uuid": "809984a7-4c03-4ef9-b44e-8ca596226d5c", "comment": "Malware payload", "value": "32c2939decce20caccb9ffe0df030397443c56a78cd66ca59d20d896f2f37127", "object_relation": "sha256", "Tag": [ { "name": "Dienstangebot-Klement", "colour": "#522A09", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234545, "uuid": "3f76c341-232d-42c2-8617-f41ad5c6c8ee", "comment": "Malware payload", "value": "ba6c8bf4686d775f80169ec84d442d1aeb924ac1", "object_relation": "sha1", "Tag": [ { "name": "Dienstangebot-Klement", "colour": "#522A09", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234545, "uuid": "1c5b8883-24d0-4826-8efc-fa61b8ab67c1", "comment": "Malware payload", "value": "2fb71537de4a671a0552dd169cc86a065e26136957530d7246d86babe676f2912f69253aadae57cec712e409f6ca0d55", "object_relation": "sha3-384", "Tag": [ { "name": "Dienstangebot-Klement", "colour": "#522A09", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776234545, "uuid": "79ce8719-9fbe-4c15-957a-84ffe3d72b14", "value": "T15A7199C46AE91648F4B61F39E9BF7950193A7F1D9A15C68C0848D10D05F2A68CCAFFB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776234545, "uuid": "f981b469-62ef-4767-9a7a-33b528c13b7b", "value": "96:8iJFpXCrZEZ1CCCCnAABeEBo1X5DXPRc81zxFO0PAaloBUxAIBZzpoUAgisi:8iJF1oCCCAAjBmpDXPR31zzO0oaloaji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776234545, "uuid": "c618455b-f772-456a-8967-098da56b59d3", "value": 3769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776234545, "uuid": "a6555b5b-b447-47cd-a2bd-aac4126a44ea", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776234545, "uuid": "156d3d7d-00fd-45fa-bc57-1ce61c684282", "value": "Dienstangebot_A_Klement_18-03-26 docx lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2fc6f5f-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776239827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239827, "uuid": "bb4b9d5b-b07b-46f2-862b-58547f33b854", "comment": "Malware payload (AgentTesla)", "value": "b3b82caad21f2489984f365dbdb8922e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239827, "uuid": "2aa6d71c-bf21-4268-979e-fed4d3817f82", "comment": "Malware payload (AgentTesla)", "value": "3359619c9f75f1c0bc00b687a9f0dcfdc01407b89a1d938a5846ebcace8461d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239827, "uuid": "1b092c05-a782-4024-8a4a-18dd4a952da0", "comment": "Malware payload (AgentTesla)", "value": "6da49c4b1ae4b339f458e28422c8cf5b0a0ccaf6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239827, "uuid": "ba5288ab-d2cc-4d5c-b022-3d749de75b1e", "comment": "Malware payload (AgentTesla)", "value": "1ee0ede5b2d4ca5e92a1f7409a31364d04110abbcae57e5c51e892ba5a84420ef78e91ac8b92263214f575755becc558", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239827, "uuid": "ecd634a1-c6ad-41b2-ac3a-7bc7f9727eaa", "value": "T1FB65021186C43F68CF9C161D50FE260EB3A14E8A5419B68AFF73FD4AAFF7A04511B198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239827, "uuid": "fa915066-c245-4b8a-9557-da9e17b9b3e5", "value": "24576:vGR5s1MwtLdMp6spuzg2L11aE/4uf0ZUz3eID+G/jn:u3w9GneJ1d0ZUy6+cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239827, "uuid": "15dd4e6f-67a3-4037-a0a0-1915f9b87645", "value": 1437498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239827, "uuid": "1f54890a-f6ae-49a4-8b2b-752c71a3e505", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239827, "uuid": "33e10a6b-b759-4449-a674-ea95f90ed9a1", "value": "POENGG032.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a10d16f8-38fa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776278452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278452, "uuid": "bfb8db61-0e02-4bfa-b343-393b1cedfadd", "comment": "Malware payload (Mirai)", "value": "705d9238c5392d99b15ea15eec221ca2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278452, "uuid": "09fd6a4c-9e43-45ce-8ba7-b02261c1168f", "comment": "Malware payload (Mirai)", "value": "33f87d33a21d54fec8f71afdb953d7304f70b8cb5083a494e3235d661535f1a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278452, "uuid": "67a5d44a-b719-4054-9e35-24aef8967b52", "comment": "Malware payload (Mirai)", "value": "1e9adc8fe83d0bb892ab693edf89200feca1db80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278452, "uuid": "ee497dbb-88e5-4400-95c2-39f62181c30f", "comment": "Malware payload (Mirai)", "value": "98e6b2027c8b14442748eed7a96288d7ec3085a86488d90f21cb9141f646e9c101d67a66403fc9de57e82670c081e993", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278452, "uuid": "acbafc59-35c8-42d6-acbc-a48955225c25", "value": "T116D2E1898A1E65F8E9E70139C147B37E6CC3AE40FEC82B8428DF353647D1C65A065F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278452, "uuid": "9b0ef964-82b4-4a04-90f6-2dae84b2a9ca", "value": "768:baajh00oaZnvH2dbW+iawlnFMjMWqvMkNgwFSFiPmGsM:+G60oaRUiaMF0qvMkHSFiOLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776278452, "uuid": "10ed4613-fe1e-49bb-9bc1-72ff60034c22", "value": 29940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776278452, "uuid": "22a1a938-1d71-4b63-9372-416c22a557fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278452, "uuid": "d20e102d-e8a8-4ec0-97e2-d714c96d0271", "value": "FGx8SNCa4txePA.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20900859-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776239581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239581, "uuid": "d2f0d913-40fc-4aa9-9711-963e405518a7", "comment": "Malware payload (Formbook)", "value": "6e2bac6e535c260fde739241291faaa9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239581, "uuid": "b19d91f2-510b-49d7-bef8-e9d5b9a58bc2", "comment": "Malware payload (Formbook)", "value": "33fe1536a423be11bd3b530e661c8509e1c21773785ef41df17b7c507f340ef1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239581, "uuid": "50b0dbb7-bf66-4ab9-af9f-fc5f2e46c20c", "comment": "Malware payload (Formbook)", "value": "9a482b3262256dd02e4dfe3f31dc758a9861e38a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239581, "uuid": "82978177-a8d7-46f5-8c54-1bd0b3db83b8", "comment": "Malware payload (Formbook)", "value": "f1f666309305890a71f3aaf6b716b83a7eb1969b3bc902c8fda11fdb1eefdb34a5b8023a5edc96d9efa8d4c3f0752c1c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239581, "uuid": "a6385b41-7f30-4ba5-b440-8ac5dd6d0361", "value": "T17995021199C83FB9CFAC661940FE161EA3F049CA501A7989EF73BD4BBFE7A044117198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239581, "uuid": "cc679b02-2497-4d6c-96ac-cd51c35b6400", "value": "24576:fRwYSNVRxajPv1Bx0Q2kZ23usvuB1PphZjZsXdKIfpqmZGuCbILlCa7YM:5+aj3pLEFu99IfkI6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239581, "uuid": "fda1143f-80f8-4f5e-a21b-4536cfaff921", "value": 2029540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239581, "uuid": "77b24a7c-ee8b-4e76-aa74-77051af278d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239581, "uuid": "a539d4df-84e5-440f-b40e-56a97bd19d43", "value": "Order request 204S095.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427c7b9a-3912-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776288601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288601, "uuid": "cfeaadd2-fd0f-41e0-92e3-6d3d774c20dd", "comment": "Malware payload (NetSupport)", "value": "ef006bdc686cd06777c9dc9f16e8acf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288601, "uuid": "cf57188f-2832-4fb8-ba3e-c689f6a29272", "comment": "Malware payload (NetSupport)", "value": "348fee6177eb5f4a2148b44e8f7df0762f42adeb1abb3c3e1b310465e1a11054", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288601, "uuid": "7c449c97-5531-4f83-8c72-a3c6e56a5853", "comment": "Malware payload (NetSupport)", "value": "74be4ca7b473b09ad3009d36509285aafb232924", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288601, "uuid": "2a6b52e8-4660-43f0-ac07-6dde21ddd0ee", "comment": "Malware payload (NetSupport)", "value": "962cca67cb5f352d8d2de91383fab1a81ffeb62982cedd9d2603d38d86e7e7f19b1918e96066ef88871b9edfb301cf1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288601, "uuid": "ced6d75b-d403-4647-a417-f35483cfcd1d", "value": "T109064A0BEDBD8CE8C499E2348433A156BA647C405B3173D72BD1B6682E73BF09879B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288601, "uuid": "d1d8ee65-ba23-42b6-b1d0-5ab60e786834", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288601, "uuid": "8eb1faeb-957f-4bbc-af3d-5ecde1bb680d", "value": "49152:bKwf+NH2Shbq8HGnQ9SLbrZdCjKQcnZ5uv/20epnC1kCgtHt0o:b2yPX4A9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776288601, "uuid": "6a3dd9fb-e360-484a-b8fa-9f486ee0ac6e", "value": 3734016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776288601, "uuid": "f131947a-a566-479a-bf6f-23f8359a32cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288601, "uuid": "c75b1b03-c38d-4413-83d7-1e035d3387b8", "value": "SecuriteInfo.com.Variant.Ulise.596178.43658882", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7fa051-391d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776293320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293320, "uuid": "6ce6ce06-bb19-42cd-84ee-9618030f5c1d", "comment": "Malware payload", "value": "727c2c6a4097d9f7a9c3de128a710632", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293320, "uuid": "8f9eb398-cb28-43df-9992-c5b30bc549e3", "comment": "Malware payload", "value": "34db23f78f34b31071e2e87ed06a4468a33a44b539f46167b6e7b80f188f21df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293320, "uuid": "240dabd0-d1b9-422d-9021-c7e74ba61648", "comment": "Malware payload", "value": "6f1b331ea48080201dcda3ca6ad8183fdaadf25f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293320, "uuid": "abcc6e35-1cdb-4fac-92d3-283755610478", "comment": "Malware payload", "value": "7deea859128aeb71fcfb8e37919e8901b317d68d48bf0470686beb6823e74f99b39067b4fed5c9b600e8a9fdf6fdc953", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293320, "uuid": "ce94d2ef-ac64-4468-a5c3-2bc89df5300c", "value": "T1E893F649FD416B00D8D635FAFE4F024973934B6CE3FEB201AA245B2523CAA5B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293320, "uuid": "36ec80ce-33c5-4513-9710-ceada3e1140c", "value": "1536:QKnCrR75jFLNtCP5k2vJBbW0a+OJBgGsG9PlBqiLiRiHjz/NQZhYeUW:GR77L/qiU7bW0a+MBgGJGiHjz/NQzBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776293320, "uuid": "b5f87e02-ef7f-4d78-be72-bd68f364446c", "value": 93268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776293320, "uuid": "6799cf74-85ef-4a5f-bece-486132051634", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293320, "uuid": "da10c821-b997-4692-a558-2ecb9cefbca2", "value": ".Sassy.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "121e9c0c-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776239557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239557, "uuid": "4b8a29d1-e03f-4d1e-8e8d-9d8577fd54eb", "comment": "Malware payload (Formbook)", "value": "19d8b061925ef7f52595b73af67069f8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239557, "uuid": "3427ff3a-a811-4cb3-a75a-b82769021927", "comment": "Malware payload (Formbook)", "value": "362dffc9bf195a6c9902d96a61ee68b00b2ec9560e55db113fb43050949bcf97", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239557, "uuid": "f1f5025b-0e6f-4015-a4c2-b99846dcdab6", "comment": "Malware payload (Formbook)", "value": "202e708db8d4a92281a5a9ce7e6edb5f63f81208", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239557, "uuid": "5b6b63c3-7886-46db-98f0-0f9768a51c8e", "comment": "Malware payload (Formbook)", "value": "23908d9dc6ce3b9e314a0ce1652219dce5681935167f851849186e02755dba9109c07bdcf95c7a880f21bada97b4f1e6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239557, "uuid": "cb2353f0-3496-411e-b32e-4b8c683fcf30", "value": "T12295F1118AC42FA8CF9C561D90BE150EB3F14D8E5416B98AEB73BD4AEFF7A00511B19C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239557, "uuid": "5755f11a-b5eb-4ae4-b068-2ee5ea8057c5", "value": "24576:v8IJ9ZZPMQP/hqr3k/gd1cHFMjCTCWJVf6DuLOfVA5XhMsulIu2cAq:0IJBP/hHBxANb2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239557, "uuid": "521343fa-b115-48c0-845c-03c55c169ab1", "value": 2037378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239557, "uuid": "af39d53d-b231-476e-9a58-8579a660ba05", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239557, "uuid": "3275a1f1-a574-4333-a456-08c562eafd9c", "value": "MT103_12602172.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddfc791b-38f8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776277695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277695, "uuid": "6b97ea44-41d2-43b0-9386-ecc6e0b4a8a6", "comment": "Malware payload (Mirai)", "value": "c5edc097f27cde64b022f0191bd774ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277695, "uuid": "b10e0d18-5308-4a5b-b6c6-c1c2418e7810", "comment": "Malware payload (Mirai)", "value": "3683db3261e884f2b7cf7622c1ba519a6bf1d71527a1cdc53b4214102cfd5665", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277695, "uuid": "7ed71b06-45b7-439c-8d71-350c232c80f2", "comment": "Malware payload (Mirai)", "value": "85b7eaa9361a75b7516e3415773ccb60acfc9236", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277695, "uuid": "bf863194-9c37-49fa-821f-14f41d999e0a", "comment": "Malware payload (Mirai)", "value": "d85a59111a4a1ff00f0f20b1677ec7925b9a83d686fcfcdd9ad26457595b0ba017a1681f5e8055e6aec817f382b9017d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776277695, "uuid": "22721319-9d1e-43dc-a315-1570e8665fe5", "value": "T1F9B39DDBF2871161C89246F007CB4BAE3E2323C15F178AE73C69667969751DF8902F92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776277695, "uuid": "03da8567-b0d9-409e-ac84-caab43bf6eba", "value": "1536:QhmlPOHh1bhawTY+jSprkfxmW1toNK04gGnO/LWh:amlGHQwTY+jyMxhoNK04gGnOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776277695, "uuid": "7bb0437d-b40e-4bf0-b0ac-4826736ea16d", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776277695, "uuid": "4d976ae1-3b53-418b-8932-4aab28d5b5fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776277695, "uuid": "247f2cde-d663-4907-98a7-b9ebf3f59ae0", "value": "FGx8SNCa4txePA.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df1a6a2-3927-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776297586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776297586, "uuid": "ddf1ca08-4cf6-4b0b-9124-1ce0c9aa89a9", "comment": "Malware payload", "value": "d896a6242c5dcb20cb5b5bddb92845d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776297586, "uuid": "b4024f8f-bffc-43da-b2c9-71ff8961d89e", "comment": "Malware payload", "value": "3771d77b1b565282526460398e9f4469d84a76c6d5d3d2a53fec69b8a3061ab0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776297586, "uuid": "734331cc-c0cc-4232-ab86-fe52b65c1256", "comment": "Malware payload", "value": "e026695b03d74baeacfd67b1a5fa35a79f475854", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776297586, "uuid": "8b7c9d78-951a-41f5-b8b6-fa42c324845b", "comment": "Malware payload", "value": "791f71c4af614f689f4fed49dfc6faf841bf9fc14fd328173372884542a6661b37f63c1ec914174004fd732798f9773c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776297586, "uuid": "0bd5a2a4-be38-4e8c-af6a-636bb10f1926", "value": "T19CC30985FC559B17CAC262BBFB4E438D772A1758D3FE720399256F20378B85A0E36142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776297586, "uuid": "a65c45ea-2be6-400e-8f21-e60ca3b23d1e", "value": "1536:z9v4oigG66/1FAb6VWwfLfIT53peX3QOHMBCphkJjalnywyw7zXLQRqP6VJFeIVc:z9goigG6Y1F5cwzIF3pmymhE7E7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776297586, "uuid": "fda66a92-e87f-472f-85ad-ce43231eb76f", "value": 121376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776297586, "uuid": "07561da0-0520-4096-b52d-1b7dfba836d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776297586, "uuid": "0c21e967-44a6-44a3-bedb-f6ef9939da68", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cd9a412-3916-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776290417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290417, "uuid": "73dc45be-92a6-44c8-b01c-910e8177a251", "comment": "Malware payload", "value": "515bd88de08948bfa1b086087cfe479d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290417, "uuid": "dfcfac8b-4e8a-46d7-b761-8963dd037186", "comment": "Malware payload", "value": "37fb059d66f036d9fcbde38eae1f577e5c214713ed0f2c2ff42f893c3b16e035", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290417, "uuid": "e61f4e57-46c7-4f47-bfd9-e8637a137ebc", "comment": "Malware payload", "value": "44802631843780b0cc061783730a0ca4737c4c09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290417, "uuid": "d33e9f67-68a1-45bf-9978-e6aca14de19c", "comment": "Malware payload", "value": "bada760c40d300c0d7481ab9c2d6b17a720dfc5e4033442f2065435e6f3dd5796fb61cba86fd775e64235e3ca268448e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290417, "uuid": "98521e54-2096-41f6-a7f4-5829a056390b", "value": "T1A2F45C517660D7AEF6761639B4CAC36E6454BC30AD06038FF1B07EA847B2EAC4F86351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290417, "uuid": "c27738d3-5425-41a4-a6ca-cf1544d12958", "value": "0293eec0b5432ad092f24065016203b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290417, "uuid": "ceabe339-ec4a-4bf1-8210-edc403313059", "value": "12288:0SW9MrpT34uxqhxw3L9X/qLu6GRMKABrhfaEwTr4IeY3:0SW9MrpT3kbw3LpyLur0BYEwTkzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776290417, "uuid": "c89fb015-61be-4abe-85c8-66beed6bee99", "value": 753720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776290417, "uuid": "9030d663-11a3-42bb-96e6-27aa1cd7ff35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290417, "uuid": "44a182b5-ea6c-49e7-a4af-1187698167d9", "value": "rShippingdocuments.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5be6ec2-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776239805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239805, "uuid": "e2f5866a-cec0-4c15-8d57-d01b2d07ea9e", "comment": "Malware payload (AgentTesla)", "value": "4dc6c4f6c5ec57b9713282d4c25f1b2e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239805, "uuid": "edaab792-2e6f-4c71-b491-5627578d32fb", "comment": "Malware payload (AgentTesla)", "value": "3879be5488a07314981931bde2252051c339407e76e06cb19ee352f5e025f3f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239805, "uuid": "d2257384-469b-4d7b-ae41-17a810de61b9", "comment": "Malware payload (AgentTesla)", "value": "e93788833576f647bef1dc6180471aa67ff5ef07", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239805, "uuid": "ed059ee1-8258-49a8-b9f9-26059a82ee71", "comment": "Malware payload (AgentTesla)", "value": "86ceb86c8aa38476a860f3b17869b38b58aa6b6d9ffa49a4140b8dc07872b4e2e94a1156074f2818205c72d603a890cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239805, "uuid": "a674176b-dfad-48e3-b26c-134b11054259", "value": "T10665021559C83FB8CFB81A2980BE161AA3F08D8650197989EB73FD4AFFF7A04411B1D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239805, "uuid": "4fe83b8e-44ac-474b-8969-a78c0bd8ab54", "value": "24576:jKwC0r90G2z7tC/BecduIRvhmyWOkhlQqQykc7Vrf6dKk4KEf8leGz:/B0pC/FucmtBQArfxJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239805, "uuid": "e769de40-21ed-471a-82ae-27404e8e23c5", "value": 1410955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239805, "uuid": "13050bec-4268-4aed-9cb0-5ac6e382f730", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239805, "uuid": "11b7b3ec-202c-43fc-b7a4-e27c06f0ce01", "value": "Nuevo pedido, mayor volumen.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b65a7dea-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776239833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239833, "uuid": "3a8f0109-dca0-4c89-aea9-b9abf414f4e8", "comment": "Malware payload", "value": "f6c80906e1fe833a74a3392e49f420ac", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239833, "uuid": "e046580a-7877-4120-be62-216f09bfede0", "comment": "Malware payload", "value": "3899a535c02c68254006e46980f04bfe12a084b5cbac697f0075013c5bf0148b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239833, "uuid": "b87275b7-868f-47dd-bd6a-63581b04f678", "comment": "Malware payload", "value": "2d72a660be8ad3e14bb457c76162f0e989e0da47", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239833, "uuid": "43b53704-1bad-4003-b112-27f0e78198f0", "comment": "Malware payload", "value": "4fe82383a2dc879eeb91bc0201e50431cfab2e8a38286d0558df787c6bc01f8468d563625c00a32016b729a01fb2df7f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239833, "uuid": "e82d5e42-41b6-49e0-9e4e-c8bd5ae9d0de", "value": "T114531345D79C0BB73DDC25BBB68502894D2FEE21C988E8FB26158F8B9D5C6C405EDC22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239833, "uuid": "67c08f78-065c-4a59-b526-2d0ba64e6350", "value": "768:4RAeMY6uwym/TgLnvMXlF4oLZ9nh11WL3fPrifiaLHbjbmxag1P+4cXNXCfQ31+L:itvD0nLkm4e+d1QLo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239833, "uuid": "580db3a7-bd8a-409b-bf01-b3e59078c163", "value": 63255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239833, "uuid": "1a1a9192-225a-426e-85e0-79d430187490", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239833, "uuid": "e2a4e9f5-fd15-4e5c-a47e-e25520c39e67", "value": "invoice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad788ca8-38a6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776242395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242395, "uuid": "f490b533-e3fc-4587-825d-df1d587eb165", "comment": "Malware payload", "value": "bdef87de5929a5e5ea0ca4fbde584f63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242395, "uuid": "562d4dd0-caa1-49c2-9e7d-a59b641758a6", "comment": "Malware payload", "value": "390ca378978bedc3f71db8f79c294afd1da652117297729d2dd946eb9e6b6825", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242395, "uuid": "03db395f-c4bf-4705-bd2e-155b7e6d152d", "comment": "Malware payload", "value": "90d311b9d57bc68649886fb322eee2d0f557d81e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242395, "uuid": "fc237430-8f24-4039-a910-623999951b40", "comment": "Malware payload", "value": "ad64d1328ad212dc6909715b128bc192ff1266655baa06fb91ee5518033c046dac867b391a8e5ef669a7f2d2443fd53f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242395, "uuid": "d12a1204-79ac-4db4-b45c-a06c3d1644a7", "value": "T1F5146C19BA5540FAE26B8538C9521D05FB737C4647A0AACF47900AF69F237E0EE3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242395, "uuid": "7e920cf7-aef1-41cf-afd3-d21a067cf50c", "value": "6b2cae8aa855bea0054b484f646ff01e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242395, "uuid": "64f233dc-245a-48ed-8912-195363befe6c", "value": "3072:nCAjPxdo9Ka04Vz83Yf6fci4kz7/hObAFgiEn:nCA1doMaxVAIS9QbAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776242395, "uuid": "b0b052a7-1be1-4700-ae93-1a16fdbef4c8", "value": 194048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776242395, "uuid": "e366a07b-8518-49fd-9805-ad51f0aa0ee4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242395, "uuid": "e872765f-1a6a-40f9-a0b5-39a941beed14", "value": "SecuriteInfo.com.Variant.Tedy.906630.55697618", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61de7742-38ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776257730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257730, "uuid": "be8a7ff1-f22b-49dc-8b63-6ab2f9e3e468", "comment": "Malware payload", "value": "31514358bf684a1e466a9e8069c11031", "object_relation": "md5", "Tag": [ { "name": "147-93-58-117", "colour": "#818D5D", "exportable": true, "hide_tag": false }, { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257730, "uuid": "c49a6255-ca9b-4a04-b43e-d7eba7653493", "comment": "Malware payload", "value": "39901ffa746a6f6ac3de2b36d9e61e0d60b221f4d9510436fd3cb3d2d7362130", "object_relation": "sha256", "Tag": [ { "name": "147-93-58-117", "colour": "#818D5D", "exportable": true, "hide_tag": false }, { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257730, "uuid": "d564f78b-1992-42f9-8e99-72b15b560939", "comment": "Malware payload", "value": "71e292745c4d86ef0d5c69b724d93379915dab15", "object_relation": "sha1", "Tag": [ { "name": "147-93-58-117", "colour": "#818D5D", "exportable": true, "hide_tag": false }, { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257730, "uuid": "e9613a53-0d17-4dae-9a94-9d268efb3c28", "comment": "Malware payload", "value": "fb97c0d1c7131c19b7936081527a05ea058809661427b95bf6b71a13b7ec644e4587f5de330318a57192049a91191b7a", "object_relation": "sha3-384", "Tag": [ { "name": "147-93-58-117", "colour": "#818D5D", "exportable": true, "hide_tag": false }, { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257730, "uuid": "2ba08dfc-7774-4b7a-9080-05597db0732e", "value": "T11BB623C6F7A89D2FC8B710B68D6A66B1125A4C12C7839F477944371C38776E80F99BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257730, "uuid": "99a0a543-5019-4251-a85e-6b2c15b60b20", "value": "196608:0lS8A1d2Dzj8ORCWEEtit462b1ISD3YiFgNxqjX/aK+JBW/X2XBS3e2bo+2:0RA1wDzRuEosbewmNxQXC16/X2REe2b6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776257730, "uuid": "3c79fdbc-0313-496e-bcde-a59245238b0c", "value": 11142887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776257730, "uuid": "b69a9789-cb93-440c-9e86-bd3ccc0db723", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257730, "uuid": "8bfcc43c-a287-418d-bb39-f565c55ba947", "value": "39901ffa746a6f6ac3de2b36d9e61e0d60b221f4d9510436fd3cb3d2d7362130.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d1fedfd-3872-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776219899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776219899, "uuid": "1224766c-da76-4e6b-b4ac-a4e344d83bfa", "comment": "Malware payload", "value": "6c00d87f7d9bcff9d9533e1d69fe7f6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776219899, "uuid": "2ff35b0d-c08e-41a1-8ada-7de0f02380a4", "comment": "Malware payload", "value": "39a3b8a0609dce39b71ed24c32dfbea89fafdc7dd49f2143ec2c74dd581c8f7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776219899, "uuid": "b02ccdb4-b612-46ee-896d-f107b9b57c6e", "comment": "Malware payload", "value": "cdb8d9ea9ed9896ec1ae79764ceae9e3f4ff4b9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776219899, "uuid": "3c06d168-f52e-495f-b7e0-133ff61a141d", "comment": "Malware payload", "value": "227ad6909a77b50e268aea97b1e61d12c61661469e69ae7d00eb1604b312213c95926f967286e09dcb19ffcbd1bee921", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776219899, "uuid": "0377fd81-0d3a-4e75-b01c-c3582bf3d5bc", "value": "T13CE623EA85D922F4DCD70A80674F57CE30D0615E59A9AC2C35CB2C429F36EAB424DE73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776219899, "uuid": "c19d7abc-4dd2-4eaa-aeca-b1a401ac0c8b", "value": "a5a596d815c802faa2d0bd187fa3a147", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776219899, "uuid": "3f05a220-f488-4cc8-9406-34bddec0569f", "value": "196608:/wqQyD+DUPDNfiQDlQA8AvSCDbNdOezVXNZfrI9u5ra3Ar3gdv:vQyD+DGiYVFRdNXJ5qdv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776219899, "uuid": "5a2bcfe1-eb80-4a17-a22a-b6369cb1a29b", "value": 14375888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776219899, "uuid": "768609d7-a441-40a7-ba69-36467e50b2d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776219899, "uuid": "eac24fe0-15ef-4870-a23a-341c37d728aa", "value": "ExtremeInjector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f9be8c9-38bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776252250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252250, "uuid": "6361990f-cdf6-46e9-a509-3031c4d992be", "comment": "Malware payload (Mirai)", "value": "72ad13b7372d4701efbd460bdc1cc1fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252250, "uuid": "245c2fe6-51f2-4b73-b73e-f0f478bac45f", "comment": "Malware payload (Mirai)", "value": "3a7a4b9fb87105d2cf16dfb1b69f106db82a6f75c117aa027841c0da8937ca14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252250, "uuid": "adc4b530-17ce-41e2-9140-e237f7fab8ef", "comment": "Malware payload (Mirai)", "value": "c6313eb8f9727a1dcf410b788b1bd4191ef9d70b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252250, "uuid": "b07767df-fc1b-4702-8531-321d1c26e14d", "comment": "Malware payload (Mirai)", "value": "1748eb8be95149c1b88ea66b0ac8443e0e540b6195d9bd056a7462eb4a10f06bf3d259d08917a26efcd168fe5da90113", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252250, "uuid": "760fa04b-afcb-4881-a64f-3637701d7c1f", "value": "T1C873025547146CA7D8127F3C89E2CF65CDA69EB37EE8F880B9A8DF48CDD8055094341E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252250, "uuid": "061ef44e-6fa2-4894-8050-7185bf50a270", "value": "1536:9L8HfSg5E+i3MZ/MZdLgGn5tAMQv1ujurrqPWjSU0Eknbdvco/VJuZ:9LafSg5EbMZEZ9gU5KMQv1uCqKFMZZ/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776252250, "uuid": "2a4d195a-8d41-4fea-aff5-e2968a5a96a9", "value": 75448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776252250, "uuid": "5627718b-366f-4451-ba45-78c85d7169ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252250, "uuid": "43d93701-4475-403a-98da-51fd5668a48e", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340f0f8d-38ab-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776244338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776244338, "uuid": "8fdeceab-5c1b-4716-96b0-847be3a0a404", "comment": "Malware payload (AgentTesla)", "value": "eebdc958c0bcd9003bec0b9432713928", "object_relation": "md5", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "tecnoruoteindustriali-it", "colour": "#1EC7BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776244338, "uuid": "0a70a384-d133-4174-b555-6a74c231b9f6", "comment": "Malware payload (AgentTesla)", "value": "3a9019bc4d0b77313357a86ef0045b19ae35fd6eabe7f9a24eca7fe49bc6a2b5", "object_relation": "sha256", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "tecnoruoteindustriali-it", "colour": "#1EC7BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776244338, "uuid": "141fe6e3-eee3-4bc5-9786-f7b3a3aee785", "comment": "Malware payload (AgentTesla)", "value": "efd1e66b5683e7ee4f112d085a1dcba7d84c21ec", "object_relation": "sha1", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "tecnoruoteindustriali-it", "colour": "#1EC7BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776244338, "uuid": "ecdeb904-41f4-4c66-befc-c6787ebbfd25", "comment": "Malware payload (AgentTesla)", "value": "50d9b96ed747a5e670a91f2f1b47ed95d72b8a0a854b7e1801a521f2061ca61db7e5447e8aee36727f74f837272105bc", "object_relation": "sha3-384", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "tecnoruoteindustriali-it", "colour": "#1EC7BC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776244338, "uuid": "7940298d-723c-4af3-a5a8-7cc151949691", "value": "T155A2229E9A13C7E8073F67085C770DE5B49AE20787339CF4E26D533B1A02164D7A4AE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776244338, "uuid": "eceed76f-dac6-4947-a422-1b0877763db2", "value": "384:70mXOJGZAAKU+4DKdD4YkPi8tTbSlVyWsPuILZXEi9U2ltGHIx:5eJGZNKj5k0yTlF9UstiO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776244338, "uuid": "96b4929a-1993-4820-b578-749ac4f9b876", "value": 23216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776244338, "uuid": "cb318b10-d343-477c-8cbd-97f1ddee7cf5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776244338, "uuid": "e0e2662f-3151-46d9-9412-e844cbef6fd9", "value": "IMG20260415-02271.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7181065-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776239861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239861, "uuid": "586eb27a-d6ab-4543-a2bb-14361a177db8", "comment": "Malware payload (AgentTesla)", "value": "2b0444ce3134a90289f35adc229d0085", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239861, "uuid": "aee44bb7-c028-42f6-9d4a-27a420c8e4e8", "comment": "Malware payload (AgentTesla)", "value": "3a99e7cdc5000d4d7f72588d9c51be9cf32626065a709d9c80ffbe1ea329b23a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239861, "uuid": "066ba4db-e282-4af3-b912-28c28e2e31f8", "comment": "Malware payload (AgentTesla)", "value": "c4057752d11d9b9b2afee9f9e579cca956b472d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239861, "uuid": "0de2c6a8-bf12-4b80-a3b2-fbc82fa1089a", "comment": "Malware payload (AgentTesla)", "value": "5fe554a063ba0dbd600f7e3bfa13052e76e74e7838cd80489dd56fce32225f81ee4a92015ba805f2af77741cca2c0b8c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239861, "uuid": "89c7f7fa-55fb-4bd7-9e02-03abb4ccaab1", "value": "T13094E18862C53FA44799292B587F610EF3B54C496058A086FFB2FC5DFF767048137AA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239861, "uuid": "3f91ea61-b0dc-4c7c-b43b-dcb6f1e20a08", "value": "6144:vtslne/UQOg+HftI+lsYE2pOrcAq3qFLgZv1thtg/7QMfmhbEWp+BxRQNgiG8let:vRZGtDAq3CgHtTg02mZEWp+bSgN8lCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239861, "uuid": "4973d3b1-ff4f-4a28-9762-13fbfc248309", "value": 419078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239861, "uuid": "6e20f430-0809-4677-91e1-31620450d138", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239861, "uuid": "38feaeaa-8916-48eb-9404-7093e0e82c90", "value": "ORDEN DE COMPRA.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ebe584-391c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776293004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293004, "uuid": "f8d0030f-eb6f-4761-bd33-f4b2fa3861c7", "comment": "Malware payload (Mirai)", "value": "4430bc6390dad6d0b8d3ff5a1e750d53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293004, "uuid": "1008f487-3c83-4cb2-bad8-57f68333537d", "comment": "Malware payload (Mirai)", "value": "3ab22fec751235745f9ae17a4f722fb76366df228f43098665bdd7e151621170", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293004, "uuid": "39f5d3fa-5e64-4c55-954b-6f910e4d52fc", "comment": "Malware payload (Mirai)", "value": "49de0bac2724169c992d7a95162af7310453f4b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293004, "uuid": "8169246a-692c-4e84-b605-a5826f115062", "comment": "Malware payload (Mirai)", "value": "ecd18e787321969dfd321a7c19e78b0b2b4547efe710b94018a503f1ac62eacfe66484876b19ef303d237ace80dae69a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293004, "uuid": "e994f820-e966-4c2c-85aa-4437f423d407", "value": "T1D5C39DA7B34F1490C82207F45BCB5B5C2E3325019E2B96E77C6E763E1E365DA58063E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293004, "uuid": "8e22e173-ae7f-4a7d-885e-720562a5291f", "value": "3072:dErWprnzhXbYys/+4aF/YaCSc+qG/fVgeCG7dL0oYq:dErUzTs24uQ1ScVGXtCG7d+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776293004, "uuid": "a716755a-7b25-4174-a227-a90279a08bfd", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776293004, "uuid": "d4a3ac8c-a7f8-4143-a0c6-67c0b352e4f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293004, "uuid": "5a738ea2-57a1-4ca2-91de-b46db9dcff26", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbed8243-38b4-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776248486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776248486, "uuid": "22501520-3d94-4787-ba2e-80f6e9591b44", "comment": "Malware payload (ValleyRAT)", "value": "480343a631d52439ad2a36c098a5dc75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RokRat", "colour": "#3F471A", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.RokRat", "colour": "#42CA5E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776248486, "uuid": "d566d5a7-9157-4128-b226-39e37b753244", "comment": "Malware payload (ValleyRAT)", "value": "3ad7da28ef1ba24f7724bf52425bc936f013b94f9e369ad84e1bcb860286f5e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RokRat", "colour": "#3F471A", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.RokRat", "colour": "#42CA5E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776248486, "uuid": "883c51c5-566b-496f-af0a-8a25f8634255", "comment": "Malware payload (ValleyRAT)", "value": "530c4b9660c3c7f1dbd6e402ce69568406363a3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RokRat", "colour": "#3F471A", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.RokRat", "colour": "#42CA5E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776248486, "uuid": "16ff9ac6-4416-4b8b-a88c-5e83de7c1359", "comment": "Malware payload (ValleyRAT)", "value": "d7875bb3151e64e361d3139b423f5110269861679e99437bb91ea088bbfbf9725ff4ec0d873a2d0c5d63f73062bf4093", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RokRat", "colour": "#3F471A", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.RokRat", "colour": "#42CA5E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776248486, "uuid": "c23df9ef-afb3-44cf-aca1-d553a108099e", "value": "T102747D16FB9689F8F12BC078824149326A737C890721BEFB67A44B353F56EE15E38714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776248486, "uuid": "d2129d9d-ccec-4b80-b056-071222e64bcb", "value": "dd29298ce51dfc8d7e9a5f6be4d6377b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776248486, "uuid": "ebb17c2d-ffed-403f-b37c-2be6124505b3", "value": "6144:vi0Mm5SS2iCwFCJ1/U8GhhT7moLHYICmU+YBo:rVxEzc8GBLHYICmUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776248486, "uuid": "130a6892-1ac1-49a6-9eca-fa10754a2a7b", "value": 363008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776248486, "uuid": "64dc77d8-8e1f-4928-b937-b49cc8c8e319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776248486, "uuid": "473bbf7d-ac3a-45c7-84b9-309b55fa098a", "value": "2026\u5e74\u7b2c\u4e00\u5b63\u5ea6\u5185\u804c\u4eba\u5458\u8fdd\u7eaa\u540d\u5355\u4fe1\u606f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff272724-38fa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776278609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278609, "uuid": "b441a5c8-8ac0-40c1-a18c-0c35ba5ef580", "comment": "Malware payload (Mirai)", "value": "1d72c4899a3c6b4069c2d880390f9a5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278609, "uuid": "500cffc1-018a-48ea-82a0-0a2831422c49", "comment": "Malware payload (Mirai)", "value": "3ade1a199c74c3360cc24f9e1471b31fe1240753225a7ed3b70fc7e36953fed7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278609, "uuid": "e2e270d3-bbe0-431a-a3a8-47428a72c8f3", "comment": "Malware payload (Mirai)", "value": "e90a91ea8c7abc49ca1ec99ba3f07a6870d98891", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278609, "uuid": "602befe7-e232-4acb-9fed-893cba562e55", "comment": "Malware payload (Mirai)", "value": "58858d648f6d50b70b58a7bd872bf7b304ec9c14ea8112287ea9d0f5d169212f3c10003f46d93f3184ea576438ae0c8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278609, "uuid": "673464e5-5b6c-49bc-9f68-4054f8479316", "value": "T1F9633B91FC819A13C5C5037AFAAE428D3B2613E8E2DA7217CE255F2137C651B0C6BE65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278609, "uuid": "90ba3c90-4224-476b-b8b2-08db5172b33e", "value": "1536:FlLaq6tjm6X2qN+UfKGLYSJWwm1b5BY69Gvtu:FlODf9JTm3iLtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776278609, "uuid": "020bc035-cb53-4835-85c6-750aa88869aa", "value": 68316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776278609, "uuid": "e3e2a31d-8b0c-48e6-a43e-efd119e0e02a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278609, "uuid": "7a2a5d82-54d0-49f1-a68a-edc91dc2e903", "value": "FGx8SNCa4txePA.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb25ce30-38c9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776257477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257477, "uuid": "a78ea94c-1022-4945-ae57-e016f499870e", "comment": "Malware payload", "value": "2632d7f26f9bbc02d11640c4a109bcf3", "object_relation": "md5", "Tag": [ { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "livemap-back-ddns-net", "colour": "#E73106", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257477, "uuid": "e19651ec-a767-4176-958a-abfc9974acee", "comment": "Malware payload", "value": "3b5adb76e37e4cc999e281068d1f3e6f82cab8055c6b46c2e6de1b6ea8499a7e", "object_relation": "sha256", "Tag": [ { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "livemap-back-ddns-net", "colour": "#E73106", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257477, "uuid": "43d6697b-9b16-4f47-8740-7aced85f8c37", "comment": "Malware payload", "value": "ae447ea4f5a73f4d918767dca673a2774a313e9c", "object_relation": "sha1", "Tag": [ { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "livemap-back-ddns-net", "colour": "#E73106", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257477, "uuid": "3c064ecd-045f-496d-b86e-0084688c8cb0", "comment": "Malware payload", "value": "c5e2dde42346ec23c3c3997843402f5d5b7a1c293897ede8751dcc58a2a9f1ae8b5f3e7fc8500722d8be241d61a34319", "object_relation": "sha3-384", "Tag": [ { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "livemap-back-ddns-net", "colour": "#E73106", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257477, "uuid": "aa29cdf8-d683-4b6d-a49d-496217648c6c", "value": "T1E918E147F6428CA7CDE55470A55ED277B3223D6CC352A213AA44B7287EBB7D44F2A380", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257477, "uuid": "e4dd9ab5-f999-445d-8a46-d701b84e56e8", "value": "786432:fKTXx8hpRVAgfsVI0mke75jT0ZfR7LzfvfWyYEL9aoW56k1mApPfjO52Qm/fiJU9:iTef9R5fyYLT1Y52QzJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776257477, "uuid": "44938e61-f142-4909-9990-73e52243c1b0", "value": 87404292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776257477, "uuid": "5c39297c-1035-43d0-9626-bcee8c55f904", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257477, "uuid": "5f008b30-ce52-45f1-ad06-6ae1171535ae", "value": "3b5adb76e37e4cc999e281068d1f3e6f82cab8055c6b46c2e6de1b6ea8499a7e.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ff86fb-38cf-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776260121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260121, "uuid": "8cf73642-d532-4e2e-bc61-f3ee7292bc74", "comment": "Malware payload (ConnectWise)", "value": "4218a7f1cde2a075b731c83e115c21a6", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260121, "uuid": "4134875d-6243-4501-abb2-394b4452b512", "comment": "Malware payload (ConnectWise)", "value": "3bb89515ab455a2c8f2918903d34a2cd48704c66f24cfbe85c97cc097bd3b364", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260121, "uuid": "5013f878-c172-4cef-8499-308309417036", "comment": "Malware payload (ConnectWise)", "value": "fd82b17cb16e00dc17aa0eab37235c2dd571f8e3", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260121, "uuid": "5d9c3433-5a9b-4385-bc41-72da0772075c", "comment": "Malware payload (ConnectWise)", "value": "df6cbd3df082579e3dcb9d3c8c61b878101a64513a4923dfefae7da3c95422e2806c4ec8c240bb2f118f05b898114e28", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776260121, "uuid": "55384812-a952-48f3-9ac6-9a2b210b80c7", "value": "T1FF95F13136E8C039E2B61A39E83A85F15979BD24DA63C15F83647D1E3970E9096B3733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776260121, "uuid": "bf3cab11-6910-4130-a035-f08bf1d06f25", "value": "49152:z/czgQ52NHC7eFc7339O9JHAzYqWXGuaYzr2G1g:zigQ8NHzc79O9lAYqqGNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776260121, "uuid": "420e43d8-b594-456d-979e-6c2d642a11a0", "value": 1884160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776260121, "uuid": "07f6f302-0b0b-43f6-8e13-f57078e02320", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776260121, "uuid": "a1567d4e-36a8-405d-bbcf-7bcda9a16567", "value": "SecuriteInfo.com.Riskware.MSIL.ScreenConnect.Heur.21205.18518", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0024dd55-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776239527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239527, "uuid": "1111f799-fa44-4660-b7f5-df685eda77da", "comment": "Malware payload", "value": "3fc830e15532816cbdfb87201d7f9c0e", "object_relation": "md5", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239527, "uuid": "cfb2ba83-4ff7-4196-968b-81d8d518a8d9", "comment": "Malware payload", "value": "3bf778e4f4cfc41decdbadc4f5d91cbca3696be47b554b61f12fb6c6d5a34770", "object_relation": "sha256", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239527, "uuid": "949b465e-656a-4815-a5be-9d0a94302333", "comment": "Malware payload", "value": "e47a9af295978e7c50396f195a341f7d96b27c00", "object_relation": "sha1", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239527, "uuid": "84445b43-fa5f-4a60-a593-24f40e7d8265", "comment": "Malware payload", "value": "1be885e3e32cc750edc5f42eddc8f3e51c162063da5e13d5ae2a4262882ffb3162adfd7e143f62f4341afa022ea1f4b4", "object_relation": "sha3-384", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239527, "uuid": "447d95fd-9095-49b2-8f65-b1bb07198d08", "value": "T18E840243B3D68D47E39B027D7D53D9C72940BC1AABA1426F31A47BCE34306562D3D8AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239527, "uuid": "0ba2cc4d-2adb-469f-b20a-662d28fa31d4", "value": "6144:ekgkER2x4Rxfu7xYJAGv6oLIQ17MwvcdNyLVSnhaeuVNZRPdE6NwBkbKPFyD:ek2R2j7x0XvHLSHyRMjubDPHNwWbKPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239527, "uuid": "62ed9cf4-16ff-4c17-9814-1da65d134121", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239527, "uuid": "4a34d0ab-c8b0-45e3-9981-661b2e44c431", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239527, "uuid": "6714a4ad-536b-4d60-941f-eb9cdbcb0420", "value": "Hsbc Payment Advice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4232ca21-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776239638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239638, "uuid": "24e14ee7-1443-4750-a98a-e13fb3f7ff33", "comment": "Malware payload (AgentTesla)", "value": "9592062ae5d90935fd1a419e6c440070", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239638, "uuid": "850a0d43-afbd-4cc2-a02a-a721751667b7", "comment": "Malware payload (AgentTesla)", "value": "3c6fd17b9f959fcb6cc932f5b9219588da2cb055eb38c35d6bf23c9a742df655", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239638, "uuid": "435b7d28-3cde-4c87-9646-93897293b3f4", "comment": "Malware payload (AgentTesla)", "value": "f64143793e2a31b6feed98f3d5b5f73f8d381041", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239638, "uuid": "eeb11f09-dbe9-46cb-8486-8b72a75f95f1", "comment": "Malware payload (AgentTesla)", "value": "f5685908e0d0be1efaffcc3f85053cc07690356563549dc90a81979fab081e22edb4067520d7f472bcae36f15fad189b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239638, "uuid": "93463c9d-53c2-46a3-9548-75ac68326cc3", "value": "T17482A519C905DBF40A3D32A0A66B6816A91003A3B5393D8D7D8FC19D3F7A660CBE54ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239638, "uuid": "2ded69e7-cbbf-4a4e-9bcd-b66c87f3c6e3", "value": "384:KR8ZiOBWXt4wnk3riwNf/CBTY34hNgkJrr+IDkwlCIMB7dH:KR8ZikMGBIu3WBrHcbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239638, "uuid": "593cd301-b43a-422c-bc28-21ecfcf73a94", "value": 18336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239638, "uuid": "d21e7ea7-ee9c-49e6-bc03-4f430ef231c6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239638, "uuid": "2a70b88f-b5f9-43d6-aae5-61ec233a0f52", "value": "HT0-3673.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a5aeb7d-3898-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776236189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236189, "uuid": "7d8d1ec3-d97a-4e7d-8c82-89f4f1853db1", "comment": "Malware payload", "value": "68ba072c71caf0add8c5849b9ec96984", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236189, "uuid": "b7850d56-5e57-400b-935c-795569b607d4", "comment": "Malware payload", "value": "3c8d7f1fae4d64dd3d65fa7342addb62f3ee997ac6ffefb5d81f258503b37787", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236189, "uuid": "cbf258df-c115-4d06-8e73-8564f6654c1b", "comment": "Malware payload", "value": "4c57ce67d0c7dc0d47162978f7283f9fa0e33732", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236189, "uuid": "a22042bd-0ca2-46e2-ba61-d4dfbfbb6bda", "comment": "Malware payload", "value": "7a148837def2f0c2b233f30531384937d81eded04eea99e3de3a6bc18cf46303ec4babe3e0f641ab7ce0cd90f92cfcca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236189, "uuid": "8ab167bd-cc78-401d-be27-5de8cd02fdf7", "value": "T1F5C44216EA11A52FF49789B079799546BC292E3217C0AC57F7801F9930B0AABF0F471F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236189, "uuid": "4b80b939-6181-4c05-b86c-496c2681625c", "value": "65bb6ba373dc416a9faa5adc2c3298cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236189, "uuid": "e0c88154-21fa-4aff-9a27-174e37e11f26", "value": "6144:h9zYOrFC0oiU+16q+5JlVUQaGdPfitRQsBg7Kj5HYI9Yps2ZHDcTHzK0i0ey+Bw1:fz4iUDhw5Bsp925eYhA1wTjckNwxo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776236189, "uuid": "1420740f-c083-4a67-af20-20e37ccdeae3", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776236189, "uuid": "f4636149-fcc0-440c-ac19-a09068d96abf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236189, "uuid": "8f183f85-d607-4d46-b815-17de9fb9e840", "value": "transferencia interbancaria (BBVA).tar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f50f909-38be-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776252545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252545, "uuid": "5c5156f6-212e-4fe7-8954-f54cd10b6fb9", "comment": "Malware payload (Mirai)", "value": "23e2f16e5757d025106a7293a2636363", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252545, "uuid": "6c78d9f4-e3de-4c8a-b8e9-e80c865412c0", "comment": "Malware payload (Mirai)", "value": "3c9fe9ee04a5b293c121e3cc1e501316c8b4da080f14d44f99c6bfc4c5090e67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252545, "uuid": "0f821fbd-e720-4e4b-b1fb-c38909d61431", "comment": "Malware payload (Mirai)", "value": "736fd4c3f57d3e90a740d245246b0ecd71db444a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252545, "uuid": "8b693a87-fa8f-4ff8-b5ea-1039e48a65be", "comment": "Malware payload (Mirai)", "value": "46d013f4c4ea89905b76a839cc851945b78494213c1a4740f498e3d6d55c9bd96fc72785b4128f7a3f5e60124edc6926", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252545, "uuid": "ea20a4fc-ddec-4f94-a09f-5402876bf5f8", "value": "T14534C71F6E228F7DF369873447B78A24975D23C627E1D645E26CD2005E6038E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252545, "uuid": "01c0392b-14f0-40ff-8051-4a4372bacfed", "value": "6144:qXNoh83tLiA/tINfsN7KWYWXeRPKwZoqcYpgo/KB23AslvKFKj76/9sUVgF7meW8:HFWJVUquVrleOqDZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776252545, "uuid": "56abd1f6-f9f3-4a3a-8280-b4879cc73009", "value": 252360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776252545, "uuid": "afc87d34-5845-4c8e-9761-b629d9ae5e45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252545, "uuid": "4895bd86-42ee-418e-a845-0da7cfad8c8e", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "826da0e9-3917-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776290856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290856, "uuid": "3bde535f-64e7-4472-80e9-2e6b4a0cdd41", "comment": "Malware payload", "value": "bdbe297ae3bb63da3cd8edc37d89c6c2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290856, "uuid": "26d65859-19be-480e-9fa4-73bba84c9a7d", "comment": "Malware payload", "value": "3cd55bb1e297ed1bcb8301286aff5772514a3aaab111cf0315709115bd8219f4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290856, "uuid": "df75f6ca-8ccc-4796-9b7d-64863a8dd681", "comment": "Malware payload", "value": "25c06b0663c250102d5b714d4ee5df30c08757cf", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290856, "uuid": "8676094c-4d59-406a-9dcc-6d24ff1d99d3", "comment": "Malware payload", "value": "b3550c09e0715265ccf3664e44ccfabedbe9f2cd6fddcc01864db65e84a242ccea8375625a1fbab2144fbc7c315493a1", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290856, "uuid": "0ae28779-c276-4cf1-b665-e187b359e83f", "value": "T199A302DB9B78F955DA6F487A84F5E13BAFB15363D0A0FB8F4E019051AE950B10EA001F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290856, "uuid": "32457e94-ec12-443e-b658-26204b4361d7", "value": "1536:EfQsUwBx84E4uAXQlcWrZvS00eV688DANSct9eImLwDsNM/ChbDI:mQ9wBMAghNZV68C69/Swp/ChbDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776290856, "uuid": "2ff516d3-5cea-46de-b2c6-1f615a3299d4", "value": 103096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776290856, "uuid": "0432c8f0-c7f4-4318-94f9-2ce39c37e5ed", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290856, "uuid": "69a553b0-ebd3-4723-91ae-a698b8a8cad7", "value": "APK.APK", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d45afd3-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776239576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239576, "uuid": "b2c5895c-a6cd-4ac4-8a04-84787393cadb", "comment": "Malware payload (AgentTesla)", "value": "0994cef5250527542051939149950f1a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239576, "uuid": "86a26fe0-ff77-4570-92ba-c6e5e9c0fe7f", "comment": "Malware payload (AgentTesla)", "value": "3ce21e396cd19b8c655f342722b7715c7e319f1c6667ebff36da8775bf284124", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239576, "uuid": "6a690065-e35a-4a75-8b29-0b5191424882", "comment": "Malware payload (AgentTesla)", "value": "2eb73cd8a05b551c74878ac9615155088e7e5ef6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239576, "uuid": "e536d084-a044-483a-84a2-33260c843388", "comment": "Malware payload (AgentTesla)", "value": "d94a0a0529cd04d683d477117565689ee243673ebc7261447ec6c9e25c68df152c87d8ed816ae4f44f271824c71be854", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239576, "uuid": "5ba37557-8908-49fe-9782-c8b2ad4bb344", "value": "T15556975CC0A4B00C98C2EF9BA563D4B289CFBCAA6E0DD972611F917C1C59F9798111EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239576, "uuid": "8872c8d4-c1fb-4206-a36e-6b3c5bbaa871", "value": "98304:jqCdyCczKIYvaqLkUj4ig8QEQ5gzhdvgNVYEwvvW9XPPs+hOzqyu7TN6980E1fqF:jHdh8nYvaOkUZH70gXoiZvmPuq77TiE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239576, "uuid": "ead12671-ca39-4c79-b017-852312781568", "value": 6027836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239576, "uuid": "91e36f7c-4264-4f8f-9720-a45a3cb7b837", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239576, "uuid": "348915c1-c3ed-4a49-93ad-e6287915524b", "value": "urjcwiyk.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a39b3b28-3876-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1776221762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776221762, "uuid": "e4fd1516-8099-4c2c-bfcd-06be7d3bc979", "comment": "Malware payload (RatonRAT)", "value": "35e4d013a817a8c438d77abb984576c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776221762, "uuid": "647e4d0f-3884-4281-9bab-bc97fd233161", "comment": "Malware payload (RatonRAT)", "value": "3dc4e6bae0421dbc3bd7c526e0c42e79a396465b2ef9c2c2cac0d59cc1750054", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776221762, "uuid": "3c364055-7a80-4fd2-a468-86c51e14490f", "comment": "Malware payload (RatonRAT)", "value": "c575a9246dbff42654df6c802fb3b32d5a108ba4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776221762, "uuid": "b82c7849-95f7-4a7d-874f-8a39f753dc61", "comment": "Malware payload (RatonRAT)", "value": "d0e8ce97c794920f40e199e24b4b55d7a3aef74b67781ea751bfa0405a2941e58c83cf72abdda7dda6b35f1227821e4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776221762, "uuid": "d171a08b-9869-40d8-8cbd-fe8e1d3acc1c", "value": "T118D5121C33FACB18F2AF4BB4A87185664371FD179D62D76C589139AE04B6F48BA10B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776221762, "uuid": "34066096-8171-4336-9fa1-2308b59bb92f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776221762, "uuid": "c0a807ea-6326-4f7c-a944-4a27632cf72a", "value": "49152:ogVUlsHjkmiGWU5FLGpMZ7iKPJ5W1tsclR0BxMzaRw4w6WC:ogVUuHjkDGjzqpgmwQ1GuRxzew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776221762, "uuid": "46ef05bf-198a-438a-9a85-b3c589a58de8", "value": 2945024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776221762, "uuid": "c8c7fbe9-9975-4c8a-a6a5-50239496182e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776221762, "uuid": "ad9583df-d1e4-4d17-aefc-5574f752199d", "value": "ratonClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "789bc404-38ae-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1776245742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245742, "uuid": "1de02449-ae33-40df-8afe-a49487f254f9", "comment": "Malware payload (XWorm)", "value": "9fff548c62f6d9508e53f9ad43ad4046", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245742, "uuid": "abba75e5-0c3c-49dd-8cc8-61c5cb1ec220", "comment": "Malware payload (XWorm)", "value": "3dd9a087a124f08ae4a29d420a2362544c8a0f32e1a9bdfb1b2b3fac1789d753", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245742, "uuid": "1330a89b-1749-43d6-974f-bb9b3e6fabef", "comment": "Malware payload (XWorm)", "value": "da291ef7ddb95651cb59a06bb2b8219207e436aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245742, "uuid": "31a3a3f5-adeb-40a4-a5a5-9b8ce3a60058", "comment": "Malware payload (XWorm)", "value": "e6823f94e2f6d04b726837c8e0bfd1ca5b11a5778dd0eaebd18fa4fb2a38ea0c7e3d59a1afacf7a44e79d1b4d56df779", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245742, "uuid": "f6dd32a3-84f7-4bae-8c8a-3c525012aff7", "value": "T12AE35CAEFB51AD01C64C0E7BC157510487BEC9AB6427FB9B21C81CB59DA3C988C8B7D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245742, "uuid": "ac23b762-f744-4b9b-afe6-0f1239b63105", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245742, "uuid": "96830399-47ae-492f-a8a9-bfb9ed2ae705", "value": "3072:70LW9p5eLBRjEsU39Q8KOXm5UZ3NbWNeRykw:735e9RgsU3qVudbWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776245742, "uuid": "03ed0c64-cddc-4e35-8815-73e21e1319d7", "value": 145920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776245742, "uuid": "b349096b-008d-44e2-b6ed-b6c5d1b56004", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245742, "uuid": "20b5e9c3-e843-4c00-8500-9946b6f45a79", "value": "SecuriteInfo.com.Trojan.PWS.StealerNET.203.19116.10935", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2141e73f-389e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776238723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238723, "uuid": "ac88bd82-8062-4922-8947-90661b55f3cd", "comment": "Malware payload", "value": "36be2cbb59cd1c3f745d5f80f9aee21c", "object_relation": "md5", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238723, "uuid": "791a2b72-0fc3-4f28-88c7-b0dfa5ce7fbe", "comment": "Malware payload", "value": "3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102", "object_relation": "sha256", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238723, "uuid": "8198808d-c50c-448b-b201-0f420ffb4920", "comment": "Malware payload", "value": "d0f8b7885e65a2d0714f91f7275d100bca25a886", "object_relation": "sha1", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238723, "uuid": "79595533-87cd-43c0-a18f-80688888b793", "comment": "Malware payload", "value": "5a2d40146399269f5790e66af98f063f20c3f2a9bba96e3cf7bd7517f0190d1f9f2c0a61008eb8dcf2a2a2d643bb6106", "object_relation": "sha3-384", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238723, "uuid": "1119a3bb-940b-4857-99df-8d3eeb9d44d4", "value": "T1AFB59E82BAC1C472F2631230442AA77856B9BE60F73189DB63D47E0D9D715C2ED3A367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238723, "uuid": "1ec7f647-0865-4946-93de-44be2b3baea8", "value": "d90ee3698f18ce8e4c365e9b1e446ea2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238723, "uuid": "64c6e7b2-67c1-4010-a8fd-00ae5c1e60e8", "value": "49152:LyzNg7jH8hXgcewfXzWNIj/TzCqhBNsEIU3B7uRNroI44p:LyzNrlewfXrBNNI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776238723, "uuid": "5361a1a3-f325-4647-a699-292875e70e18", "value": 2345968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776238723, "uuid": "e0a5b1a2-7ae8-472d-9477-3e27a1a02be8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238723, "uuid": "1f11d67e-22f6-49fc-aff8-d671a47bda32", "value": "3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1012111-38f3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776275579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776275579, "uuid": "a1feb2fd-c793-428d-bca5-55b808ab73c8", "comment": "Malware payload", "value": "6ae809b6081c12026de85f44cfba4b2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776275579, "uuid": "decebd87-e205-428e-85ca-fbeb75822101", "comment": "Malware payload", "value": "402303b0a4e2c959d18d3d9da44794016f389ce812cb23cccc1dfdc04db0796e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776275579, "uuid": "e5d1b1fc-48df-4f71-95f5-aec78ceba811", "comment": "Malware payload", "value": "b8a2b5a1fb927e6c199a1d789409bb1ae9597402", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776275579, "uuid": "83ec83e9-b519-4c95-a0b9-306c211b436c", "comment": "Malware payload", "value": "287a6daa050a45d8ff6a3a1133443fe40c85c9b93c49b2fe0bf3ecb3b085000cefa797702f8a720f9756829d1bb4026b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776275579, "uuid": "dfe8ec28-9b67-422d-b522-61b9d29793e1", "value": "T139F54913FCA119A9C0AEA23189669252BB71BC491F3123D73B50F7382F76BD0ADB5714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776275579, "uuid": "417efc5d-c8c4-4eba-93ef-c38309e05456", "value": "49152:6nLsSR90f2zdSAf2IlpdsteDDHdP5ES3vSEDic/:6LjWuhzcCrl5a6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776275579, "uuid": "51c8a0c1-d680-4c88-a3c0-c5836779d0c9", "value": 3473592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776275579, "uuid": "bce84e09-f0f9-48e6-aa4d-abba7d2bef4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776275579, "uuid": "9f04cb57-fae9-431e-96bd-0307be377b56", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6742b480-3869-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776216078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776216078, "uuid": "0cacbc31-65c0-4e29-8221-b4d11da02132", "comment": "Malware payload (AgentTesla)", "value": "7c85464ebcf6da92b5fae1bebe2a29d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776216078, "uuid": "641b7106-ebd4-495b-9008-c52e51ae4902", "comment": "Malware payload (AgentTesla)", "value": "40bfdb62bcd0ad5f2c09f33df6ce43f61e2da683ae7ae86cd479c8d567612780", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776216078, "uuid": "73f30afa-a5cb-4613-aaed-046f0a237a38", "comment": "Malware payload (AgentTesla)", "value": "91c0b580788c4f82c3f9e0e01f76490e4bdef905", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776216078, "uuid": "033c5a0e-d160-4b4a-80f2-e93ad5345e96", "comment": "Malware payload (AgentTesla)", "value": "81562ea4698bd9b1e5b60b64430c09698efab0ed56ab9bbdbbfc7359b53473e1a60b8caef2cb35ae5b0d8da332c1c0b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776216078, "uuid": "6b3ad3c9-f060-4646-a583-594361300438", "value": "T1B9E4C05A2C9D949AE2A14A7400E2B37D53FEA2D23E88D7D79E3D455D6D21CCCEE32D00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776216078, "uuid": "aa1c5997-b892-4b7e-af18-29351fb50208", "value": "4fecd44dfc94ffab3c4ae3356e71b8f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776216078, "uuid": "f15526e8-1407-46e9-99a5-5449f3c6ed28", "value": "12288:mdX9s4H7pg1bqvp0ysPSHa971dphecXjLcCVWxwS95nnnHnnntnnnNnnnunnn:EubqR0yPHa9xjXj/ir5nnnGnnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776216078, "uuid": "ea647721-46ff-4d29-aa74-c557917cfbc4", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776216078, "uuid": "d68909dc-5772-4113-86f0-8e40086b577d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776216078, "uuid": "ed6b22ae-8426-48f4-9d33-fae1fd345fb0", "value": "NEW_PURCHASE_ORDER029345.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5d71216-38cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776259240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259240, "uuid": "8be5a13e-2491-475b-b889-960ab17c5be2", "comment": "Malware payload (Formbook)", "value": "9a90943d977de42e588dc4662a75a636", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259240, "uuid": "231c34f4-d951-4f92-97d7-6d565bb9f9fc", "comment": "Malware payload (Formbook)", "value": "41afa43a3aea61c4b0eb08892fec971037c87a7df05daada19e4d87a4df2fc9b", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259240, "uuid": "55b244a4-5b70-412d-89de-45c45a1b112c", "comment": "Malware payload (Formbook)", "value": "89b71711457bd6d78d78e5d3eade2901e9711e07", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259240, "uuid": "58c4f6a3-45da-4f9c-a56f-3a3d864fcfb3", "comment": "Malware payload (Formbook)", "value": "ceb38c0fe9a476238daba35c3827194736dc4f419ee8fab2765f0bbb2e29e300dad8ede4ebb60672b30601a608412c5e", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259240, "uuid": "83a4f2ea-cdba-4dd8-9972-a61122280095", "value": "T15D35121A5328D803C4670BF419B1E0B427A88D9CE576D606AFDE7FEBF07970446A9393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259240, "uuid": "1e0a1a42-83d3-43ed-af88-c57aa304c1d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259240, "uuid": "3a6186e4-6c3b-415c-931c-4d2232e40ac3", "value": "24576:9XenMHUrcISfixiZgo/yDFmZ9jKuq0hFdzA/XtYzw2YSvfS:96M010KhRe3FA/XtYzw2YSv6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259240, "uuid": "951c172d-78bb-4eb0-8b0b-8f6074d32a42", "value": 1069568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259240, "uuid": "0828a7bd-6d61-4f2a-b72a-cebe73cd6fb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259240, "uuid": "15bd4576-850f-451d-adc3-ec0307585bd3", "value": "DHL-PAYMENTOVERDUE-1STREMINDER-1300712211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a176eef-389a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776236993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236993, "uuid": "78846390-f8ea-4a95-9f0b-1350a9e21f96", "comment": "Malware payload", "value": "0e481ef39747dd823267d88958ec10f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236993, "uuid": "d5fcd730-9c13-45aa-8156-5dbe3ee6c74f", "comment": "Malware payload", "value": "41d36b01b7f467f3f4eef1966bfb07b6e26845bfab2d3842253adbe26ae0881c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236993, "uuid": "3b558185-32cf-430d-acf1-e99da5f56fb0", "comment": "Malware payload", "value": "96d852b6be18768317ef1965aaf0b2eeeb2c6a59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236993, "uuid": "ff82249b-c2e5-4df8-85c3-646fa599950e", "comment": "Malware payload", "value": "8d8ee885f64cd1b0997a37972b6145503f6cb14326d0ec821954b8a62f455ffef05d8373fac920b1252a91d36f61035a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236993, "uuid": "190684a2-3abf-4603-bdae-8d69be99b92c", "value": "T19C641A1AC951D8FDF04206F01EBBAA3E6E7B9442E37BC697DBE869105595C90133F20E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236993, "uuid": "2ddd5ee2-41ac-452b-992b-f733e440affc", "value": "e94ef2affd460354a20230f72d207aa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236993, "uuid": "d0bc409a-24a7-4451-bd29-c59d9054a594", "value": "6144:pKLRVydBKmKzTD8Kt/PZBcNXfYCk9/ROyYvTuxh2TaR:Y1VyNKzHHlPZmvYVOyaTah22R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776236993, "uuid": "e751a38d-b355-4182-9114-6b755f31ea9a", "value": 317440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776236993, "uuid": "9314c24f-b8f9-45fa-b564-9bb0b7afc9d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236993, "uuid": "bf031bfc-3e75-48f5-a9af-b4961209a636", "value": "0e481ef39747dd823267d88958ec10f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "878361a0-38bd-11f1-a769-42010a9c0008", "comment": "Malware payload (MacSync)", "timestamp": 1776252209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252209, "uuid": "673b0910-ed2b-4c61-b9f0-f6f74df43ff1", "comment": "Malware payload (MacSync)", "value": "728ff67bdad1b3f523a6e45935bcb82d", "object_relation": "md5", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252209, "uuid": "701c6c43-7e06-43b6-bb38-31aeee615e86", "comment": "Malware payload (MacSync)", "value": "421e31c6b98a4133ef4a8a92efa9f3488dc5aa2867eb83cc3ea928ed59116b5d", "object_relation": "sha256", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252209, "uuid": "d795fda5-8e04-43f6-8592-462b6c8bb192", "comment": "Malware payload (MacSync)", "value": "d3065dc1001c370afed77f4b6a143d8f816c39ce", "object_relation": "sha1", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252209, "uuid": "c037ee38-bbad-4d2d-98bc-9b0a1667d8be", "comment": "Malware payload (MacSync)", "value": "269ceaf47f08d8acb799bf60b80eea15236bf4aae396d3d899ff87ed352a7f1a4161baf527fc4c8b310ffd2ec2481770", "object_relation": "sha3-384", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252209, "uuid": "fea2f4df-94ab-42b6-8f47-82458487e6f3", "value": "T122211B2027259DB144384152515B774DD1E3471E7BB8F78F05620D55654422730E9FFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252209, "uuid": "0762974e-f1ad-4a9d-a5ac-6941f75fb1e4", "value": "24:Eit0FvSishrXs1Vxgq8U9uTE11VLeEpIWKbzybSd30ImPrwkTZ36pRGfLBe820VK:C8isJEVr8UqE11lvtKbzyuB0xjjSRGfq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776252209, "uuid": "973039c6-f2af-409d-87b8-a244272b3041", "value": 1440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776252209, "uuid": "c36094ba-2078-4423-981e-6e5c72f56cbf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252209, "uuid": "61d7d816-334f-4092-b684-e2657e664e9a", "value": "421e31c6b98a4133ef4a8a92efa9f3488dc5aa2867eb83cc3ea928ed59116b5d.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34eb2cd2-38c0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776253359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253359, "uuid": "a5bd2c3d-2118-4f9a-8d05-efbdfb8dcfc5", "comment": "Malware payload", "value": "4cc0ae0945e8e2afd2ea896e7c67be8d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253359, "uuid": "8bf41db9-9365-4b1c-8842-8bc48b7df9a7", "comment": "Malware payload", "value": "4263735b71af49b8b41220245c1ab423462f6b7418b3ba0595ae0e19b7883ffb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253359, "uuid": "6c012c4d-3cd5-470b-ac7f-ba8e1960823f", "comment": "Malware payload", "value": "147bcd64cf5542df445e8a5ecaa8c2d98f9f1660", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253359, "uuid": "d6b505d0-b6d9-4257-99eb-1dd86a00a1a1", "comment": "Malware payload", "value": "97282ce8b177a451b23e376f6ba86c41291d1b0f70ba09e2442e6907dbad2aa625a713e10dd0ce0651f0be3313a37552", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253359, "uuid": "1a2bf4e0-3ff6-4e5e-86be-4befb1222dfc", "value": "T182137D6956857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49A9CD219B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253359, "uuid": "29ea2db3-15e4-44d2-ad52-a374717c56b1", "value": "768:bB+q9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bB+/co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776253359, "uuid": "13530a4b-e4b4-42e2-b6a5-59a3771cbfde", "value": 45502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776253359, "uuid": "42f9fda0-b049-4c3a-97f9-7e7fb3f3a9d0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253359, "uuid": "daebc08d-bf00-40ac-b0e6-ccb6f887cac7", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216d29e6-38b6-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776249032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776249032, "uuid": "9e35b245-36b7-49c5-b370-edcf1ab84832", "comment": "Malware payload (NetSupport)", "value": "dbd706af83a3bff47095d5d94986becd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776249032, "uuid": "ddef0a23-4ad0-48ea-b54f-a65b1b8311c8", "comment": "Malware payload (NetSupport)", "value": "4478c3153d533c18287755ef3367062e427ae37ccfe4d51043327fd878bac138", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776249032, "uuid": "4bcbf8e2-d23e-4f22-be08-5903fe220210", "comment": "Malware payload (NetSupport)", "value": "9e16029b69f221277efbfde17cb46ae88e7268fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776249032, "uuid": "1d144a16-c688-4ea4-ad87-9e0850517ef2", "comment": "Malware payload (NetSupport)", "value": "87c58b6f10049d1fa3a2840404ad10fc662082ffa7aa0bfaef809b788235fd1bcc5d2893802f8e93a87ede633b20428e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776249032, "uuid": "0d2c7c0a-baa9-4786-a2be-6eb238b9cc2d", "value": "T16BF55B0BECB94CA9C099E6748433A5527E25BC401B3273E72BD4B3682E737F0A975B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776249032, "uuid": "962658e7-fcff-4370-bbc6-a12cdb84d78f", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776249032, "uuid": "b87be884-d58a-4a69-a7ac-e917e03852c7", "value": "49152:+OH5EJpID/2zsZ1J/9eDaph55HeO+Rpj7LQQclnF:+Ofb2+1Fuo+R4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776249032, "uuid": "1f0c0f9b-2fd3-4807-90c7-43cc9b6ef1ac", "value": 3501560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776249032, "uuid": "62b45218-334e-4770-aae1-5cd40289740b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776249032, "uuid": "35dd99a3-f0cf-48ee-8f7d-f69c2dd6e27e", "value": "SecuriteInfo.com.Variant.Ulise.596178.23922.6677", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "929a4dec-3914-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776289594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776289594, "uuid": "75c56974-d219-4507-865d-ac9e9d53693b", "comment": "Malware payload (Mirai)", "value": "82812c481b75447f8ca2f08b2f8fb340", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776289594, "uuid": "f1686fa8-7080-46ec-8240-2e0f23612e51", "comment": "Malware payload (Mirai)", "value": "4491429a853c50b57124a27fbbcda88d3075cfae1df65e2c618f42d45fadb5f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776289594, "uuid": "a2f9f1c9-eb17-4d7e-a74e-2ede3f63797c", "comment": "Malware payload (Mirai)", "value": "a05f9ff5394b07653f76c879aeace1af85d3a5c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776289594, "uuid": "c622d935-364b-4fdb-9fa2-c7765bb61564", "comment": "Malware payload (Mirai)", "value": "afdc74aeae406168151c778ce29bd38446f475d18a2db920d6b36e3ce45ab803afb35c3bd9b06d9dadf292a8ebceeded", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776289594, "uuid": "a1b5aaf7-c713-4cc9-bbfc-ac18af1e4b50", "value": "T1FBD31A46F8819B11D5C151BAFF0E124E77231B7CE2DE7202AD246B747B8B8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776289594, "uuid": "e23951a9-b5fd-47a1-a9ed-24e2a8629758", "value": "3072:2qwDysUhE2gVt1RaMEVmJXFbAJffXdqMLGED:rCByUVtPalVm7AJXkMLGED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776289594, "uuid": "e203e11a-917e-4431-b713-90cacc951b96", "value": 136604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776289594, "uuid": "b025d56d-48c9-4411-b169-bc717d4761dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776289594, "uuid": "ac989920-74d1-4a53-9b00-b4adadaaab31", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92abaa8a-390d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776286588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776286588, "uuid": "0ebe0722-f3c9-49dc-9ecf-9af1eb97b23c", "comment": "Malware payload (Mirai)", "value": "2cc1f088784e4905978d75d2b414d610", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776286588, "uuid": "d4c700a9-fb65-4ac4-8b7a-df05f3050020", "comment": "Malware payload (Mirai)", "value": "44a279424ece8eee271221867c4fedbbaa39586cdd6dff0a593d4d57048db1f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776286588, "uuid": "573146ca-d1da-4653-9332-12044868e630", "comment": "Malware payload (Mirai)", "value": "6ba0673e65a65adfa8a50f26f4353af27327fc8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776286588, "uuid": "c239fa3a-1d7e-448c-be0c-467b87108c08", "comment": "Malware payload (Mirai)", "value": "793702d0869b268d98af0312e9a1e66cfb8082729ab329770298551f3df935f0dff020889dd493930e14d956a01e0dab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776286588, "uuid": "d708fe34-e5de-4f01-86ee-360b03ecff16", "value": "T19242B50B57BABE07C1E0F37701E3072266EA9F556118432F7D192C995E993072D3A7D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776286588, "uuid": "a77a0361-e685-4c19-8a39-0ea9a2c0633f", "value": "192:ngGr1/Wzx6j+LnKuOgR8HF20E5ID8tRGrSv3RczekT:ngHxI+7DOgSlnEKSv3R0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776286588, "uuid": "ddbae354-5314-4f32-a645-efc32eac50a1", "value": 12308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776286588, "uuid": "3018df43-6570-430c-a84e-817ce342a891", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776286588, "uuid": "435e50d7-0b62-4c71-a058-c92ac6bd9195", "value": ".Sassy.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e78af4-38b2-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1776247511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776247511, "uuid": "4f7cd96c-7f8b-48d6-b13d-e93658a46170", "comment": "Malware payload (SantaStealer)", "value": "48e9cbb09d4095f855e56a63ad1cb325", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776247511, "uuid": "591eff94-e4d6-4eb7-bcea-fec3c84b89d9", "comment": "Malware payload (SantaStealer)", "value": "44bf32bdbbd2b498a8903ee27cc66ff938b91ecace58a4b4a4a90f0414dc579a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776247511, "uuid": "b95965e1-f315-4a3b-b380-975ea7b9d818", "comment": "Malware payload (SantaStealer)", "value": "865186a8e8628f82cafeed381a9985bb08e06d6d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776247511, "uuid": "df1a0d71-0e34-4c19-9d52-043e75cba8de", "comment": "Malware payload (SantaStealer)", "value": "3921077721496fcf6a04ce7a18e068268ed2de0933a014ab93c2a525f419d273817320057358b6b91348092d4925cfd2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776247511, "uuid": "3013a7ad-3d0c-42c0-bf3e-65d0fc93f7c3", "value": "T19D264901B45A3F9ADC3680F047225322ADE0F4F4B622EB79E5F8B61C25B1ACCDED5951", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776247511, "uuid": "22141a97-5466-4dfa-9771-d34b7d40d936", "value": "2e41c122adea49109a9d1ec39ba4d3c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776247511, "uuid": "02e52439-e510-4a01-9021-8f86ed38cb5a", "value": "98304:17G3DS5o7DLRCjB5Yw/dcIMIAXGs1ZJ2cP/+:1CTSB5YwFc3Hbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776247511, "uuid": "ea40814d-939d-4fd9-933a-4f9b9a1be9b1", "value": 4579840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776247511, "uuid": "d39a2beb-059c-4f22-8b33-b9cedeca3530", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776247511, "uuid": "1c53081e-0cf9-4bae-b76a-9bd67892c6ad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715cbbcc-3894-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776234563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234563, "uuid": "600f44af-a455-40d4-a129-779aea3d8909", "comment": "Malware payload", "value": "44fe4ec3168197e784593ca6b99e5dbd", "object_relation": "md5", "Tag": [ { "name": "Dienstangebot-Klement", "colour": "#522A09", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234563, "uuid": "9dbac94e-b1da-44f1-b688-ce4a23fe0e28", "comment": "Malware payload", "value": "4578bc4b0b5eab3ac6e38d71bc1a086593b118c8bb221161d3fd27c5f5d00ea6", "object_relation": "sha256", "Tag": [ { "name": "Dienstangebot-Klement", "colour": "#522A09", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234563, "uuid": "e1aa1317-22ac-4926-a7cb-bb2755fee4f9", "comment": "Malware payload", "value": "d1358ba5bef3ccae5c2013b957552347f322dd69", "object_relation": "sha1", "Tag": [ { "name": "Dienstangebot-Klement", "colour": "#522A09", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234563, "uuid": "7ad3fd19-5969-430d-95cf-6e17fb03e4be", "comment": "Malware payload", "value": "9d639358ccf52174ef7e4d42bbf7c31e3fbf49de059d4946c4e1c3ec9260700717c1993dbe1d956ef96c289f944f9a48", "object_relation": "sha3-384", "Tag": [ { "name": "Dienstangebot-Klement", "colour": "#522A09", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776234563, "uuid": "59c51d56-d518-4d2a-abac-974de6849d75", "value": "T16652BFB1DBCE2237E747F5F9999A420EEA10744294187BC2390A43D4BCC42A947FBB0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776234563, "uuid": "9eb44def-f638-4f0f-9c55-f9a0aef62613", "value": "384:Yl0re6jyaA8LMpgwDyL8nA/v3Zs2uUbdHdAClQi2N:u0reVaVLfLkA/v3KUbdak6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776234563, "uuid": "c0eb95ee-4aee-43d2-8e84-2b174c16c2c9", "value": 14282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776234563, "uuid": "2bea968a-c653-4cd4-8ca8-8bba41dcb82e", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776234563, "uuid": "b6b6191d-ac71-4468-9ec2-f9860ecc02bf", "value": "ROSSMANN_NDA_Datenschutzrichtlinie.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3c1febf-38bd-11f1-a769-42010a9c0008", "comment": "Malware payload (MeshAgent)", "timestamp": 1776252364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252364, "uuid": "2016392c-c8e8-431f-9c39-8d0f85e99dde", "comment": "Malware payload (MeshAgent)", "value": "5a27502a451b2d80b0f536c792d88041", "object_relation": "md5", "Tag": [ { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252364, "uuid": "2fca8b1e-c54e-4015-8dcd-c5cfc06686d5", "comment": "Malware payload (MeshAgent)", "value": "459837b23c2b107e00e1ce93f203f117a751181ca6906ab5519a66166b1ce914", "object_relation": "sha256", "Tag": [ { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252364, "uuid": "2baff6ca-ed24-4aa5-a9ea-97c5d78b32bd", "comment": "Malware payload (MeshAgent)", "value": "bf6393c47b8187d68563236addb4aa970ed0b5f4", "object_relation": "sha1", "Tag": [ { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252364, "uuid": "dd902ccb-3d34-46cc-a6f2-8ef01a77053d", "comment": "Malware payload (MeshAgent)", "value": "f7ab0d7ece4feac4dff941d69944396ae87be82e1e1734b2813e465a2c83b2c8ddce6da23a413e0980eae37e62450b16", "object_relation": "sha3-384", "Tag": [ { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252364, "uuid": "06f64373-49ba-4aa4-8d0b-a34b895bd618", "value": "T1F906AEC3BB834471F8A736B411AB53BE9D7D69530328D4C393D428A949316D0AE3B39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252364, "uuid": "5ef55308-94eb-4aa0-9089-66de957c88fb", "value": "7aa58492bf5691114c98568704d048cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252364, "uuid": "024dee2d-773d-4e99-b9a1-b2bf63dd103e", "value": "49152:QfEV3ugKeuWoAkf6bRexQlNIdwB0pJCWJ0+1NaZPwq+5bWZPan:QfEYnnfKthWq+1jJWZPan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776252364, "uuid": "a4a3a56d-bf44-45d9-9f5a-e2b48f83cac8", "value": 3856488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776252364, "uuid": "269a3824-87ff-4582-a3ce-46ae76b731c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252364, "uuid": "0f63b0a7-8d8a-4ce3-a589-426012083d45", "value": "meshagents", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a013b824-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776239795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239795, "uuid": "9892cb83-3a33-40c3-9ec9-accc6192419a", "comment": "Malware payload", "value": "94fe1ba3e40ea490a15038a41bc1545a", "object_relation": "md5", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239795, "uuid": "deaff91d-0261-41f7-b7f0-a930a184cce9", "comment": "Malware payload", "value": "45991f94c94986dc8e6be01fd7afcc61c4426ab5209a19186f1b0ee7628f61a3", "object_relation": "sha256", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239795, "uuid": "0764de68-39b8-480b-9b07-fe67ce39d07d", "comment": "Malware payload", "value": "aae6787c32c7279522ef15ff27561f0b21db055e", "object_relation": "sha1", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239795, "uuid": "7028003a-962c-4dd5-988a-aa45bf6bc3f9", "comment": "Malware payload", "value": "7014824aba2a8dc7aeefbcbe10c78ff301026b2518bf5c216723f2399b52f15d86dd6a94e68026996a3aaecee3c309ee", "object_relation": "sha3-384", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239795, "uuid": "703a43bd-fd04-4aad-a691-a858b3ed4e66", "value": "T1C434293DC6990126F1F6D224FDA50413E5677B53263D8C9822C9138D4BB310E7AAEB9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239795, "uuid": "4bc61795-15c3-456e-b65d-1180556e8b10", "value": "6144:34FgEGcsOvL1dOQJzh+ojN6MJOBL3VgtluAuZPwRauIJsZ3XNFQxjr:I2EwI8QtMcNZkBmnuAePyOi3dAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239795, "uuid": "0d341bfe-9609-4fd8-a9d3-d6753a74e745", "value": 251304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239795, "uuid": "7f2c6db4-044f-42eb-a8dd-6e141c1b613d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239795, "uuid": "3824acfa-5766-426d-ac98-055790461655", "value": "Verk\u00e4ufe Anfrage _ DE 197556324.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95df3e1e-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776239778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239778, "uuid": "3460cb07-6583-4840-acc5-02edd8c68636", "comment": "Malware payload (PhantomStealer)", "value": "54fa34bd79f6b46e817a8e704700e191", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239778, "uuid": "dd95d48d-f933-49ae-a4bc-bbd1a5c3ab2e", "comment": "Malware payload (PhantomStealer)", "value": "45be3efdb7ec5bc961651aef1c117bfac33c014905e43feea45dddf65a8d656e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239778, "uuid": "58bdc991-e408-4cf6-8ba1-01aa6cc8bf1d", "comment": "Malware payload (PhantomStealer)", "value": "acc8472f2e4df33a15790ef60c2cdd46735ff8e0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239778, "uuid": "ad808fdf-f579-478e-87d5-6ef641bece6e", "comment": "Malware payload (PhantomStealer)", "value": "eb51753bd4e2543658f308df7143091a0582e795ca0b6f65fa49ab2ba6048076741920654085e1e32cac732d53bbb37c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239778, "uuid": "eb2c54d5-3bc8-49fe-94c9-976f95965293", "value": "T1BD26021189C46FB9CFAC5A1D80FE150EA3E04A8E5016B98AFB33BD46BFE7A4411171DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239778, "uuid": "26c06ece-e5d0-4e30-8bc5-3bcaf5f4c5d1", "value": "49152:eXwdXe6OrvgSs1WB425Tr1iiYSWznFe4iDtTlENRxIQy6BMGsNKdY61s:e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239778, "uuid": "26193186-c70a-4fc8-89ca-647cc29e0fd1", "value": 4704198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239778, "uuid": "b4e30ba7-11f6-43d3-957e-31a6c9834857", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239778, "uuid": "cdd459d4-7c67-44e8-a2dc-3356d0d31031", "value": "PO 4500272644 -R0-S - 250275.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3f0f11-389a-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1776237215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776237215, "uuid": "ea0349ad-9bef-4e85-aea3-22861182b5e6", "comment": "Malware payload (LummaStealer)", "value": "3371606e97a321058ccb0f8d2b84a561", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776237215, "uuid": "58e5a149-4b1c-4c00-bc59-fc7b598f8d3f", "comment": "Malware payload (LummaStealer)", "value": "4719eede5ebc81fd2e3d4b7376501e688e48b286111fa0705de1819eaeaf551c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776237215, "uuid": "50fef20d-8ac6-4c6f-b8f6-b591da1357a4", "comment": "Malware payload (LummaStealer)", "value": "bb5fcff9117b7994a270f6e954cac5098f3e8ebd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776237215, "uuid": "2bd064f8-eb3a-4843-8b81-da186b3642ff", "comment": "Malware payload (LummaStealer)", "value": "9efb99db90ba0eb31d1d97d4bede0a5695a3d86e3367114bac1db0fd89f56b2373da00728819ffad2fb3fb4f35f644d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776237215, "uuid": "9e898fcc-e746-4315-9404-b67edcf69270", "value": "T119747B4AEBB718B1D5870978259A633BEF3412154338CECBDBF0DF4479236E2593A606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776237215, "uuid": "0a754ebb-0ac7-4f76-9bc2-91a261ca9ac8", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776237215, "uuid": "e4a86f45-7ff8-4df6-8dc9-7bc3abe6add9", "value": "6144:UR3WOOetu4qp62brOMNDG18erEcA1HKjVZQqklTPy+ODkRw:AHNebrOSymeXZSubDkRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776237215, "uuid": "482ea3e4-88c5-4b0c-b9f8-326ea54770c1", "value": 347203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776237215, "uuid": "95a6e5a0-65bb-4683-a9aa-aa0f6c406158", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776237215, "uuid": "87c13072-415a-4675-915b-ff1b4c598835", "value": "3371606e97a321058ccb0f8d2b84a561.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c10831dd-38be-11f1-a769-42010a9c0008", "comment": "Malware payload (CobaltStrike)", "timestamp": 1776252735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252735, "uuid": "293e3fc7-4b68-467e-b615-de9cada91920", "comment": "Malware payload (CobaltStrike)", "value": "a259eb72788914747d6bc8bca288fd0c", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252735, "uuid": "8414b91f-20f9-4e97-bce0-5ce4bad4213a", "comment": "Malware payload (CobaltStrike)", "value": "4772d85990eb9ab0bc0ce48cc759613572f7613857040da2dd7ab1a8ca4b1ece", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252735, "uuid": "2f83537d-dd67-42a7-beee-7cbed6f597e6", "comment": "Malware payload (CobaltStrike)", "value": "bad7217ff5e60633e7e2c5a1616cc0c1e7a14a2c", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252735, "uuid": "5e1bdafa-758b-4c73-a84a-bc3a59430c66", "comment": "Malware payload (CobaltStrike)", "value": "793ffa442e518f975e3cc462200db0a1d87f3016230d2c9513819efeb2b6a240ed01e5dee96787b8b9b15d3612dee643", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252735, "uuid": "e0719fa0-b132-458a-9e5e-d7b5bf76ca1a", "value": "T143D55B1BFCA118F9C1AE923589235156BB707C851B3267D72E90F2B82FB2BD05E39714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252735, "uuid": "0d7f6b23-630e-470a-8982-b6ba9b926dba", "value": "3ea0d4f44f2a32cf20db9a7e00271489", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252735, "uuid": "a992fece-b145-46de-86dc-9bc5f9c7bfe0", "value": "24576:e14dUZMYCHH2OSBpHVn6Fjp2ExEu8YuKknGLAPzJ14j3E0Gi3fP3t9WrnpEExkm:e14qZMYCHH2Ok6FjpbNTKWSgjhb7ukm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776252735, "uuid": "cab980be-91fe-4746-97d2-2762b812c19e", "value": 2811608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776252735, "uuid": "e32da46e-c20b-42a3-bc30-d1572b573fbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252735, "uuid": "25f7380f-bf13-4213-a0cb-bef546b40dd1", "value": "4772d85990eb9ab0bc0ce48cc759613572f7613857040da2dd7ab1a8ca4b1ece.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b408a50-3880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776225855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225855, "uuid": "40ac3163-9ba8-4aa9-8e1c-ba017db49da6", "comment": "Malware payload (Mirai)", "value": "f27d716fa541d20a62b98cd95c686af3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225855, "uuid": "bcc4874d-b664-44d8-861a-2440d2c80175", "comment": "Malware payload (Mirai)", "value": "47a2b91bc36c41bd67a70f56469dca07f1b9751e0da68118ddd821a2bb19891f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225855, "uuid": "4e99b13e-7285-471a-bd77-fd2675315ebd", "comment": "Malware payload (Mirai)", "value": "6d7a148401c474af89450d4a43e092511ca53925", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225855, "uuid": "ceb3460c-0fc5-4c4b-9075-e8864c641a65", "comment": "Malware payload (Mirai)", "value": "48cb8d009a130b1b190537ede95e695bd3b9d1a715d9ae0251716f220f7f4f2df9c5aad6476cf398a47cf63c48b73501", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225855, "uuid": "f9809d01-36fd-40c0-979a-042aa1b4c213", "value": "T152A32863CC262F18D668D4B5B0B19F796BA39920818B1FBF1677C6744083D8DF6093B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225855, "uuid": "11fa65cc-4c65-4f7a-a404-a72a474bb921", "value": "1536:rW5ihIo2bCSjKdPaQ7NXAaLAqB8t2bW7s3Liljxf98:2MX2b1GdbOaLAj4bWo3LO92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776225855, "uuid": "fbf17164-aaf2-44c9-b956-63d0d978501b", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776225855, "uuid": "5a8734b2-eb38-48af-abf8-7c60a89484ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225855, "uuid": "e3cd4de1-4efa-46d4-a682-86f3ec1e1a0c", "value": ".Sassy.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26953c75-38bd-11f1-a769-42010a9c0008", "comment": "Malware payload (MacSync)", "timestamp": 1776252047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252047, "uuid": "fc54ff76-2243-4d38-b946-4b3d0715f138", "comment": "Malware payload (MacSync)", "value": "4751708675acf38a37791bc9881b97fd", "object_relation": "md5", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252047, "uuid": "3d01c204-d29b-4bcd-8d0c-4276c51578d5", "comment": "Malware payload (MacSync)", "value": "47a5467c35b34a28035d82ad75b75a3c1b26bdc6891e1e342db7d4a94f31ed82", "object_relation": "sha256", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252047, "uuid": "df838856-f09a-454b-a463-b142cd372cec", "comment": "Malware payload (MacSync)", "value": "2c0712a0f192a9f7339c1759d8e3041cdbb0b31d", "object_relation": "sha1", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252047, "uuid": "38edcfb5-2afb-4755-9d35-967c6bb7b73b", "comment": "Malware payload (MacSync)", "value": "33fcbcf4a519f76c17ad27f70fdcd84a016a5d9d3c9c3df46e5d437edc43169e8a7d973419c3d8170ccb342bdba783a3", "object_relation": "sha3-384", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252047, "uuid": "b3e2cf80-2490-4d97-9b43-1d85b139c8a3", "value": "T1E8F3DF38E35868B7FC9119B13AA004AB4CA96DB77924CD55A0C7392F1387F757E70E22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252047, "uuid": "c47f13b2-8111-41ea-9803-b55676ded5ba", "value": "3072:wwcz2Eq3/kiAiT1MdDesGkViuxEzYPlE8NU6qRqtIfoN3K7/4i2:wwMs/BNnkVT7BxDSwN3ti2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776252047, "uuid": "4c9cf5b2-911c-4e42-ab2d-87b3ef7b37e0", "value": 165927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776252047, "uuid": "18794be4-da6e-43fe-8413-2ececb82fe2d", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252047, "uuid": "4b16ea26-781e-45dc-92d2-a501c262c57c", "value": "47a5467c35b34a28035d82ad75b75a3c1b26bdc6891e1e342db7d4a94f31ed82.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe1da0d5-38cd-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776259280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259280, "uuid": "c2552ac0-48c0-4195-aae5-671633062f75", "comment": "Malware payload (RemcosRAT)", "value": "a9f3149785c2b587601188a8b2226069", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259280, "uuid": "d1fba80b-776c-4bb5-829f-d118fefe8241", "comment": "Malware payload (RemcosRAT)", "value": "49143d53152b124ca1e1dc3c80d93ac71273d076b8c05721655a693ff31a0849", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259280, "uuid": "b82821a0-3e9f-4a4c-ba73-481bb3908fe3", "comment": "Malware payload (RemcosRAT)", "value": "8fe95e271d445520ad3ea2e20a1abd5695bc9a65", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259280, "uuid": "ef8ab1be-7640-47fc-af7d-d0583c6fd08f", "comment": "Malware payload (RemcosRAT)", "value": "6d7b272d1df868f7aac764080769c21cf31ba224331bb4508b1b7a1e7b70277be643016edfca40c22ee2dbc381e06cb2", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259280, "uuid": "08bae30c-a2e9-4c32-8d0d-95c3e9eb80cc", "value": "T19612ADA86EC33F8BD862A41BA57159364941FCBF96B738C5432CEA2DEDDC00F9285057", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259280, "uuid": "cc5e99a3-4b17-40cc-bb7d-65511b22e0b4", "value": "96:7Hxb6D9PreUPf2Oh2FciUr4iRedgrz3kkrJNx9ycT:7Htu9z32OhxN4PoJNx9ycT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259280, "uuid": "873a56ac-204b-404b-8e76-4f5d87d2ddfb", "value": 9690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259280, "uuid": "a70d835a-735a-4fb0-badb-107db1faec78", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259280, "uuid": "879b1b40-abcb-4459-b376-3c44e6c834e9", "value": "odeme-PDF.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "516661f0-3906-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776283472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776283472, "uuid": "7e9e4f03-5fe6-46b2-aaba-10becc569e74", "comment": "Malware payload", "value": "9191668067d2e379c9bc471341021d02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hmbr-org-br", "colour": "#28549B", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776283472, "uuid": "4afd7aa8-315c-43ba-969b-984a93587e92", "comment": "Malware payload", "value": "4a3f21b2f0b0c4d4e5d43cfdcd8fb800c95a4ad7ec582d714ccd9480df826e2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hmbr-org-br", "colour": "#28549B", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776283472, "uuid": "a6221296-e464-488d-b007-275cfc183e4e", "comment": "Malware payload", "value": "2ef5d0d8492aa47d9074b6a24cdb67be51c5e2c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hmbr-org-br", "colour": "#28549B", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776283472, "uuid": "78653d7f-650f-4999-b8d0-fcc073abc6f5", "comment": "Malware payload", "value": "c2ddf0bc2e9b97684bcaa5d457c7856f5129210b94654797cf11ba49841feec49606f09ec055efdb1bb7c6f81a61f460", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hmbr-org-br", "colour": "#28549B", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776283472, "uuid": "9fb1df68-7afb-4efc-8d9a-53dcdf383cd6", "value": "T13352B74012C131EAE21E437E6473C8A6B96DF40283512DFF95A5DABB5E01EC2F93EB45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776283472, "uuid": "9002d580-b096-42c8-826a-9c94cc618bd9", "value": "4fd2ddf42f3df0a0865c6aa4fca0a5c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776283472, "uuid": "ddcacb38-9719-4ef3-9aed-2fad388f8f34", "value": "192:qBDgiosjKyxBeX4hbStD0PInkXK4M6XoKcqcc6UV:QgiozyHeX4eD0AnIK4M6XyczV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776283472, "uuid": "f70a202f-eb9a-4624-bcf3-c02a280a0678", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776283472, "uuid": "3b8ce3ce-8188-4279-99c2-a1cfd1dc4279", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776283472, "uuid": "39980288-9ec3-4c8e-861b-9ab30f43d099", "value": "bin.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "964b1731-38fa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776278433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278433, "uuid": "dd13af60-d993-4ad9-a02d-80da7339c7f6", "comment": "Malware payload (Mirai)", "value": "9df9a4d62250ea8ea8ddcb0ce066e04e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278433, "uuid": "3ea9a4c0-bd12-4dde-85a5-4c293b4908fc", "comment": "Malware payload (Mirai)", "value": "4a7d72ef1717b586826ab439e5aa4bfe568ff9eac7513e051bc95503ad0617b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278433, "uuid": "aec64770-98ae-43b6-b899-901f88c9e55d", "comment": "Malware payload (Mirai)", "value": "b3d05c4f747b36868a042ded51c5cad6ca404276", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278433, "uuid": "da9e80a3-214f-4248-8e78-ed4f28e0011a", "comment": "Malware payload (Mirai)", "value": "4b438f3727a2e69582f9cea5c6bc936308c747cb560d4f34ea7dc1652817f6cb41eeda1ad8d69eef0465fa1018857a2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278433, "uuid": "d91a2aee-cd2c-40ca-b4ab-c71a3b219982", "value": "T1F0F2F236F64386C2CA71083EEFAFC4CAA7474BB1C4AE38366889D6391961307D5247DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278433, "uuid": "7ad124e9-7732-494d-a224-05bd80abcc3c", "value": "768:hEWuV9QrPjpnzsoK2poMTfM+U9l1HZ4FFFSO5aolNL+E9q3UELTe:0w13KkTX6DHZ4JXDKL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776278433, "uuid": "d844a9c9-09b7-497b-882c-8161cb2cbced", "value": 34312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776278433, "uuid": "352c5e20-0c0a-496f-bedd-a2b403ba7548", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278433, "uuid": "9c69227a-9423-4ec9-bfea-3c6a82a29065", "value": "FGx8SNCa4txePA.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf574dd-389f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776239225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239225, "uuid": "2ac93e28-4c75-4c80-9510-b70479de35df", "comment": "Malware payload", "value": "58e80693f971fab0ea07050f141a7043", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239225, "uuid": "afa34e4c-b8a8-47a3-826c-b169db8de83d", "comment": "Malware payload", "value": "4a919c7e0ba6049fd269531235282fa58c9f265cb51c49959928c3972bcf1df1", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239225, "uuid": "bd806eab-90be-4244-ae34-fe5143d63fa9", "comment": "Malware payload", "value": "316d39b7bedde905018c50b8f182a1bb068752d5", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239225, "uuid": "4ad6f752-4f26-4de3-8fcc-b7e17828612d", "comment": "Malware payload", "value": "d75b2a9d48ab353a3916cb9b8a0f3717070edb8a428ca5fb732c8d892b301709011eca85da56b9e849f9bafebff3fd3c", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239225, "uuid": "deb96a34-5be7-4678-a98d-fff28be05ffd", "value": "T165D2FDA4EA533D188DD26011E62E86350F99F393D8931C2B39CE581F838B7DD63A5DD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239225, "uuid": "03230b85-c8d3-4b00-bfe3-7892d4d94d9f", "value": "384:J2hrqFBtH4mlJSmu8rfvHd0E9QxSh+D66RpH6UGLx:JSrqFBnlJSCTfd0E9QxShjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239225, "uuid": "fb078e2a-289b-435f-97ac-b893d1c2408f", "value": 28668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239225, "uuid": "4904b517-16b4-4e90-a83f-22b91d437d6d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239225, "uuid": "a01afaf6-061b-42e8-88e3-66eff4ca0fb2", "value": "WannaDec.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "189adea3-38f2-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776274787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274787, "uuid": "7ad6f789-415d-4d2f-903d-727b297bdbbf", "comment": "Malware payload (ConnectWise)", "value": "ed65594c7db9c62698aa61304be9f9d4", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274787, "uuid": "f2b81c4c-6e7b-4e2e-8a9e-e67f4141c6c0", "comment": "Malware payload (ConnectWise)", "value": "4aa89e3b7b13fce4f57576ce2ffc363ce77cad2fab67688315829320b000a483", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274787, "uuid": "a66fd89b-6dd2-4b06-9f2c-2bbd56ccaec5", "comment": "Malware payload (ConnectWise)", "value": "1c9f49dabc7db7caf5870c19f821963d6fe998d6", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274787, "uuid": "50158fd0-04cb-4de3-8269-4958edda484a", "comment": "Malware payload (ConnectWise)", "value": "4ecdd0850bff2bd0af22457e52478f9782e2d00933a6128b4c5e76d7725c0e3ba71e39970d8743636794e062855d7a9e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274787, "uuid": "b54410f2-68f6-498a-a605-42958016bf58", "value": "T121C6232526F8AA98F1B61B79EE7640B01D7A7D61DA12C15E13207C9F2872F4086F7733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274787, "uuid": "81ed69c8-dcd8-4d35-8ff7-2d2d27093ee5", "value": "98304:4VA3GnJY4UJjatcxGP4H+gv5wVsjyIhVA3GnJY4UJjatc9VA3GnJY4UJjatc8VAI:i61muxwVsb61mA61ml61mC61m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776274787, "uuid": "66dde0bf-7835-4441-bf94-51e8d6569e98", "value": 12304384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776274787, "uuid": "f021d27e-6807-4a2a-a7cb-05cf7385672b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274787, "uuid": "37e533a8-19a9-46c1-91b5-561a9a04c389", "value": "ScreenConnect.ClientSetup5.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a440545-3924-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776296264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776296264, "uuid": "7415ff92-3b90-43f2-8ac3-30c1e260385e", "comment": "Malware payload", "value": "e1af8abd9f7747840e62b243b8ce889f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776296264, "uuid": "fbaac7cb-3d5a-4cb3-bca3-8c452e7b5c43", "comment": "Malware payload", "value": "4d169cc73f0389c86d0e4d3df5a38042f38da00a3fe474275a2a1894fbbbee66", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776296264, "uuid": "6a225e52-bd3b-493d-9301-bff7b63245e2", "comment": "Malware payload", "value": "99bef53f8886ad92234995cfe26866a691b5b635", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776296264, "uuid": "7a305bf4-b3f9-4d50-b1a0-8a9809a65a53", "comment": "Malware payload", "value": "f0cb855b5326f08586a81904caecf3f43d0b0f9038d0bb1e69f58a21ac3870b73c7b8958fd1b46a10cfc217b6e9b0311", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776296264, "uuid": "a739b03e-d141-4724-b452-96d043bc6d7b", "value": "T12D41338947E0238EF5C48E07FC9D8D7960D7A5A015AC5900E0780DF2A2BF987B6F9667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776296264, "uuid": "c833c22c-ba97-424f-bb4a-ab0a80e47828", "value": "24:Rv/vpbEGEPvFH2kEkEpvqv+cE6mfvBvvVE3hvqv+cE6FgvgRFvgRTgRBEgR/zgRK:TXcHPyPzBRA+rbdULSy0lZJoJHAjCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776296264, "uuid": "ed277809-2fb1-46ab-bc4d-25eb15ad3e7c", "value": 2174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776296264, "uuid": "1e2e494a-22d5-4397-aee8-579cb341df1c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776296264, "uuid": "e37a236c-024b-475b-93e8-61e7c4383d3a", "value": "Sassy-Cats.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd195f33-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776239898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239898, "uuid": "8601ce44-4c97-4fa7-8e95-f9dcd68d63c1", "comment": "Malware payload", "value": "86cc492b0c42aaf5d0ff48c67af1ab41", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239898, "uuid": "9c3acbe4-20b4-41fe-9e2c-e69da141c037", "comment": "Malware payload", "value": "4f269ade4e1441707dc1e75d7f4433ea84ae2cf32163c57bfe18142b89203f78", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239898, "uuid": "47927877-bb75-4179-b7af-c1987c81fafa", "comment": "Malware payload", "value": "36aae00c8c7d0048ebbb310e2015e9ecd4f85061", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239898, "uuid": "1f347b7a-3e46-435f-9a16-156271578beb", "comment": "Malware payload", "value": "ddd8a06fd41aff303e7eac28ab923ba1089cc8995ab044e0a37e54caeebd89844d01db4e10979e26be529cbcf89ddacf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239898, "uuid": "194d5720-717f-4e88-95fc-4da1268d916c", "value": "T1BC641E38ADEA402A7173EE54AED47493E96FB773370F585C1081038A4723949EDDA63E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239898, "uuid": "e96fbb82-6b02-4e6a-8e95-6bbe0d789c85", "value": "6144:Djd9nk9/H5EnRYyerE8qyAEb2D4mq7A5KTZQRNiqOsNbMkL/M4CQd7dl7VlDagTV:dlk9RVtrSyA9Hq7oKlQRNidsNbMkLk4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239898, "uuid": "e23f7880-5677-48ad-8d69-b022f9a3620b", "value": 310716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239898, "uuid": "c11f317c-84db-4b92-8d45-31f898961c69", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239898, "uuid": "aa9e1780-daba-4ef5-987d-e53b30349984", "value": "Request a quote A06006515 __ SRL 15.04.2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb17fb5-389d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776238343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238343, "uuid": "eccc169b-f4a7-4e51-96a8-54fc646c4c5e", "comment": "Malware payload", "value": "2adaba773e2b4deca72f70200ea8453d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238343, "uuid": "8c8d08ae-b07b-46d1-b0c6-3588d2a750a9", "comment": "Malware payload", "value": "4f569e4456ef1d1b77b84220061d3af7b61c1447b2ed041283af27f38d5b23e5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238343, "uuid": "a6b9cbc0-8e73-409f-bb91-f73f55ff539b", "comment": "Malware payload", "value": "b6f46eec9a12bede5884671a08c9f0d0622185ee", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238343, "uuid": "7f842197-a40a-4fd5-b328-c17aa0aafa55", "comment": "Malware payload", "value": "38df309b7ac4e6a5571e1e992eb28296f74ba425beed45c2432d187156024d5a22b31beab79ba9bf1ea220360995755e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238343, "uuid": "31de46b3-bc07-46dd-972e-4208ab5f50ed", "value": "T17A53206D98C71266A71BEF506CAE584CBF784B4B3B1DC1B1254660EB8BD0C18C43EE5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238343, "uuid": "3d41224c-9111-4524-a3a0-8e0908529e97", "value": "384:O7zPuc6qNClxGsFD/YFBHgcEryXaVETcaPw1+ZXmdV0UINWMxLdor5zV0ftdGLSi:mHGrLIrwngQnFsBbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776238343, "uuid": "ca17baa2-c212-411f-b905-55f432bcf1de", "value": 63378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776238343, "uuid": "5d7ca9b5-6df3-4b42-851f-b729effec8f3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238343, "uuid": "262c1400-1955-49db-bebf-da2213a3a954", "value": "SOSTENER.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e993a86e-3898-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776236483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236483, "uuid": "dbe16b14-b45d-4f1c-ba97-a4dd5f41a2fe", "comment": "Malware payload", "value": "97b398a109dc02332a8558ff978c36e8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236483, "uuid": "a2ebb563-e732-4e2e-851e-a5d439a184b4", "comment": "Malware payload", "value": "4f7a1178edc345dbb094aef8d04c5ccdb2d11dc90ac1eae893841f90e1c5a066", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236483, "uuid": "92204343-4af4-4b33-b9c4-8a70971d71c4", "comment": "Malware payload", "value": "8044a71805fb1674df2f9d268fc11b5905ff2e52", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236483, "uuid": "d74d3a11-e831-4281-8af0-26110fab0866", "comment": "Malware payload", "value": "ee31ea2739e3a2238520b6ca6133075c9ab07cba5377342036d8e31d49d16a6b9e10c1d3512c46fd0f3ccab8226c4667", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236483, "uuid": "ada23362-837a-49f6-8a43-3b5ebb19c2ca", "value": "T190343A3EC6A80016B1B7D614FDA64413F56B7B622B3D9C8C22C5028D47B350EB5AEB5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236483, "uuid": "cca4adc4-d66d-45bd-a4eb-1842d61041db", "value": "6144:HRHaDbStZjkxaJ8CCjduiJmMqA/MrSTb9HaDbXbZ5ksWpND:ObeYx4ed3lB7btWbF5XWTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776236483, "uuid": "1a3da166-a6fa-4922-8d78-9eab994c219d", "value": 239972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776236483, "uuid": "4f4cada0-d63b-49f0-8006-b407103ffb3f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236483, "uuid": "90e26cee-a873-4447-ab45-d3dc678b0243", "value": "Overdue Balance Invoice for JAN-FEB-MARCH 04813067_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6cf02c2-38af-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776246329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776246329, "uuid": "e54bb8f4-6574-4857-bf2d-28521d1c4751", "comment": "Malware payload (ValleyRAT)", "value": "e9f20eb92b4ce25a5b0b7ed47d68fc47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776246329, "uuid": "30b61e98-b056-4d70-bd09-3ef0484769ed", "comment": "Malware payload (ValleyRAT)", "value": "4fb9f4695f78e60b3e15dc069486dd899f816f88a13b69ac7e9e496c49134624", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776246329, "uuid": "5f4afd14-4968-45e2-83d1-a301e40f1369", "comment": "Malware payload (ValleyRAT)", "value": "660fa69ba4dcda2b058fdc8e88f72fdef05c8392", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776246329, "uuid": "b1b25e49-445d-487d-b37c-355efc174aae", "comment": "Malware payload (ValleyRAT)", "value": "ebfcd1410494fc12d5e5bb20b53ce9b7a8e93cd00fb77bee7c57dd287c3340f46b8f505c4d85e2b465acd8c796849cb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776246329, "uuid": "ce8e6264-ac67-49f8-ba26-750072d9dcd9", "value": "T150946D21FE9698FCE167C07486564A73AA36B88A0721FDFF029851343F55AF16F38B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776246329, "uuid": "c1adc711-7a6b-4c91-b8c9-32bd276fa6d0", "value": "aa25ca96a93260e6e31b4f6c9d02aae3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776246329, "uuid": "0c7a2835-5bb2-4b8e-9e68-ae3da1d4013e", "value": "6144:/usPezcrl5OZZWSIG58akOWvMAIe5FDzblyo952BzxSRWdZ1Y/1Xalm05k:L+Zx58yuzD395BWdZ1G1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776246329, "uuid": "b2d69ce7-b743-4741-b1aa-be48a6eb3fed", "value": 421376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776246329, "uuid": "a298b88c-6fc0-4947-a804-a00b47590b2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776246329, "uuid": "a065ae7a-a8e1-46d4-acb9-34152c18a613", "value": "2026\u5e74_\u7b2c\u4e00\u5b63\u5ea6\u8fdd\u89c4\u4e71\u7eaa\u4eba\u5458\u540d\u5355pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b1a0268-3917-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776290870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290870, "uuid": "016ac718-9bef-4d84-b25e-dc7abf80b253", "comment": "Malware payload", "value": "93b5f71973517b0891e5aa27f2f085e9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290870, "uuid": "a93b63f9-64d6-450b-8b4f-3ee2ae826aed", "comment": "Malware payload", "value": "50b8638dde85a2667aabe9be84c4243f37a40945c82125a0d4e98104874a4541", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290870, "uuid": "50d7b64a-a3e5-49fd-82cd-070af385621b", "comment": "Malware payload", "value": "0aeb58e029f0f77efef0c675893d90a938fbf544", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290870, "uuid": "e1fc4fb5-ca78-4422-98ab-4cd8a2d0a795", "comment": "Malware payload", "value": "c3d809e09009361448705641656c9d780b5a89b5e91288fdd2e9c33ada4e77dca86b33167328814803e615c7ab4632f0", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290870, "uuid": "5a7071b3-7018-4370-bc90-e87ce0966f98", "value": "T1F89423FBE818B2A2D65E1D7AD43F9E17B778938378B885E7445011E1C2705A4C2EA80F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290870, "uuid": "0094f9bc-ce02-448c-84e7-12ecfa677fa6", "value": "6144:IdhN9CK/vdD5wYFx/i26cu6VNNDBU3TqiukWk4/XZ/plyUJYW92:IdhN4avd1wOx/iQu0NNznlPZhtH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776290870, "uuid": "0a2f129a-b94b-4b17-99ca-8ef4717fd72a", "value": 426946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776290870, "uuid": "3f296f23-8204-4a94-82f8-9d86712040de", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290870, "uuid": "a67aeaa8-edb1-4a74-b98f-d151dc1956cd", "value": "MicrophoneMickrophone.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee3c4b6-38b0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776246504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776246504, "uuid": "30daf9ae-2e53-48dd-9254-4e4a9fa440f5", "comment": "Malware payload (AgentTesla)", "value": "ea6b386159052e4e0311ae8a81848585", "object_relation": "md5", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "tecnoruoteindustriali-it", "colour": "#1EC7BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776246504, "uuid": "29f33862-b776-4c34-aa52-b84f3e821a48", "comment": "Malware payload (AgentTesla)", "value": "517ce010c5a304a7e1ba776c98b07cee6d2c39269cfec30d7da3b8c15d0c2b9c", "object_relation": "sha256", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "tecnoruoteindustriali-it", "colour": "#1EC7BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776246504, "uuid": "030be575-16b8-4866-9d8c-bed37a38c0e3", "comment": "Malware payload (AgentTesla)", "value": "e7af30bec31b8f64815520caa10c23bcf8fa294f", "object_relation": "sha1", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "tecnoruoteindustriali-it", "colour": "#1EC7BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776246504, "uuid": "925a7b0f-914f-4aad-a39c-5b1a8a0656f0", "comment": "Malware payload (AgentTesla)", "value": "aa91299f27524c9e2069c98ae2f7ef1e09d0385d35e61d5043ebe3da6c995ec54fb994bc21c789a23ee62d2cf38f31bb", "object_relation": "sha3-384", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "tecnoruoteindustriali-it", "colour": "#1EC7BC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776246504, "uuid": "d4c085c7-0ca9-4376-abb0-172a1e1a8ee1", "value": "T1DF7434B9DA33C752C7D028C651B0A1942F11E48F11E4A181C576EF72BF6CAACA7C967C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776246504, "uuid": "18f240b3-2639-4892-a64d-71c037bfec5c", "value": "6144:XN8EITMDDYxgZun6zns0TICsTbSgjGvLQI/umpBLfyIhlIcAOYk3irempqBUgXsX:dMID7ni7SgpmDfyIlsTpq5XA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776246504, "uuid": "caa89b71-faf4-4530-99bc-64870525a250", "value": 355900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776246504, "uuid": "0baa4860-32d2-4496-b99b-6c2e2748c365", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776246504, "uuid": "d9c13f07-4263-4099-94c0-85eb888b214b", "value": "fibulae.afm.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f828c1de-38cf-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776260129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260129, "uuid": "f3e2c59d-ebb5-496d-9d1c-67853ad19ac9", "comment": "Malware payload (ConnectWise)", "value": "3a022f9cb3252c75b3c8afb474fa7997", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260129, "uuid": "11bced92-1a78-47a5-9643-ef3d3f681f5e", "comment": "Malware payload (ConnectWise)", "value": "51acbd2c6429c059ab63b23ad2a756d31396f8c22ab034cb7f0e8931b94b89bc", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260129, "uuid": "916648f3-c0e9-4050-986e-d523b6d7eb35", "comment": "Malware payload (ConnectWise)", "value": "e39b8c89c91b927d2a5f40e2adc8d48b623ae6df", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260129, "uuid": "27977a92-b73c-4a42-b271-3d941f9cf7f5", "comment": "Malware payload (ConnectWise)", "value": "3f66c2e4209b9133171962e83716ccdfd87b024ecd53f185dee422d32773c639eac6f80c99f0c5f319ba60abe4a7c1db", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776260129, "uuid": "ae64df91-30cf-4831-90ba-ba4dddab1d42", "value": "T1EC05E01077FA4A3AF5F31B32BF7A91505A7ABD669E21C15E1698312D0DB1B80D6B0333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776260129, "uuid": "9a7a168b-9f83-435f-89b3-3ab7c63db049", "value": "24576:/hUVI37syvkWgvnwcmnNUU+GG27hhx5F0NM8:/hUVI3MtQnG2lL5FqM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776260129, "uuid": "37f5833c-0c41-4b1b-8d1c-5cede185e67d", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776260129, "uuid": "5f378df1-bd03-4baa-9e43-064b5723f045", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776260129, "uuid": "38977ab4-cf5b-46ef-b84f-52f81063928f", "value": "SecuriteInfo.com.Riskware.MSIL.ScreenConnect.Heur.18846.471", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a55b378-3925-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776296828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776296828, "uuid": "d42273af-5d17-4ee4-b78d-2e4d79c7c988", "comment": "Malware payload (Mirai)", "value": "279a15c3c5fe5d22632d303168d6fd45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776296828, "uuid": "ab5ce8b5-3f6a-41dd-a72e-bdb0af858c1c", "comment": "Malware payload (Mirai)", "value": "51b175a689e9fa52738dcac1a6942db9aaa1e299c5e83c04e31bd292610c0768", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776296828, "uuid": "1258ee34-9b17-43a5-9e16-708a91a2d0d3", "comment": "Malware payload (Mirai)", "value": "de995cac97fb4a4bff572e0bd040dcfab6207206", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776296828, "uuid": "59d03fd5-3470-426e-9b5b-0389d295bbc9", "comment": "Malware payload (Mirai)", "value": "261f3b40135d8ea110e536070dce9a6eb7a952983a4af9b21a4cc99ba480290631d9a72ab345e4487199630c14aa8d68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776296828, "uuid": "fcde82e6-86e9-400f-b32a-f2a361bb5727", "value": "T122F3885A6E224FAEF678873547F74E30A75D23DA23E1D684D2ACC1141F2039E541FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776296828, "uuid": "6a6ac6d5-34e6-46da-af9d-00cfc08f06da", "value": "1536:y19wNtnlsQWYhLrBUryIENIs31XUXbRIeWp1eb9e6jU9iCdZTYCvLGdJS+A8gqH:y16RPbT1ELRIeWd6jUjbvidJSn0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776296828, "uuid": "8b69f956-2bde-4b2f-aa66-37c106f994bd", "value": 165508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776296828, "uuid": "9f943adc-e1f7-46cb-9b0a-177ef1d7f0a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776296828, "uuid": "69927cbb-33dd-4d13-a2f6-36a76758ec25", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4171da-38ee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776273211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776273211, "uuid": "b9190b6c-acab-411e-bd57-0925f29e3e3c", "comment": "Malware payload (Mirai)", "value": "0e938057f66d89e3f7343ba5e20d66b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776273211, "uuid": "c850610d-f895-4099-ab02-4d52bda0eb1d", "comment": "Malware payload (Mirai)", "value": "524446f8632e0c83fd0aac15ce09c8ea23217141e275a051e4f651800dfde7a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776273211, "uuid": "9c79a0a7-f061-4f01-bbc4-8ea9b26725ff", "comment": "Malware payload (Mirai)", "value": "98d49a27366333be238f9117eed06fae02919819", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776273211, "uuid": "5c9625f3-c092-4926-a199-920e43dfde00", "comment": "Malware payload (Mirai)", "value": "d815a60b6bac55f90024e95b2b073dec8bd28878abb185b96d2d2acb2dce88ede16f29de849d00c42d06c155add1a9c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776273211, "uuid": "8092eae1-e7fb-4b30-90f2-dc6aedc59665", "value": "T1E823E1F34575D27CD478C7F8675A84C9BE22F8136B430B2795B232EF611B389A6046A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776273211, "uuid": "64ce9b12-d26b-430d-9c4a-25939bf80f96", "value": "768:kwci/BITwVr0kVbJilI4LerUgc8TRT24/S7a+KLSBMStqneYLQbs9GPGi:k21/VViSlUghRPuavSiStQeYi4Gb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776273211, "uuid": "1819d139-94bf-4710-a693-6446184c22c3", "value": 49252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776273211, "uuid": "bd8fe781-37a2-4f2a-9f15-34959ad1fed7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776273211, "uuid": "f3d896a4-b501-471f-8de7-e13c47468bf2", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9557015-391b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776292639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776292639, "uuid": "5d2c5f64-531c-4704-bd08-3055daa15968", "comment": "Malware payload (Mirai)", "value": "a39de9a60ca1bc1ed5a051bd2dd1c6c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776292639, "uuid": "eae44e0b-4d90-4e86-91b1-3f05f37036ba", "comment": "Malware payload (Mirai)", "value": "5260262c2e02485e8d13eaad74c36ec4e5043f41a9484d4e76395b4cc91130a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776292639, "uuid": "0f92fe7e-e36c-4795-a713-1722831969eb", "comment": "Malware payload (Mirai)", "value": "d14f1617a91975278c9fa03b6d9cfc72bfeb062c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776292639, "uuid": "1f38a769-c6ed-469c-b7ae-b11795015ae3", "comment": "Malware payload (Mirai)", "value": "ab3c27d448b55b2e102bc721cabe76c44ef7c614d595429b1149a26502d41f34c26160a20bc161a6bb6dd49f79ae0c0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776292639, "uuid": "1de40274-1838-4ef0-81f7-3192de213f4d", "value": "T135B3F845FC445B17C6C661BBFF8E438D7B2A1758E3EE720399256F20378B95A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776292639, "uuid": "9a394493-3546-41e6-b419-111dd4453ae1", "value": "1536:77NB38YTiATqJ4VVL0Tu/zOWmIOr0inkPBz6cLZhllRwywmMDMj3TLpRYbyL:NBZTiD4b0q/zPSnkP966NF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776292639, "uuid": "65100f05-3b54-4ef3-911b-e4f70345af92", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776292639, "uuid": "030614a9-789c-4a1c-a182-a7a5139e89c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776292639, "uuid": "5d38e85e-f412-4f71-8e28-e264f0240583", "value": ".Sassy.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ca0ec8-38cf-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776260125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260125, "uuid": "a253e03a-7961-42f5-8d83-939d0b2bffc6", "comment": "Malware payload (ConnectWise)", "value": "3e573f4670898a35fd39d5d430c96748", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260125, "uuid": "dc5cab25-c716-423a-ada3-a2bfe8fc2f2d", "comment": "Malware payload (ConnectWise)", "value": "52addbccf07f023efef348bbd8c74dbc588f65ab2ddb69b9e676fa0b768c0b99", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260125, "uuid": "a8004091-33ff-45e5-a496-ce43dfc54c5c", "comment": "Malware payload (ConnectWise)", "value": "595f8a9d253e1c9d66cc83bc0f26a8931a19cb32", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260125, "uuid": "6c050dc1-9efc-4c4c-90d0-18eb5b83898b", "comment": "Malware payload (ConnectWise)", "value": "76dc05a1aa5003151e352733f2585131e447f0a15173a598e053a14f2f03556dae2fa863b00e5e28b454b91d070d529f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776260125, "uuid": "3f50842b-bb28-4404-a8df-0c1253a21a8a", "value": "T11095F13136E4C039E2B21B35E93A92F15E79BD24DA62C05F43643D1E7971E809AB2773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776260125, "uuid": "a70de4db-ee3b-4a70-b15d-97612e021319", "value": "24576:RNGryn8Y2KWeNXPKPC+j/4TkfVub1emjS4t3nHRRlUhIMUUGGHpYLgmdF8gu7ura:jeyqkXSPkYYb1rSuRlUOXGHpYLgSL1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776260125, "uuid": "791eec72-e786-466f-848e-b4a3781c3adf", "value": 1888256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776260125, "uuid": "a994e7fb-095d-4bf1-bee9-66c3e0344f57", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776260125, "uuid": "f3a03383-0659-49f6-8892-96c6be8d819d", "value": "SecuriteInfo.com.Riskware.MSIL.ScreenConnect.Heur.29504.36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187fe901-38f9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776277793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277793, "uuid": "03d9193e-dff7-46a1-8bca-cec416d93228", "comment": "Malware payload (Mirai)", "value": "910b60fb7fabdad589e70afb333e6db2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277793, "uuid": "b61d3f41-764e-4e29-9ab2-57f3686b5f30", "comment": "Malware payload (Mirai)", "value": "534e81666f4359a64a26ec9580d8d81afaf480cc1963d393a6126fc8e87d38fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277793, "uuid": "1291b552-49d4-4af1-9e4c-99ae74d2da0d", "comment": "Malware payload (Mirai)", "value": "6d7815b2937220f4eac19c7c360698d99151640d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277793, "uuid": "7268f790-e7da-4b13-bf44-3e9c316b8412", "comment": "Malware payload (Mirai)", "value": "e1444ecec2e88225c6e98ff094f7adfb58f539df19ab6ea09aa3f58972c49897f6f33d50aa6d6b33b7e0dc6b628be306", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776277793, "uuid": "1e3a74ed-d5d3-40d6-a306-f94e5e85ed2f", "value": "T12D437CC4E583E8F5DC4715B52572FB778B72F1FA1218DB43D3F86632AC92602A502A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776277793, "uuid": "0d6badf2-a879-4711-a01e-7cd16cd6b117", "value": "1536:LSO7eO5aJD4tD2Q8ow6veIVM+P0u9gMb/EbfcGZ1Sre:LX95aJD4tD24w6zVM+su9xb/Y0IAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776277793, "uuid": "e61bbb4a-9ef3-4385-bbc6-418fbeb0ca72", "value": 58448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776277793, "uuid": "1d6bb55d-5450-49c9-b214-a312bdacd972", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776277793, "uuid": "7d86f9ad-ff29-442f-a97a-2236678c0db9", "value": "FGx8SNCa4txePA.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed5c176-3912-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776288702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288702, "uuid": "bf730f41-eb3d-4f9e-8975-0a442316d291", "comment": "Malware payload (Mirai)", "value": "e1182930f2dc04d6a4e7b14097da58ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288702, "uuid": "ac21fb53-9f76-416a-9f8b-bed7f3c09882", "comment": "Malware payload (Mirai)", "value": "53bae1d7791fa29270ff00f59b3a32b2f676c699f1ebd77d7f681cabe87d3232", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288702, "uuid": "09fd6fb3-eac3-423b-9039-0ea953699b0a", "comment": "Malware payload (Mirai)", "value": "a39bd2bb2f2826006afcd7ed2fd7ee4ea89e2ba2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288702, "uuid": "ed556068-6bd4-4e28-ba39-6b564301bce3", "comment": "Malware payload (Mirai)", "value": "8819bd09f06071f07535e8391157f59bf554ba3f97e5890e4d742cacfa2e7ec44ef3e20668419b2d7c0069a5f3190c22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288702, "uuid": "0ece71b4-da9e-4491-85ab-5b8434406545", "value": "T1EAA31B8ABCC5C702C5E0A1B6FB1F52CD375643A8D3EA7147CD19AF29274B8670A3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288702, "uuid": "d0171a8c-204d-44d3-a069-9d1a8147bff9", "value": "1536:ZClDzZAd8XYrSDAWP4M1C7cYiBD98Pk8HkQnpZV8fU0OJIbAn4b+R:ZClDzZAIhDe2C7cYiBD98SCVXlWAn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776288702, "uuid": "5d4d0f97-03e9-4188-9119-033e8a9ee3ec", "value": 100328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776288702, "uuid": "8635ac8b-cc57-4965-b4ec-727e02e6824c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288702, "uuid": "2696fa66-0c25-4cd3-be6d-65443a386451", "value": "splarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "673668cb-38a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776240129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776240129, "uuid": "f4c42c53-8228-4377-bdd8-3df642e31392", "comment": "Malware payload", "value": "b76bd6b4cba5492515e98a1932b58bdc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776240129, "uuid": "81150b34-7bcc-4c19-9c87-616f3127ffd8", "comment": "Malware payload", "value": "53c3e0f8627917e8972a627b9e68adf9c21966428a85cb1c28f47cb21db3c12b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776240129, "uuid": "1d96c15a-75cb-43af-a3bb-b57596aaf00a", "comment": "Malware payload", "value": "41f3a23a3aa73d0d59f964620e2ecb9fe9fa370e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776240129, "uuid": "5a9fa372-4dfc-4c68-8560-9f8604edd2b9", "comment": "Malware payload", "value": "0d3c108b288a630416daa2068288abbb0a57d1abe94d4929a76461dc0e60b6d637ad34f14b05c71cac838a28500041aa", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776240129, "uuid": "7c82bd88-0ce2-4848-9677-4656d65e673d", "value": "T19135B51C71CCAB81D3AC573E9CB08823D7F8644779A4DB5E55A30C1C5603B9E8BF9A86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776240129, "uuid": "ba1de3b1-f58a-480c-bbd8-1d5ecba718f3", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776240129, "uuid": "82e0c54a-0b4f-4f19-b073-ed72aac848c5", "value": "12288:uGuVtVPdrbVTBLz3pgWe8oSWWCXFKlzSVRbc3+elqMn76IYLAln/xF9:7cLbTBXNEjXFKlzCobEM76IYLY5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776240129, "uuid": "16db4246-7d28-4395-a413-cc4bdf9e0a0b", "value": 1161216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776240129, "uuid": "871c9b68-b0db-445d-b274-8c9c5ec488c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776240129, "uuid": "9784a296-2e83-4834-9243-4bc30b5441cd", "value": "53c3e0f8627917e8972a627b9e68adf9c21966428a85cb1c28f47cb21db3c12b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6650701b-38c2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirax)", "timestamp": 1776254301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776254301, "uuid": "47740b2a-3650-40b7-bcc8-907d012e20d2", "comment": "Malware payload (Mirax)", "value": "ef219df49c55d32a7b6183d5beff3ae8", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Mirax", "colour": "#EA30CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776254301, "uuid": "5d97961d-2a2b-44b4-b198-28b6d02e1239", "comment": "Malware payload (Mirax)", "value": "53de68ebec281e7233bffc52199b22ec2dba463eec3b29d4c399838e18daecbf", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Mirax", "colour": "#EA30CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776254301, "uuid": "ed587907-34b8-4448-a450-821bd4374919", "comment": "Malware payload (Mirax)", "value": "845594ee7deef5af733c7424c7ddf232d437102c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Mirax", "colour": "#EA30CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776254301, "uuid": "7beed98b-e0f1-49a5-ae98-c43195253f0a", "comment": "Malware payload (Mirax)", "value": "0ea24d57b335731fbb81901a9882eb16effd2500c1b98748ed91ae8f502ed7e051d7b1bc3b6332ae6c1eff80ecf9979c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Mirax", "colour": "#EA30CB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776254301, "uuid": "06576d1b-2985-48c0-8eab-26789ee00c0e", "value": "T16B072246FB84E99AC4F7337649755226430B6C268B63C7D36E48727C18BB5F04F4AAC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776254301, "uuid": "819cb912-ec26-45ff-9033-66bcc60e46d1", "value": "393216:ALit5JN1Wb4S3mWq4NPascTE4WH5Nw9fpHfOQBG:hz9WlHzrftZe9fxO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776254301, "uuid": "0da34d10-0add-4752-96c7-4513206b4c4d", "value": 18413783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776254301, "uuid": "328f47dd-9575-461c-a7d9-bf8ce5af24f8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776254301, "uuid": "fea32d01-d1f7-4980-9570-086e93ec1f9a", "value": "53de68ebec281e7233bffc52199b22ec2dba463eec3b29d4c399838e18daecbf.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d189e9-38ee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776273250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776273250, "uuid": "83a88499-b870-4cc4-a6c1-7e5b6c579abd", "comment": "Malware payload (Mirai)", "value": "08f3ea8b6e5afd038c6dd62ccfee6454", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776273250, "uuid": "5492868f-c652-4351-989a-41de908772ff", "comment": "Malware payload (Mirai)", "value": "5453e68c64697b9db13996db223b64c476871c13a173f5f6c5fd85bf4fff5913", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776273250, "uuid": "66b2fccd-770f-451d-8671-235f9d2cfb98", "comment": "Malware payload (Mirai)", "value": "b2ca980c4cc1a71981b349cdec5dbef1abf60c07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776273250, "uuid": "2c96928f-90db-4053-bd81-fef98ec7ea4a", "comment": "Malware payload (Mirai)", "value": "7b893e5b193dfb51149c82bde101bdab927d4b163c849f5c3aa71ff70870958cd088a313b43ef801375ccc3ad48c5e6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776273250, "uuid": "99d3b39a-3aae-4925-9ff0-9a9dc77b77c8", "value": "T1DED34A1775D190FEC8DAC1B84BEAE226DA73B4295178B11E27C46A372E4DF206F2D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776273250, "uuid": "bfa8305d-7c62-497c-9c05-23c974687b92", "value": "3072:oH4ASVlTMWtLMFAMiuy1fv5nh6Rsp4BAw4Xr/PxgN:1JL03cCRJmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776273250, "uuid": "8d2d6204-ee12-43d1-ae15-ad603a97738e", "value": 130952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776273250, "uuid": "cc16650c-b160-4738-9c59-f6b1cc3acf52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776273250, "uuid": "f4c28748-b84d-444a-8693-1e71950b6a28", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "653e8f91-38ce-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776259453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259453, "uuid": "2d56fc09-cad0-4d4e-bf64-7bde3a38eea9", "comment": "Malware payload (AgentTesla)", "value": "3f2cb0b64a93f4ae698103e427a591dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259453, "uuid": "f7b99aee-94b7-4ce7-b172-6b59c1d8d27d", "comment": "Malware payload (AgentTesla)", "value": "54606f52cc55c899e1693a7b2b82c786380e885108dd9c18f8c5170b2d22483f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259453, "uuid": "f39689a6-b96c-4975-b925-e8c5f7cb248e", "comment": "Malware payload (AgentTesla)", "value": "5b015235bfe9ccffa74b0f7bf91cbd86e2e015be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259453, "uuid": "13db1687-11c3-43b5-bde9-eb7e0a49b602", "comment": "Malware payload (AgentTesla)", "value": "e14d3150ad26bb370ba5f563afb2433a28a4d9c7e4e3f673b3f83fc8664052b5cfa53c94f33de25848d3c0346aad58d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259453, "uuid": "b2c424e7-18d1-4e17-a34c-0e333b989b60", "value": "T133644138AEEA001AB173EF54AEE47497E96FB773370E985C1081038A4723945EDD563E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259453, "uuid": "ebacafee-4248-415c-ae4b-908dc34ede31", "value": "6144:+NZualDQKvoQr9yrblpjJb3iOAjR5s8o3iuZh35xVQ0szqLvz+aNwI7hOV5u9l/K:+ealDQKvoyYTjF1AjR5bo3iuZh5xVQ04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259453, "uuid": "a635f279-55a3-4c56-bf17-1e14aac7ce0e", "value": 310994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259453, "uuid": "83e02802-2bfe-45f9-a57a-328c4bc9d326", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259453, "uuid": "0fc96481-9742-444e-a444-7fdfb2f07c44", "value": "Pre-alert.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d6fbeb-3912-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776288690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288690, "uuid": "cf4b0cd0-a164-4679-b887-b8bfa08f8714", "comment": "Malware payload (Mirai)", "value": "c1589c7e454d1a3b73e722d7c3e8ed70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288690, "uuid": "b9e47480-d2d2-4ad6-a037-797d929900c7", "comment": "Malware payload (Mirai)", "value": "54dd4bf12c8fb35b09df06f3de33ab8dfff5e5cb682d1f38baf532f5716396ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288690, "uuid": "885e0b96-bc82-44e8-b20b-aa17c7c46e8f", "comment": "Malware payload (Mirai)", "value": "4c42648c5fa8b779dfc0c356ef8bd02768afbe4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288690, "uuid": "0a28566b-355e-41a1-a82f-a2a9a336e295", "comment": "Malware payload (Mirai)", "value": "c25552cde1a20f8e53c4fc8f8c0dc3d457467afd3bedfa6e3585ca78b52ea9855f7e8b14cb42e5b1918df5198c95bbef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288690, "uuid": "6d130bfd-8c13-4a34-aeac-4fe4eecdcf0d", "value": "T1B3A33B92B400DC7EF86BE6B381270B15F121A3E10F516F27B61BFD63DE2A1A45C1AD46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288690, "uuid": "4e6a8c8e-3d10-4084-9035-39a08b8b5cf0", "value": "3072:pWwhxWR7jFBCbYuAp68000PP0kcVyZkU+MUNRxXR:pBcRvvCKMkULYxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776288690, "uuid": "a194febe-b11b-4319-b733-7bde60da7e3f", "value": 101436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776288690, "uuid": "1ea35f83-3d13-41c8-8e5f-3c375dd48483", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288690, "uuid": "c6e78400-2122-46b4-aa1c-6747e1904fe3", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c876f61-3912-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776288698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288698, "uuid": "f81bd091-73e3-4042-9bf1-a67ec2e4a704", "comment": "Malware payload (Mirai)", "value": "85308b19f4c49acf29f3a911fe3f7223", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288698, "uuid": "465f0fa8-cb64-41a5-9e2f-3e2580b9bc7a", "comment": "Malware payload (Mirai)", "value": "558174cf658e20e4a889a6d64667d9db05e1bfecefa9890f0ff6677032fa3c49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288698, "uuid": "56d74ad9-7837-48be-acdb-bf130ae11abf", "comment": "Malware payload (Mirai)", "value": "db16e47cdebe8af5db986eb631a93372efb1f4e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288698, "uuid": "ec9c8acc-a00e-4b10-92a2-56ab26463f5a", "comment": "Malware payload (Mirai)", "value": "9bca4f7e27c3f0a76fc975dd3ce83a4c78aafac0ccf83e1c667a7dea5d291fa200dc4ccaa65b687608d5cafbfa9c9efd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288698, "uuid": "fea70660-abfb-4310-8768-86a685603954", "value": "T1B9B34A22FD756C2BC5C0653B51D34630F5B6439926B89A4F7E631D9CEF14220312FAEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288698, "uuid": "a6bc62ef-1763-40cf-9040-a8718944a006", "value": "1536:gWq56BB4aOScoe0eEbGkYxBD0PK02xG3giNWs6Wolm4H7Meh+o:nqoEh8e0GxWIGNtt8H7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776288698, "uuid": "35bffa15-fee5-48b8-8ebf-96c54abd7545", "value": 107928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776288698, "uuid": "12e5c104-7329-4ff3-ae65-daa88343c91c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288698, "uuid": "eabe23f0-3ea2-43c0-9d14-6eca31cbafaa", "value": "splspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c986413-3916-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776290416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290416, "uuid": "113218b0-3d85-4211-b73d-93b87b520cb7", "comment": "Malware payload", "value": "6475f71200c3eeb18953d76916fa2705", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290416, "uuid": "682cdc63-39f6-4f0a-83ff-15415ea0acc2", "comment": "Malware payload", "value": "5646873f89e3468c306385ef3d65b7daf63aeee4128553c3224c75cb0e6902ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290416, "uuid": "f33f373e-868a-4617-b63a-753ceb89f8ed", "comment": "Malware payload", "value": "116cbb6f735fcb30c00856b5dd64c8e56e614cb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290416, "uuid": "236f40ac-71f4-4faa-8fbe-b3bba872e7ac", "comment": "Malware payload", "value": "022ca725c964f52fef4e5eaf398cc4090b3c9008a2a86477bde526fce5ded1b7da2d42dd7872f5a91803decd59152f61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290416, "uuid": "02a6bb52-623b-4257-9fab-67fe41d28ad0", "value": "T1CEF44B517670E3AEF6761639B4CAC22D64547C30AE06038FF1B07EA817B2EAC5F86351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290416, "uuid": "443e66d2-3e49-4e19-8e37-2adcd6781bd5", "value": "0293eec0b5432ad092f24065016203b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290416, "uuid": "909b9150-80d6-42a0-aca4-f1baf56a5430", "value": "6144:qj110S5YN3MrpT3Unhgxqhxw3LcNAVa9JiEBKHH988qShTK1OellbhcHl/gwYRFs:DSW9MrpT34uxqhxw3LK1I9SllaHloDR6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776290416, "uuid": "043c5964-e86d-4dcd-8f33-e53afaa6f333", "value": 736488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776290416, "uuid": "6f7c0cd6-a5e7-4651-baba-90fbb403e7e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290416, "uuid": "28344a35-f7c0-4417-bef3-01d23ed608eb", "value": "rApprovedbonuses.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa00fb2-38ce-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776259355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259355, "uuid": "eab81a26-cee3-4609-ac01-17d2b106ed2d", "comment": "Malware payload (AgentTesla)", "value": "358a411359f6c432f01166a4bf3a6f5f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259355, "uuid": "709462b7-e301-440e-90b9-62493241c578", "comment": "Malware payload (AgentTesla)", "value": "566c49c5bc4d5edd2e331460a0e5f8ca0ffbfd9fcdd3d4a964779a2f19159fc1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259355, "uuid": "d794af4e-cd73-46e8-b65c-7a4f192e83e5", "comment": "Malware payload (AgentTesla)", "value": "d0cf4f47354f5caa67b5af070bd677464b7d4458", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259355, "uuid": "fe645847-6932-4a78-ab96-50d4f0616618", "comment": "Malware payload (AgentTesla)", "value": "867d00f780ee234b5999dbf0eabf2f59c74d932a21a7a45c3421fd1753fbf654d414975f44de4c321b33b9232fd980f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259355, "uuid": "ab5725fd-2268-4996-934a-1c66ab0a14cf", "value": "T1FC569544E0A4B00E98E2CF9AE5B3D4B149CF686F3E4DC8B6A05F927C1C59F93991059F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259355, "uuid": "d50e87d9-7de6-4f0d-a5c8-7c652af3055e", "value": "98304:hGLdLm31Pmg0wjhqzJQQXqWocPNpru34gg5lX7ZFlHmht57bOnfpVh6HOd0ORKAV:wLdoeg/4zJBXqhcrru6vFlHmhX7bOnh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259355, "uuid": "ab0c330a-6abe-41f4-b9f6-50d4914669cb", "value": 6025784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259355, "uuid": "39c58073-6afd-4ecb-b626-1de22b306323", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259355, "uuid": "2d10d1f7-44f0-47d7-a4e5-843327e8831e", "value": "docx.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a839323a-38ea-11f1-a769-42010a9c0008", "comment": "Malware payload (GlassWorm)", "timestamp": 1776271592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776271592, "uuid": "06e862d0-b73b-48e2-aa84-2f01ee09fe1b", "comment": "Malware payload (GlassWorm)", "value": "6514db96c286bad1b5361ecfc9e8c656", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776271592, "uuid": "0d4c76de-d177-4cf0-9b00-447eb5a5781b", "comment": "Malware payload (GlassWorm)", "value": "5753dcccb7f40375067a4a788a78a0846e1ac43d78ba314739594a2145b77fb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776271592, "uuid": "47c6804a-52dc-434a-891a-76fe9aed3b97", "comment": "Malware payload (GlassWorm)", "value": "e863fe4172f047a6331ebcb4e09a5d83fb089ad8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776271592, "uuid": "7ac0293f-726a-4a89-b143-078b35e4184f", "comment": "Malware payload (GlassWorm)", "value": "d948ca453caafcf8c1808fa797eeca97489f73dee1374ca2f0c7028aa12f47bfed8c223e92abb8ea6665c502654d58d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776271592, "uuid": "dda154da-ebbb-4d64-8e36-2ce88c3d6ca2", "value": "T127756D43E2A620ECC05FC170975B6722F93174055B38BDFB92D0D7352AA3E906B7AB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776271592, "uuid": "da01f28e-e1d0-4a48-ad32-f0107592fca7", "value": "b712b3f1f6f5dde070c523d4407e5a3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776271592, "uuid": "a317166a-854c-4a9d-b743-94e4b3e947fd", "value": "24576:fds9Esxlce6k91UOld2LMxmeDozCMZyFF75EymOCUwPP2iP:fdaEglcAHNaYczYMyL2PP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776271592, "uuid": "161a599b-cfd2-485f-96bd-3140b0446644", "value": 1566208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776271592, "uuid": "a5cd780f-5ee1-4452-9939-3b9a77310915", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776271592, "uuid": "597e8412-66fe-4f7e-931c-c911e4d81bd7", "value": "f_ex86.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7bf3faa-38c9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776257417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257417, "uuid": "185925f2-436f-4bac-bfac-7745145bc940", "comment": "Malware payload", "value": "bc08c7440f5228aca5d8fde1033b78ff", "object_relation": "md5", "Tag": [ { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "c-pdf-ddns-net", "colour": "#388153", "exportable": true, "hide_tag": false }, { "name": "c-pdf1-ddns-net", "colour": "#A9DB14", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257417, "uuid": "72a7093f-230d-40f1-a3e3-c9a782252711", "comment": "Malware payload", "value": "5845cdc723eccd4c697777be27c19fcf47661b11b0a98b89c6aee1f62eed6683", "object_relation": "sha256", "Tag": [ { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "c-pdf-ddns-net", "colour": "#388153", "exportable": true, "hide_tag": false }, { "name": "c-pdf1-ddns-net", "colour": "#A9DB14", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257417, "uuid": "ab5978c2-6593-49d9-97de-50d4eb70622d", "comment": "Malware payload", "value": "e1aca72c03f007827c59b7d5f958f837db70f591", "object_relation": "sha1", "Tag": [ { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "c-pdf-ddns-net", "colour": "#388153", "exportable": true, "hide_tag": false }, { "name": "c-pdf1-ddns-net", "colour": "#A9DB14", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257417, "uuid": "3d75c3f8-4d9b-44b1-ac29-b6a0988c7737", "comment": "Malware payload", "value": "6d373581b3fd03d5dc02b5fbf97709b1a79da02be9e82c79f953892b6e9b46cd8a1b07a6b1ed03d2f60716dd101c5821", "object_relation": "sha3-384", "Tag": [ { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "c-pdf-ddns-net", "colour": "#388153", "exportable": true, "hide_tag": false }, { "name": "c-pdf1-ddns-net", "colour": "#A9DB14", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257417, "uuid": "91553eb5-8af5-48b5-b588-febab8681c58", "value": "T14A27331665542CD1F51B8E43A4B7FFD2F171CB4DBA3F850728B684AA4C1A8C8C36EA19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257417, "uuid": "152070e3-68f2-482a-b475-578d5e996f5a", "value": "393216:OaBhx28+370ID+gplwpnJj3jzTeBlgqILdZH8c8mD+7R4fjuE3Un+L/:zBhO37ZdlgnJj3jbvf+7R4fjlYG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776257417, "uuid": "4593a575-4160-4f09-bc23-099fcd191f19", "value": 20729024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776257417, "uuid": "c4354eda-f9cc-4877-9f71-cb14709c0d5a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257417, "uuid": "1eeaee47-f68b-4493-b07a-0d6fac5c5177", "value": "c725498cebe20cb243facb511f93de845eacdff447fadbf1549b261bd7362c64.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b819fc6-38ce-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776259383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259383, "uuid": "84be85cf-887f-4998-8050-bbde5ecf4770", "comment": "Malware payload (AgentTesla)", "value": "cb88bd7a90471456ce1dfdf377ab73e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259383, "uuid": "0f7d93b0-e74c-4589-82e6-f4442cda0f97", "comment": "Malware payload (AgentTesla)", "value": "5870431bba2eb9f652fc6eac4b10ee9a7159a876ad629771bca74f0add385ed9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259383, "uuid": "263b7c38-5d56-45aa-85a7-5818763bdd6c", "comment": "Malware payload (AgentTesla)", "value": "8c8ca5a9a95c4795a09985f376481d1f5eb6fea5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259383, "uuid": "6738669e-9e9d-439d-98aa-10825eaf4457", "comment": "Malware payload (AgentTesla)", "value": "2158db0ee38496e5d23709c68d3eea0d8b4443c81156a94e1e502c66afe1e4e7fb85fe901da8e1bfe07da9793049dcf5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259383, "uuid": "3a31e6c1-15cc-4a0f-a832-d5d7af209b17", "value": "T1D855021089C43F75CFEC661D90FE160EA3E1498B5016B589FB73BD8AAFEBA04511B19C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259383, "uuid": "15909b53-0aa7-4281-9bad-2e4f25753267", "value": "24576:S+Uq17Fpq+VdqGaTHa3gc6+u2Q+evkiBCJk:S+XY+6Z+uj02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259383, "uuid": "098e3ced-0b40-48f8-850e-aa209a2dba28", "value": 1395387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259383, "uuid": "c2385d6e-d702-433f-808e-339555c9cad6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259383, "uuid": "03cca77b-e91a-4537-9327-89420b280a77", "value": "PAYMENT RECEIPT.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b41ccb91-389e-11f1-a769-42010a9c0008", "comment": "Malware payload (Lazarus)", "timestamp": 1776238970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238970, "uuid": "a7cef351-0997-4f67-b4f9-11ea598c4e99", "comment": "Malware payload (Lazarus)", "value": "fb84a392601fc19aeb7f8ce11b3a4907", "object_relation": "md5", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238970, "uuid": "f395c344-e04e-4cc9-9af3-465eeb6f33c0", "comment": "Malware payload (Lazarus)", "value": "588cdbd3ee3594525eb62fa7bab148f6d7ab000737fc0c311a5588dc96794acc", "object_relation": "sha256", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238970, "uuid": "b7d4a6fc-ebed-477b-b1fc-692a86305dee", "comment": "Malware payload (Lazarus)", "value": "b365bed712582b3792096ff389e1755ff99a1f7e", "object_relation": "sha1", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238970, "uuid": "9367addf-4b15-4a6d-8005-0de903da7561", "comment": "Malware payload (Lazarus)", "value": "2f1c4ba46eee47d05e8350ea404046a9def7105e7de970ffb9e48f24d75f03794fdd461e28aa5f4a2ff2c992a1b18bc0", "object_relation": "sha3-384", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238970, "uuid": "d88b79bf-bd0e-48b4-bb57-93cd94f728c3", "value": "T140E35B4733A074F9E063DA3889928942E7B63C7907719B8F5760536A1F332D1AE3DB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238970, "uuid": "7d852d33-c0e8-4697-9e9b-e5a28bdc7901", "value": "6607e36e3a1b7bd285e3810e78bed30b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238970, "uuid": "4ed8bf48-ebbe-407f-8214-d2d9abf69db3", "value": "3072:EGcHEej7vBGV5T1jVMOOIFpzbTQgl1bFSsZ66p+73XVJr:EGcHEybBGDToOOQBIGbFRxpc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776238970, "uuid": "63836d05-03a0-43a9-a81a-1970eba16177", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776238970, "uuid": "a5043f32-2ef9-47b6-a7ad-35075d9da5df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238970, "uuid": "8ce0657c-0e82-42cc-ac84-0d703b2aa100", "value": "588cdbd3ee3594525eb62fa7bab148f6d7ab000737fc0c311a5588dc96794acc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67afbc80-38bd-11f1-a769-42010a9c0008", "comment": "Malware payload (MacSync)", "timestamp": 1776252156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252156, "uuid": "2c704b02-3c15-4925-9a2e-9f28e5b4cb93", "comment": "Malware payload (MacSync)", "value": "65a4e1e3a9cf1196274d5314528aa589", "object_relation": "md5", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252156, "uuid": "45e53e91-cca7-47a4-8407-f8881fc10e7c", "comment": "Malware payload (MacSync)", "value": "58a327a07bd10e46951c452e7ca3261f59d2fb71864db6091cd09dc7fb6565ce", "object_relation": "sha256", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252156, "uuid": "8076d4af-6f1c-4bcb-8ae0-f8a5e84d9441", "comment": "Malware payload (MacSync)", "value": "34352d113db5d8d01fd45a76565be50d75717396", "object_relation": "sha1", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252156, "uuid": "a9fdeaa3-3934-4e9a-b3d5-042a293ab9de", "comment": "Malware payload (MacSync)", "value": "411c9923ded217c5de87b45b319ac0654c051360c96e841771ca06f21544ff99c03be5b6ef933bc972c25005a1607aab", "object_relation": "sha3-384", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252156, "uuid": "683ce461-7dc2-409f-8473-ead5ac049f63", "value": "T11931C64EA465AF2A6CAE5EB67D2C20E3D2D0DED86C11204906AD2B444D7A7693C07345", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252156, "uuid": "d2baecaa-e35e-4379-bc26-074160ec51a0", "value": "24:kSE+QitdAY5qUXs+9GaTW1W5xMZfQE3eHDI68De7QJIOIszD6yalpEx:IvY5s+90W5xufQQUNQJ1G3l2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776252156, "uuid": "a8675429-7562-4627-9561-1be9bb78a187", "value": 1444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776252156, "uuid": "413d14ed-3fc0-4fab-a9c6-2ca914fd79c3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252156, "uuid": "3bc4cfdb-ce3a-4882-a4c7-9fc9900a860e", "value": "58a327a07bd10e46951c452e7ca3261f59d2fb71864db6091cd09dc7fb6565ce.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e9fc940-3917-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776290903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290903, "uuid": "040a00bb-6dbe-4669-ad8d-51e17f11263e", "comment": "Malware payload", "value": "0ae49b46c4cae45a977a840ed1ab2a0f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290903, "uuid": "cb412485-0653-4f3d-a112-87dfcb150902", "comment": "Malware payload", "value": "5a616700a3fa6a7a14bd38ae6155f53ba2e6578b772abfd8c8978fdb2bcaeb44", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290903, "uuid": "26f2302c-10b1-4e32-a919-c54954ff71fd", "comment": "Malware payload", "value": "a76e2ca7024c2996660f817785732d29ddee4736", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290903, "uuid": "cef1cc0d-a085-4658-933f-5113cdd605fa", "comment": "Malware payload", "value": "1d70897b4558fe93a15b899cc91c816be4478d5596528b691e52dd95a11b73746d1d9dc4534299c4a011716091f37913", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290903, "uuid": "c637354c-efdd-41bf-a5b7-0791636c3cec", "value": "T117A302A7AB58ED7BC82F5C7DD8B4D527EFE06363A090D74B0B2281615AD18B58DF001E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290903, "uuid": "0a9c271e-4656-47bc-b6bb-6e6541f75abe", "value": "1536:t0UwBx84E4uAXQlcWrZvS00eV688DANSct9eIvMvv5ixCR4R:tVwBMAghNZV68C69/Evv5ixCRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776290903, "uuid": "8c773d96-54b2-4a16-9d11-13185d0de1af", "value": 103170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776290903, "uuid": "ca8fa373-7d5b-4bae-b46a-675b9062b90c", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290903, "uuid": "63abaebb-0702-48f6-8e48-dc9085803f0b", "value": "ZIP.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50c9c47-38fa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776278485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278485, "uuid": "0f213daf-da1d-4704-982f-24311ebf8757", "comment": "Malware payload (Mirai)", "value": "f3b575fad948fd931938aca84411905e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278485, "uuid": "c09a33e0-caa6-441b-822c-141cbb6e1c36", "comment": "Malware payload (Mirai)", "value": "5ba1a20fe6849666cf833244c9bc34c1882b3c9879a6f63949e990c10eb7a176", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278485, "uuid": "2a7f81e6-7ba0-4be6-9bac-d7f2df63b1f8", "comment": "Malware payload (Mirai)", "value": "c1fc4df09207c098936d48f53b3cd57fd5e1e6e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278485, "uuid": "5832139c-6fd6-48ea-be9c-19d92a816363", "comment": "Malware payload (Mirai)", "value": "cabf23d238bf7a5ab59535a42c0bf4c6ec5a60bf28375d9f211ee77365e37954b80208c5ff8a3934f9c48e765e042de6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278485, "uuid": "d6e37653-ea14-4f57-8aa9-513511f5080a", "value": "T14F82CF101616BD63E8348133DAA8C9C7679F5DB8C6FA33E132400638E6224A791FDBD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278485, "uuid": "033ed927-49c4-4513-896b-99da46916b75", "value": "384:NjFEcxjeFOQi9bc8mXG0mjTqqUOb35GefPfidhymdGUop5h72pa:4i9Y8mXGxjTVUOTfPqds3Uoz924", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776278485, "uuid": "2ae9507d-dbfd-4d9c-aff8-fb5d074dfdb2", "value": 18280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776278485, "uuid": "cea1506b-57be-4f24-9d29-7ef585df6c14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278485, "uuid": "eedd1fee-3e07-4988-89a9-12e99bd8d339", "value": "FGx8SNCa4txePA.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66377ea3-38ae-11f1-a769-42010a9c0008", "comment": "Malware payload (PureCrypter)", "timestamp": 1776245711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245711, "uuid": "f1c86dc5-ca96-4c44-a498-8baeb442d808", "comment": "Malware payload (PureCrypter)", "value": "e7220c7ded88a99a461d9d08687c7336", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245711, "uuid": "aab8eac9-fb2d-4c56-9d69-e7b03f2f692b", "comment": "Malware payload (PureCrypter)", "value": "5bfef86cee07df46368abb6f568d43971fb16302cb2a8878d2c1a113e32eb26c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245711, "uuid": "3d4fcc3e-9fcd-4a06-b23a-ecd95ea8b88a", "comment": "Malware payload (PureCrypter)", "value": "b76c44c8e481f5d5faaf16ff24b4a2a2178e3450", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245711, "uuid": "4d95f9d2-1f87-4d70-8fae-5b1b9833e395", "comment": "Malware payload (PureCrypter)", "value": "1826c0e7317078ec9f58f5f616abc567a0da89e38ff7d8a47f9a639c2523cf87d8a23eb44935f1350f169b39778f3132", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245711, "uuid": "6a1716a9-1efe-44f1-808d-0977477c9339", "value": "T160221810A7955737CAAA4BB6E8E3035046F4E612A942DE6F2C8C5146BD123106B73B7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245711, "uuid": "153dccdf-727a-4acb-aeed-51dd2288765c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245711, "uuid": "cb799d38-8598-403b-99e2-3fbd6f767e7d", "value": "192:UxCA4PxJA9zeC1Gu0RuFdKTYLkcM6IP4849b:dDJA9zeA0RT0Lkv6IAR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776245711, "uuid": "e1dfcfe4-9f2d-42cf-b5e8-fbf3d937b3fb", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776245711, "uuid": "5d975d95-c66c-4883-9cbe-d04f0a90a4f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245711, "uuid": "a9f611a8-fea9-4836-b790-9e242c45bd7a", "value": "SecuriteInfo.com.Variant.Jalapeno.20356.38426834", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f1168fe-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776239740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239740, "uuid": "86f2acef-c8df-4b6a-aa30-e1194d55b3ff", "comment": "Malware payload (PhantomStealer)", "value": "54492906d4c69e9bea0d640662db034b", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239740, "uuid": "589b5dd2-93db-46a4-b953-1e99981904f3", "comment": "Malware payload (PhantomStealer)", "value": "5c5c064dee0065eebe8e0412408d6db74fe9c8799e3726aea3253320b51c5ce3", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239740, "uuid": "f6581184-2904-4c49-8cfc-9872fc4f0172", "comment": "Malware payload (PhantomStealer)", "value": "5c641bcf33ece3e04b924de754c96c26842b9aa1", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239740, "uuid": "08d4cfdc-9060-44d7-8098-45110d8006c5", "comment": "Malware payload (PhantomStealer)", "value": "26e1391b659b99cfb51020ae738070a7959c757fe2c1ad24e81371c083e4dfbee67dacf02c141ef5433f95d744a1a90b", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239740, "uuid": "10be5465-3d57-4073-abf7-db7cc3dc8167", "value": "T1A2339674294C45EF3493EAB4B08467E3FE6C0A5C9FED6A4F825487DA1A3E68734C3581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239740, "uuid": "0bced053-4cfc-4578-a2e1-5a78d6cd8b14", "value": "768:VPd7UTQtENDKvJBz2bB9pPeq+lxT6qP0iSG:P7CNeRBz2bB9pPUlMqP0i1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239740, "uuid": "50551a90-6101-4754-90d4-b6e3a8e2ba7f", "value": 53959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239740, "uuid": "e3cae319-d5fc-42b9-8752-7c22ea80d8ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239740, "uuid": "51250cd9-3aea-4727-872c-cfe1f2de9e54", "value": "TELEX HBL 2847798274829 DOC.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ecf8f2-3880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776225850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225850, "uuid": "d126c63b-1e3c-4f0d-b6e7-8f2d945cfb68", "comment": "Malware payload (Mirai)", "value": "3089ffebf572f2f8658a81c84cd97bfc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225850, "uuid": "fd13c48b-2d33-4248-8a68-9a9ee66ad023", "comment": "Malware payload (Mirai)", "value": "5c914e4d5506d92f2b7d25018107d15e3ea9179c2ce60e27ec3237650a74c7d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225850, "uuid": "8c571b0f-2a13-4877-a60c-543d6465527e", "comment": "Malware payload (Mirai)", "value": "4e03fef1cb311fde9248d1925d94dabd84d64a55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225850, "uuid": "1e24d3e7-38eb-4b7c-82d4-c7fb0b949419", "comment": "Malware payload (Mirai)", "value": "221bab4f449f47950c602965e5c584e3b95b2b159a94d06dcbb838b6d5b8bc178ad21c903c321fd0c86567739a24d0b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225850, "uuid": "37710352-c158-4774-8a38-68d383387a50", "value": "T14DB31945FC505B17C6C252BBFB4E428D7B2A1768D3EE720399256F30379B96B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225850, "uuid": "d06c4f1e-1ada-4677-87f4-b9143328d3b5", "value": "1536:YGZ6OjrPA8C+Uq4VtbXJTxt9vPEKOO9rb1hw9ZNqWRPlDHwywyshGz7N7ZOLqEdm:56wrPuq4jZX9vcW1heblT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776225850, "uuid": "e0c829e3-64be-472d-88ef-de2bcc19ebcc", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776225850, "uuid": "7e1bb00d-a408-4a4e-82a7-d055ce81850c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225850, "uuid": "f4934fe0-c5e7-4272-a7f3-5bb3bddfbb79", "value": ".Sassy.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e826b48-3880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776225861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225861, "uuid": "bbfbe05e-1a6f-42b3-8478-1c2c8535d38c", "comment": "Malware payload (Mirai)", "value": "a2e3cf62ae607396cdfdf64a63ea0970", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225861, "uuid": "bd53861d-8585-49c6-8d12-bb0a33974acf", "comment": "Malware payload (Mirai)", "value": "5dde3392a1b39edc02f042456957641cec09b5c19ce9eebb50c8f80cf8ba5c07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225861, "uuid": "95d73e3f-205e-4e77-ab05-517c6b49fe3b", "comment": "Malware payload (Mirai)", "value": "35a8274169a573077bad3f6f5611fbc349e75644", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225861, "uuid": "8a359a1a-85da-4e12-9302-8f633836307a", "comment": "Malware payload (Mirai)", "value": "b8b079cc8e32eabcde372da29de86f795e068265416c7a5d9750bb3c9460abeb4022d1a94f909680354997c60409e061", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225861, "uuid": "f4f6d73e-55ba-48cd-87a2-ba42e3ab995f", "value": "T16693F649FD416B10E4D635FAFF4F024973934B6CE3FAB201AA245B2523CAA5B0F76416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225861, "uuid": "30d20a6f-410f-4ed4-8265-825c5ec6608c", "value": "1536:wqnQEMDz8EdtS/pljv8oWKaFuZMgmMGKPlhKv8ioyXi/9RZRYk6:vMkEvqT78oWKaF8MgmhuyXi/9RjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776225861, "uuid": "8c64c17f-fc62-4d01-b253-d616e00ba5a2", "value": 93252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776225861, "uuid": "9d1c372c-6ce3-44f7-81d9-8d741e265b66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225861, "uuid": "c888ea93-1b7f-45a8-a44b-151a9cb6d576", "value": ".Sassy.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa44ea7-38a6-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1776242398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242398, "uuid": "90e6d611-ef95-4fd9-8650-71fdb4913a16", "comment": "Malware payload (SalatStealer)", "value": "5ceebbf529f63cce288793f0c08ac8d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242398, "uuid": "01e8e21a-9022-4ad0-855a-2fa8b4550cb4", "comment": "Malware payload (SalatStealer)", "value": "5df048aa57edebbce68fe0065c69092255368562aae200336083593c89f4a283", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242398, "uuid": "5ae76a45-8a36-4ea2-bd34-2f6602dc334e", "comment": "Malware payload (SalatStealer)", "value": "b833b07b8452f36177af79029bb106f33ea73065", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242398, "uuid": "e9213f81-3eff-4d46-8db3-29220fa5aade", "comment": "Malware payload (SalatStealer)", "value": "5012d415a036adff7affd1d370c2fd7e4556f23e7316bdd3235ec6148398be31cc81569136e4482179b1d28f18bfccff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242398, "uuid": "90b3fbc9-aaa1-4a7b-8908-ccc37dea96fc", "value": "T1B8C66C11FECB58F5E9035831406BB37F63315D048B28CB9BEB183B6AF8776A1196A705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242398, "uuid": "f9fa8554-ef69-4659-8088-4f1eb313c700", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242398, "uuid": "50243773-54d6-4710-8861-1f0ae1966324", "value": "98304:EveuH/b4j5fCi5PqGlkCG1lO4sc3HX+AEcO/:SbgNP9q7OyUcO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776242398, "uuid": "6ebf42f7-e566-42e7-b1e8-1716f93e5f04", "value": 12571648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776242398, "uuid": "053b1dd2-23d0-4c41-8c82-fa9a05bbc765", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242398, "uuid": "26eb49d6-fa36-4bdf-ab0c-0c779f2fb505", "value": "SecuriteInfo.com.Trojan.PWS.Salat.390.22539.16092", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "302e847c-38c3-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776254640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776254640, "uuid": "ad121837-3a0f-4254-a43e-83c4782d01cc", "comment": "Malware payload (Formbook)", "value": "9ace9ad6a5d2de6bc4bc87c0fceffcc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776254640, "uuid": "6ec58498-7ce3-4686-a691-0ee1c5f179d8", "comment": "Malware payload (Formbook)", "value": "5e9416a27d3461852594b456694f7744fab1613cf4d4fc0d22f3664ff4ccd966", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776254640, "uuid": "e289c67c-b312-43ae-94d6-7ee967fc3c76", "comment": "Malware payload (Formbook)", "value": "746c1b408f49541a9c6b1df86641def30d2afd38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776254640, "uuid": "c902ee75-691b-4612-9dd1-6c349bef74bb", "comment": "Malware payload (Formbook)", "value": "4c52dd419fcc7dd8750b662b90c4644eb979d1f98d9f71918c637f09dcce1e2774b8b7894a6267647e346384c1b1fdf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776254640, "uuid": "0b9b78df-1057-42ee-bc78-64091579ef5a", "value": "T19495021149C47FA9CFBC162940FE051DA3F04ECA5426A989EB73BE4BAFF7A04511B19C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776254640, "uuid": "9960469b-fa5b-47d2-be3d-410b0a227c14", "value": "24576:Vo0SgLdA1HQY3NclpvseuN5VdCR8O/WEf7BffpX+yCGBdJJzChXUPOo0Uug0S4MD:K0WNDKfpR8aWED5pu5m/J35bEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776254640, "uuid": "f28c2ee9-a41e-499c-8cf9-70eb0e1328b3", "value": 2016428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776254640, "uuid": "93c0a482-39a6-4623-8a78-fa42cf41d207", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776254640, "uuid": "03d05db3-b7f6-417a-b8ec-c8c3965dd87f", "value": "SWIFT909728728728.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a3d8f9-38d0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776260234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260234, "uuid": "464b4bcd-3ecd-4835-bc53-6d1f44015494", "comment": "Malware payload", "value": "2660a71e3a9b0ac575ca16dd2f5fc8f6", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260234, "uuid": "e3c11954-9f78-4cc3-bda2-c58168719be6", "comment": "Malware payload", "value": "5ec70f64c2c2e47974b74a1c031103fd817b365328fe58119540559f5e4a5878", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260234, "uuid": "0501baa5-5330-435c-90aa-b0c9dad94b18", "comment": "Malware payload", "value": "a0012526e36134ecf5694491cc99bce90ac55461", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260234, "uuid": "613be5e6-106b-4713-8b56-3afc7759a6f6", "comment": "Malware payload", "value": "e6eb53399ecbcd28e7792933a6c540a11de59c66d7b44c28652a562d96ceb32e961722891da5067938bb62f79c83e1f6", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776260234, "uuid": "1095e0d9-1c86-436b-b225-4f2dae624b70", "value": "T174D3DCCE899E88FC871F6428455F9C03D58EA213051ED951BEEEBFA13F12D7474AA8D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776260234, "uuid": "04640fe7-5f67-4540-b5e4-6e60f84d6d78", "value": "768:q/nstFvjK1C066MTerv0P7LgAYFm1ajSSL182S00K2PrBqanSCurwrYPYPckrhiU:qUPv9x2RsPrBqabN0kk1TcytJcwPaak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776260234, "uuid": "2dc861d1-554a-4e44-8870-c4175bcf087a", "value": 133278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776260234, "uuid": "2556b7a1-7294-4d51-9bc3-b5cfe16cfde4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776260234, "uuid": "8f2e51de-3674-4841-bc3b-ffe086776764", "value": "DevOps_Delta_Photos_353.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99de1835-38fa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776278439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278439, "uuid": "ae93a978-e6a9-4afc-9967-0c8581dee3ac", "comment": "Malware payload (Mirai)", "value": "032264f69f7509256f7a8370fe180c66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278439, "uuid": "4529b546-f288-45cd-9262-ea247a9b74f9", "comment": "Malware payload (Mirai)", "value": "5ee10c1171820fb8c0945ad17f018724e55b87c36ef84b1d0e7fad05fd402251", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278439, "uuid": "02a46852-194f-4256-a332-83d45e5038bc", "comment": "Malware payload (Mirai)", "value": "9d84b34a3694eefba10013245b52dbe5ddb5e30d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278439, "uuid": "758d4e1f-e63b-43e1-9401-dc3a7c1eef30", "comment": "Malware payload (Mirai)", "value": "2794c5dfbbc0009d6c4b955e2fcded47fd659f19949fa34a63211ab306abe19036a9f368b8cd1fc49d07d60f3c464e04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278439, "uuid": "32a4a3d1-5637-4f09-af77-da8e1d1c00e5", "value": "T17E632B21BA351E17C0D4647A21FB5B19B2F196DE62A8C61E3D710E4FFF21A406943EF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278439, "uuid": "f70e49c7-2f24-48e6-8c5f-1a88f46d9ab2", "value": "1536:3aRh4MjrNUzgXXvcxbmTK3FVjDC4UinR75SYvtt4nvvZ:KtNWFbnRVjH4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776278439, "uuid": "426ba0ac-29f5-4714-bc5b-94172033a2ae", "value": 67264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776278439, "uuid": "eca9676d-d5d0-4ee4-ad56-371ac6744372", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278439, "uuid": "a4cb83e6-5b74-4add-8c64-73e9718b00ee", "value": "FGx8SNCa4txePA.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80858a04-38c1-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776253916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253916, "uuid": "6b282e1c-f067-42b3-8f85-cbe9178a2de2", "comment": "Malware payload (NetSupport)", "value": "f66f31c4d9c847826a721c9ec571e164", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253916, "uuid": "aa1d554f-e42e-45ed-af5a-de47a356e7a3", "comment": "Malware payload (NetSupport)", "value": "5efa1f8b7e466778389e88f922cf1a6d921bbdb74d5a8651d73c8a0c46c33d0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253916, "uuid": "7ad5715b-aba5-4930-94b2-afe7df92a51d", "comment": "Malware payload (NetSupport)", "value": "d4603174d4c0e81a29ee0f8c834ae443cb935c55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253916, "uuid": "df58a3e8-94a2-433b-9b03-c0974ba4ff70", "comment": "Malware payload (NetSupport)", "value": "86357781c62db288ec9c03f12590ebee1fd82a675020ec5245592989080026ad1bfba817d5fddf442ab498c3712b06bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253916, "uuid": "592c6314-fc7e-47e5-a231-dcf6cca8c9b3", "value": "T163F55C0BECBD4CE9C099E2348433A556BA65BC001B3173D72AE1B6A52F737F09976B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253916, "uuid": "7dee4a2a-50a9-4672-abcf-1f6a34612dfb", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253916, "uuid": "85e2311a-a12e-4e5e-9c5c-18ad8b7b11cd", "value": "49152:ArIc+4fTvSsGTimtMcQ3wMxwQu8T5s9JtIjoQcl1nF:Ar3DCJ4DsT2kF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776253916, "uuid": "43fe993d-ae4d-4c94-8805-36ad714ed0c7", "value": 3507176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776253916, "uuid": "222a7352-3371-4f11-97b9-d569b2e46486", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253916, "uuid": "b5a27e84-9092-41de-8bfa-85ddb0c9c6a9", "value": "SecuriteInfo.com.Win64.MalwareX-gen.77461447", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db76602d-3917-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776291005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776291005, "uuid": "82d6d05c-5597-4f8f-a9c7-b520e4123b7d", "comment": "Malware payload", "value": "5677937197c16866323174d1881c8629", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776291005, "uuid": "e39cd12b-37d9-4270-ad59-87ace440deb4", "comment": "Malware payload", "value": "5fc08b4c4197d94016ec27e3cf09d4943891921519b489ade3c9494d71fe4715", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776291005, "uuid": "1b53f8d9-e341-4d51-be69-4c7870f2d293", "comment": "Malware payload", "value": "95972d83ca1122065eb3e5f5368467e3363cca71", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776291005, "uuid": "579712d7-c56a-4e96-96f1-6a5a88bc0e01", "comment": "Malware payload", "value": "cc1ee7031353e6074c77ce982685e8099fe1c7ad699f37b07a3a64e78285f3c58ed233ddf60750eb05340e24d482d107", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776291005, "uuid": "d601880a-5160-40fe-a48b-bbdf8c37aaa9", "value": "T15526337B8AB7E257E1AB0B3E00B5095B0EAFD125DED3C11B7CE0366C18D359063D6A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776291005, "uuid": "a271e483-a3ef-49a4-afb2-fbf7e449e0d5", "value": "98304:/BSnUU0Y7xprhASuQRKgF+rjD0eAD0RfD06D0E9D0nAvD0/D0GD0Rot:/B80Y7LIw8DmDGfDtDPDCsD0DJD6ot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776291005, "uuid": "f9d81ad1-42e0-49f2-b318-691ac5f143f9", "value": 4731711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776291005, "uuid": "0b5bb931-7ed9-45c1-9691-0a38ea699741", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776291005, "uuid": "73d0ef5f-20fd-4cbb-8685-9cf70e9107b2", "value": "Starpatcher-Shizuku-LP-Integration.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c60e3d0f-38e7-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1776270353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776270353, "uuid": "296408b5-4400-4729-a979-fd7975c7178e", "comment": "Malware payload (QuasarRAT)", "value": "c2c9568a0a8cae9ac3145d27ae34ee3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776270353, "uuid": "adf18fd0-29b2-492a-b40d-02b3d318f930", "comment": "Malware payload (QuasarRAT)", "value": "6029a278d4c0525bd9aaa754fcfb9c3c6b652249a26ff4592b42b9a9434d5d60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776270353, "uuid": "c8f04a2b-02f6-43b0-903f-b41469247ff4", "comment": "Malware payload (QuasarRAT)", "value": "29221772abea0fbb56714434dd3fc844298ec435", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776270353, "uuid": "cf6c9d68-ba95-4bc9-8a3b-c44c5339be1a", "comment": "Malware payload (QuasarRAT)", "value": "8758c45033f0aa8226f3ec9a91ea88cd3db92c8447d0581f76e7bd0573a8c7d9b87bf00f6c6ece1e4cfbe3308c7128c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776270353, "uuid": "1be8144f-3c8c-4d30-8049-838f5dcac13e", "value": "T1D4E56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776270353, "uuid": "04a0d116-f8c3-44ff-9974-6d606d493bf1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776270353, "uuid": "41fe8695-9980-46be-9927-c4ef74f64729", "value": "49152:rvmI22SsaNYfdPBldt698dBcjHaZRJ6CbR3LoGdMTHHB72eh2NT:rvr22SsaNYfdPBldt6+dBcjHaZRJ68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776270353, "uuid": "5575a116-5c98-4e47-b73d-335ec20c3dce", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776270353, "uuid": "029d71a2-c153-4ec4-94fd-751b5fae0aad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776270353, "uuid": "c4769d8b-658b-48bf-8798-9cbc0c9277d8", "value": "usbfallback.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c729e96d-38e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776267778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776267778, "uuid": "abf9583d-a3c7-4f10-b47a-5b7d975fb99b", "comment": "Malware payload", "value": "9fa973a58e6914ddd4a10696c6949dda", "object_relation": "md5", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "hostingshared99-com", "colour": "#52E029", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776267778, "uuid": "7778f0bb-06c7-4e63-b4dc-9c59ebda7699", "comment": "Malware payload", "value": "60cfa524fdb0853afbd4b8ce3550aee355632d1e62acb1db333bfd23fcee579c", "object_relation": "sha256", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "hostingshared99-com", "colour": "#52E029", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776267778, "uuid": "5b8de23e-be6e-48a4-91fc-d5eb3610facd", "comment": "Malware payload", "value": "5ccd0c52aabfbcb88ec6d415cd1d6473568ddddc", "object_relation": "sha1", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "hostingshared99-com", "colour": "#52E029", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776267778, "uuid": "3cd51229-c263-4ed7-8ed2-8e078f560bb0", "comment": "Malware payload", "value": "ac3ea101fa5a5192b5837c24513e0e9595161eda7600b84f157eda50a6fa2c488e03a55638ebaeb1aa2676b2e6426443", "object_relation": "sha3-384", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "hostingshared99-com", "colour": "#52E029", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776267778, "uuid": "96180929-c8be-43d8-a3b0-da6a0bda0ab3", "value": "T10F92D026EE6CD9504CB13010AE76767B65910B2CCA6174E6D360824BB65EF8BC43F1BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776267778, "uuid": "b3b253c1-366b-4535-937d-a71894979b9c", "value": "384:1cm65dyahNRV/E8nzTN2o1CCIseydSia5/dto8IjHxS8g64X1Mr:1cm6zySD/92GLzd85/d68cEW42r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776267778, "uuid": "3f76a767-5d98-4205-ab4e-06a7431b0841", "value": 20561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776267778, "uuid": "9463a430-8d6b-4510-9bc7-186297d78980", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776267778, "uuid": "d90b7e2c-6fb8-40b7-9501-4c9c81a4bb22", "value": "60cfa524fdb0853afbd4b8ce3550aee355632d1e62acb1db333bfd23fcee579c.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461f7c7d-3880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776225900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225900, "uuid": "2d0e4817-2cfc-4c6b-910e-57ddbec19d65", "comment": "Malware payload (Mirai)", "value": "972851517990e9c47282dc945e450462", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225900, "uuid": "85a99b07-24ee-4a23-948d-c8b19cde97ab", "comment": "Malware payload (Mirai)", "value": "610a903fbd31c8d44b1d895d0ca02e866d971f95b238277fab629bd34e268159", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225900, "uuid": "3b3fda47-39a8-4d96-8da1-e1b32890b590", "comment": "Malware payload (Mirai)", "value": "011ef8ed60d88b99de47aa3da35e38a7d03ae583", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225900, "uuid": "2b8db0e0-6b9b-4a85-a5f7-aa6bce93b9e2", "comment": "Malware payload (Mirai)", "value": "66ee20d06a0ac89c4caf5897ee4acc618c453c35062852d7240e31a5d53ab25d62d45e2427618027f2695d7467f8fc39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225900, "uuid": "e50ff775-9f8e-4c73-80ed-7d67f56fd9e6", "value": "T14042D50B57FABE07C1D0E37301E3072266EA4F656124472F7E192C995E9934B2D3ABD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225900, "uuid": "256c9a95-6aa4-49a7-a221-55e744991d0b", "value": "192:dmLjGr1/WTohTAjo7usPuEfHsCi0UZNDstqYM1Dq3cjeZ:AuaauDEfMC7Uphq3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776225900, "uuid": "e42f8ec8-3096-40f8-acd6-284d7de6775a", "value": 12292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776225900, "uuid": "a741d326-b536-429f-aa20-8e28d53defc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225900, "uuid": "780b9f01-9718-4693-907d-76990c89f449", "value": ".Sassy.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0ac29f-3880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776225882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225882, "uuid": "ece434e3-2aee-4ac9-b812-0e6d9f18803f", "comment": "Malware payload (Mirai)", "value": "5270bb5509ac4d3436c4d368cff6244a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225882, "uuid": "10b43440-9e5a-4afa-a623-49c7b64dc4cc", "comment": "Malware payload (Mirai)", "value": "62d025681389bd4860c1c7bec3eb60072a8da7c35fdaf743b51b35c484172279", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225882, "uuid": "4ea3f7eb-d4d5-483e-97f3-52982a33527a", "comment": "Malware payload (Mirai)", "value": "0d6bfba529a99f7ae82f5d403f0b942414aa6b7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225882, "uuid": "706ba454-3961-4f7c-96d7-34b6d5d81f13", "comment": "Malware payload (Mirai)", "value": "f0b28e4c83b4a08c8d290bb6ae6ed0dc60616c1ab06aa12e1f0b69cad03ae0b95fa602a171b96a0b32c3778caa112ded", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225882, "uuid": "69ce7b75-b778-4748-b2f4-7bf3066bd5c8", "value": "T1C523F1A7C42FE92ED83CDDB40A5385D9AA636B8BA2C302473DDD58C978577D43920EC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225882, "uuid": "e342e4f0-758a-438f-b105-c6b6fc2d0c2b", "value": "768:SSzEW+AYjn9/JP5Hz/V25GLD4nsYwlihu7NoRGZaS1yvsWdIZkyn3pv4i:SoE79p5HeyD4glisORG0S0vs7x/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776225882, "uuid": "c8ec5cfa-2161-4d09-9c52-681cf0739627", "value": 47696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776225882, "uuid": "c41b6fd8-fc54-46fb-838e-43d4bbdbfdf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225882, "uuid": "072c078d-d677-42fa-9f22-05bd9b59b020", "value": ".Sassy.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a18cc6-38bf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776252857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252857, "uuid": "36b4ea18-680f-4242-bb60-4d565506ddac", "comment": "Malware payload (Mirai)", "value": "13d72fcb9a12701f8c8be0f1364d7227", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252857, "uuid": "7e39f79f-b013-4eaf-b955-9d23291426b9", "comment": "Malware payload (Mirai)", "value": "6637bfe906ea4f693ee49e833691f0a3de69c8d0e46841e6c8d80f08af2dce98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252857, "uuid": "9b24743d-2d01-4c08-a572-5306e6077ce9", "comment": "Malware payload (Mirai)", "value": "b30383573ca4035ee5d4fe99c1f0cdcaa5959904", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252857, "uuid": "ea9fb491-dcde-499c-9ad4-7bd0549b53ca", "comment": "Malware payload (Mirai)", "value": "bf7dbaa4e53d4fbc58b74fc44ef7e7788cbb947f2d1e658ca85e24020d5572aafb508528e07d9f951107987198a2776d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252857, "uuid": "a8843b9d-3a44-4233-b05d-744df98251a8", "value": "T1F993121C55394131CB210B7B37DC07D978641EBCA42AF168D3BE0BA5664B8712BEAB4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252857, "uuid": "02b51492-c3e1-46ba-93ae-64ea05a79258", "value": "1536:KZ4sJJH9Qt89F52Noju1dpSk47LBFGKLDctVlhKoS1LLy4nNu+ve4qsa7VbhUi:BMh9QC7u3pS7709wtLlnNuKuRhUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776252857, "uuid": "5ef6faa1-66b7-449f-aef3-c1d0232343bc", "value": 92840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776252857, "uuid": "cc266637-7830-4a41-9443-15e88c3f0fea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252857, "uuid": "38d45050-f16c-4787-9958-cb5988c2d9e0", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b10ba22c-38ea-11f1-a769-42010a9c0008", "comment": "Malware payload (GlassWorm)", "timestamp": 1776271606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776271606, "uuid": "c7509281-68be-4b7b-833a-97d3c3f44aa0", "comment": "Malware payload (GlassWorm)", "value": "adee5310ab97b472d1c7a5f478e143dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776271606, "uuid": "3a214d75-6798-4c46-a5ed-62152b522cf7", "comment": "Malware payload (GlassWorm)", "value": "664408e2c14cbf4ad1eeea0d7bb65593e612527bacc7b814b00b2f0a445a6cba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776271606, "uuid": "808ea0d8-7dc0-408b-9566-4e0200584ac8", "comment": "Malware payload (GlassWorm)", "value": "56be9cc8bc4aa815308023709a27f30525a31dd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776271606, "uuid": "25cf49db-d077-4ff4-8ec2-f786002b8076", "comment": "Malware payload (GlassWorm)", "value": "d48e6474f700ac6be75535234083bd612eb1005e8511e7fa03e41a81bb0ea9758e5231e2d42a4d31e4fb609f29c6c9cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776271606, "uuid": "20c0f6f5-ba29-4a1f-8613-217f867e8a16", "value": "T18825BF83D292915CF41AC1715B2EA273F537BC448B29AFE76790DA361633BD02B7A710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776271606, "uuid": "e0f8f04d-856f-4e46-9e49-01177a6611dd", "value": "5119aa243ba31aa561ba123ac413a1c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776271606, "uuid": "a74fd98a-085c-41f5-b6b0-9a8fe0b4fe97", "value": "24576:y+pqd2T3OEe0JRh+w+qY5b8Y5bJY5bDgX:y0T+EeiRh3YaYrYdgX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776271606, "uuid": "cd9b8831-a48f-4520-a083-c8716ee1350f", "value": 1018368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776271606, "uuid": "0c91f585-39da-4da6-a2b8-7c08adc11d0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776271606, "uuid": "9237fed8-2dcb-480a-9dd3-da07bfe53c00", "value": "w.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e6e0fcd-38d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776261563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776261563, "uuid": "a0f3bb16-8a03-4a2f-bbd7-8cdeb7c84272", "comment": "Malware payload", "value": "4120bd7acc38a3c96c333ce04083823c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776261563, "uuid": "a98eb5a8-9975-4321-b192-53f3d1039a74", "comment": "Malware payload", "value": "665561b170d89f59f7f39f3d6fdbc905a2f59a7d1d069afae8fa18b5c3a20dfb", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776261563, "uuid": "a0daa6d9-893f-41f2-9cbf-1ec4f340ee50", "comment": "Malware payload", "value": "5018827fb10ec68661649e06e45bc9bcb3a0f680", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776261563, "uuid": "610b269e-8f4c-4266-9a00-2de1ad138b3b", "comment": "Malware payload", "value": "38ddf366aec5bba94457d10daf06a8a8a99a705cbea67ee6ed9ed3ca7e124a75e6ac44d98d6363d76cf5c9e8cc064cb9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776261563, "uuid": "e4ecd42a-b922-4929-950c-92a3b3ac10d3", "value": "T1AB65F146E6D5C91AE072C13F483BACD252ACADB4D5A87EC3765773A7CC2B70301A62D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776261563, "uuid": "b2dda04a-b540-4424-b960-9d0c1fd6ba9a", "value": "24576:VVzeCnGd4LJ78YRT80/KadOV3eCnGd4LJ75YRT80/KadNM9t6K0x:vCCGd4LLRTh/wuCGd4LwRTh/40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776261563, "uuid": "1f4427e7-3092-4785-8a07-654af6cef8d5", "value": 1417216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776261563, "uuid": "c2bcb516-4e63-4ee2-9ff4-1d5bb06329ed", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776261563, "uuid": "dc4c38c5-5dbd-4bc1-b363-83f73ac104cf", "value": "Naro\u010dilo podjetja FOKUS doo.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc16555-389f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776239519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239519, "uuid": "1a976be4-8b2c-4572-88e9-96a627c1c441", "comment": "Malware payload (AgentTesla)", "value": "dcb7d07f86be5f7f111a40ceffc5096d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239519, "uuid": "d37e50f3-1e53-419f-9270-751c16f439e4", "comment": "Malware payload (AgentTesla)", "value": "66aae0218e3375fbc87f3b7ff9015b2988e1f800c0b8e97007bb97a20693f710", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239519, "uuid": "da6f34c3-3024-4764-bde8-f7b7de84ddc1", "comment": "Malware payload (AgentTesla)", "value": "33619dafeecbc2acbce19e15932c91c7d75c5b37", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239519, "uuid": "2a389b83-c7e9-4dd1-8376-982987ac3fc4", "comment": "Malware payload (AgentTesla)", "value": "b65c3860606916c8ee67452f046af7eedcb0422276a51be4c1d25272a0e17a26eeac6010f3548396b2d34ca842909416", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239519, "uuid": "9dc49749-32b2-4df0-aad5-98180003f5ee", "value": "T1AAD5C1EA5EBC46B55E5F10ABE8D24190E23B48FCFC36B649F090470433DB689A6CF594", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239519, "uuid": "bdd7c74e-0da9-4a67-a551-ad8c9536bbd0", "value": "192:yCtxznzeDI/MR33eiqBK82bNZqP41VihWaX1KyG2fubstEbXm9XjC99sq/KmKOpv:ogp35MWOTQM4k8SA3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239519, "uuid": "aaaef9ba-5c4d-42c3-8efb-2c4a2ed78bae", "value": 2844059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239519, "uuid": "7a6f3f37-cc18-429e-9397-843abdff47ee", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239519, "uuid": "558c9ce3-f900-4ff3-b857-a292558116d0", "value": "DHL TELEX GUIA 1Z4815906897663406 Confirmaci\u00f3n de env\u00edo 1Z481590689766666.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "669661eb-391d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776293386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293386, "uuid": "e6625b96-976a-4446-87d5-d69401bbeac3", "comment": "Malware payload (Mirai)", "value": "64bc07f425252e96c067b82fd92d7a08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293386, "uuid": "772fe41d-a61e-44b3-9412-7b09c3ea8af9", "comment": "Malware payload (Mirai)", "value": "66b2ec2a88bec13d717218c6f8d56627fc1f353238d5705b163f042a4591c8f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293386, "uuid": "25ec4814-fe75-42c4-a544-065a51977434", "comment": "Malware payload (Mirai)", "value": "f4ea4bf5452548112c8e7ecdc38f100ea0c0f5e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293386, "uuid": "a038eae3-983b-422e-bb20-0beb1293e358", "comment": "Malware payload (Mirai)", "value": "29a55ca9bbc01cb8cb438e58ee5d693a73e411603ae92da46752197df0da065e02fc9b19196d2615fef2bc94876af95d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293386, "uuid": "a3e115ee-f08f-44d1-9a45-d5d3d4e0e8d1", "value": "T1B4D35B1774D0D0FEC8DAC2B44FAAE22AD973B42D1278B11E27C46A273E5DE206F5D600", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293386, "uuid": "b4f609d3-c978-43dc-b0cb-d62add01e0c6", "value": "3072:yjZOfm+0GIlh9rE1MkQBnb6vM6ijO5Q4wt:UOWWDa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776293386, "uuid": "913c075a-e4c9-4ef0-a8cb-52d1bfca73b4", "value": 131112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776293386, "uuid": "3c7f60d0-c937-4a06-a986-384777a61ae4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293386, "uuid": "95c57727-4cb3-4093-97b2-6af0f13b1e74", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f19c1919-38e9-11f1-a769-42010a9c0008", "comment": "Malware payload (RedTigerStealer)", "timestamp": 1776271285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776271285, "uuid": "1fdf8e60-666d-4acd-9bd1-4b601d1667d6", "comment": "Malware payload (RedTigerStealer)", "value": "1352635f7b3f38161209e83df3316323", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedTiger", "colour": "#F0D50C", "exportable": true, "hide_tag": false }, { "name": "RedTigerStealer", "colour": "#85B9EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776271285, "uuid": "1d11030a-10df-4c0b-a2d0-3754fd53e48b", "comment": "Malware payload (RedTigerStealer)", "value": "674b632a01da79a804e16105c173465b5d4127b54b08eab390876213acf81ec1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedTiger", "colour": "#F0D50C", "exportable": true, "hide_tag": false }, { "name": "RedTigerStealer", "colour": "#85B9EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776271285, "uuid": "93ab303e-fe92-4f26-a159-7c99318e77ae", "comment": "Malware payload (RedTigerStealer)", "value": "e2ad8f9007a2715f91ed52d46fab4b5a6525239b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedTiger", "colour": "#F0D50C", "exportable": true, "hide_tag": false }, { "name": "RedTigerStealer", "colour": "#85B9EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776271285, "uuid": "c9dbf803-cf45-4519-9b34-ffd5377d3f0b", "comment": "Malware payload (RedTigerStealer)", "value": "daead44fdb2284e630843a9d515334702aa2a2fa774e4a6416e9575b0df2512fe2376671f42ea1dcc028e02d0927a1f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedTiger", "colour": "#F0D50C", "exportable": true, "hide_tag": false }, { "name": "RedTigerStealer", "colour": "#85B9EB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776271285, "uuid": "ed7fef5b-10f8-480d-b063-8c02d6d2ac7c", "value": "T1E5F6339189C404A6F4B2A03D49748733F3B3AF613B61D58B0EB43B26EE7B9D5183D265", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776271285, "uuid": "d13b5338-574b-4c64-8800-ad91972a1167", "value": "351592d5ead6df0859b0cc0056827c95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776271285, "uuid": "cd794bf2-3a1c-4b2d-a5f8-0f55c0d3f5a6", "value": "393216:WU2RkMdhi5Pxfwx/hqWbdXQfM6R4Rmh7HsnvDwH/+Uff4:WRrhiJxYxvYMc3jgEH2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776271285, "uuid": "46b65b50-d020-4ea9-b947-3d4aa47aa270", "value": 16178284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776271285, "uuid": "50c50deb-8e78-4437-9709-9525afb30524", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776271285, "uuid": "7500e3ee-cd6b-4887-b3df-95e9431bd71a", "value": "Bloxflip Predictor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa75eb0b-38cf-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776260133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260133, "uuid": "4d7d0e16-2837-44d6-ac6a-2581b6c4e3af", "comment": "Malware payload (ConnectWise)", "value": "8d730236807bcb3b5e5dfcf9b0467dc8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260133, "uuid": "d926f604-97ad-4564-a68b-50610c9869ef", "comment": "Malware payload (ConnectWise)", "value": "67ce3a585c7bc978400957070670c70502d8deb4e4c6b583894e6c428489cfa8", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260133, "uuid": "53a73fd9-bec4-46aa-a6ad-415fcc8b6726", "comment": "Malware payload (ConnectWise)", "value": "26f9b26aad85450c95c398d5bacb10d48ed38aeb", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260133, "uuid": "f37b016b-ec57-421d-b5ed-ae535fba7fb5", "comment": "Malware payload (ConnectWise)", "value": "68beb0d6a5929a13e96f6776013c60adc85c07677f640905e0af816d040159da0bea4f504ecb930a16526373188e1a27", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776260133, "uuid": "5be193c9-8624-406a-947a-39b23cd29b37", "value": "T10285F03172E4C139E2B61A39E93A92F059797D54CA63815F93B47D1E39B0E8096B3333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776260133, "uuid": "2a917975-727d-4dc3-8d04-6c0ffeb97784", "value": "49152:oKCp7lczCEZxsLHBwgYL5IdXGuNQiC1g:RCr4Z+zBi5IFGWQiC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776260133, "uuid": "6f1a66d0-38e7-4e02-b660-e89d8640e674", "value": 1859584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776260133, "uuid": "1c663a35-730b-4486-b91a-7df284d76762", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776260133, "uuid": "8e2dfdbe-71dc-4aeb-9c64-28d02401c4a6", "value": "SecuriteInfo.com.Riskware.MSIL.ScreenConnect.Heur.7369.4283", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6124f3cf-38ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776245703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245703, "uuid": "2eddb3f0-7ab7-4e9d-bafb-9bafc344a56c", "comment": "Malware payload (Formbook)", "value": "897f11fc992f5ed0f01b5fcd69957a1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245703, "uuid": "e0f16eea-644d-4b6c-9c61-aceb3c066961", "comment": "Malware payload (Formbook)", "value": "67ff11dca6102d119fb3cc42da0c7d920db3d94e0fde800689d11540e9dfe5a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245703, "uuid": "fc0e9c99-0477-4a92-9958-396c1bf81d23", "comment": "Malware payload (Formbook)", "value": "2a18dd60b26e7ba2673afa4020fc968df7ba1b79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245703, "uuid": "9cc6a278-be97-4b61-ab17-ad61841ab168", "comment": "Malware payload (Formbook)", "value": "6cd04dc5784ae2be7abf50891bae82879513aa3a6e130b452664b9d4dcc7f00bf39ab9514c443e336236cc6de88b5ee9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245703, "uuid": "7b85848b-e1a7-4ba2-ac9c-14055b852c56", "value": "T1E515F1E03B29BB09DE610A31E979EDB642F61D68B4107AE659DD3B4739BC2116D0CF03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245703, "uuid": "a49d00f0-6ba2-435d-b07b-b7a9159606ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245703, "uuid": "b47e4ebc-2493-46d9-9c8b-3c8dea51de0e", "value": "24576:4xwjKSoyMxCsuoOCVEMJka0qvLV0G41BlrCBdzrlD:ROrvTuorEMt06LOHCrlD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776245703, "uuid": "6d84b565-6c37-4d44-8459-ad0f784ab506", "value": 881672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776245703, "uuid": "d897fd9c-2bd6-40a4-8068-68e429fdc490", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245703, "uuid": "f88c914a-6fe9-439e-8290-895b242bac5a", "value": "SecuriteInfo.com.Trojan.PackedNET.3184.29967.7472", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c11c9fe-3880-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776225857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225857, "uuid": "ff1c8136-b8e8-4adf-acc4-3068bd40ac95", "comment": "Malware payload", "value": "545b541d6a9fa2a923d31d64a0170662", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225857, "uuid": "4731c4d1-88d4-4479-bd81-99121ebd9daa", "comment": "Malware payload", "value": "693e032d392b074e576d3c93daae8670b82d1747debca8ccd3a109aa51f42d14", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225857, "uuid": "0958085b-0ccb-4eef-b3d3-0794cc2c0dc2", "comment": "Malware payload", "value": "d998889b91983b5cbdb10c48d1b520bd472b2904", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225857, "uuid": "9cc79ec5-02ee-4157-9214-7906e7522372", "comment": "Malware payload", "value": "8cbebeb5db44e1f627d006899fafa4f4d0a7bf1d367896ead85617dbe66f7c7f97c305d0b18368616ad9ffecf3fc25a1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225857, "uuid": "bf5e75d0-16b5-4f62-898c-bf26a3ef991e", "value": "T1A2116DEC30A8207EBD01AE46B2B65AD4B111F1FB6D834F90E8080974F58EBF4716E744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225857, "uuid": "d2f2d476-603b-47ba-be10-94b8d3bcb375", "value": "12:X5zFE5D5UfEEk5KNI5rEDD53cKrEf+5+kafaE+5D1DIr61HFIN1nIp1edIIenhcT:AYNILK8kAG5RUrkSXITEEc/ZSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776225857, "uuid": "f0a9f927-f3ca-40c9-a973-3588d878cadf", "value": 1087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776225857, "uuid": "f8b87543-39f1-45db-a1ee-ca33ba2b5b93", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225857, "uuid": "0ac2ba48-4b68-4294-baee-4a4391eb8540", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b778dafd-38b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776250142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776250142, "uuid": "d1cd9339-67d7-44ac-b236-29b97a6a3f20", "comment": "Malware payload", "value": "8f916b6661e013ffbf318ed78e24a7c2", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "Covenant", "colour": "#23E550", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Grunt", "colour": "#3467F9", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776250142, "uuid": "4743d2d6-e5e5-4123-95c0-3894a435dd80", "comment": "Malware payload", "value": "69609e89b04d8d27dc47bda2971376cfd760abb40ffe325f00d0cf3303be8906", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "Covenant", "colour": "#23E550", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Grunt", "colour": "#3467F9", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776250142, "uuid": "57e92e52-ff05-4458-8854-f8b01a61f728", "comment": "Malware payload", "value": "2827e98f4d96b37f40fa67cd3efd6fc7b6b1bce8", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "Covenant", "colour": "#23E550", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Grunt", "colour": "#3467F9", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776250142, "uuid": "4a3e1847-a608-4ef2-91de-b0ec3b7d4907", "comment": "Malware payload", "value": "02b42a57a5dd69c5a357fef823997ce6f0653aa82693da2b989df208cd603c24a3f3337fba1cc807a029c6cff88330d8", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "Covenant", "colour": "#23E550", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Grunt", "colour": "#3467F9", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776250142, "uuid": "f90fea66-6449-413b-a138-68572bfd0d4c", "value": "T150534C2D23EDE62BDA6E1679A460051503BAE10F2003FF675FDDA89B3F523421C81AF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776250142, "uuid": "31a5085b-3846-42b8-ba37-ebd015d128da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776250142, "uuid": "1f00c7da-ffca-4563-a432-3ec60819cca0", "value": "768:yyC84F0Ibq7eBRdx6M5d33JlJR9FrCidnu2gk+gUU6r21WIg01A/naF:yV7Bbq7er3HJ7RpFgtk6rOWIg0EaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776250142, "uuid": "a5554cda-3045-48b4-b5b7-fd11bde344b8", "value": 61957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776250142, "uuid": "4328b155-2124-49ba-95c2-43093c9f3077", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776250142, "uuid": "b0145f60-357f-4e70-95f5-b4553a15b53a", "value": "covAntinodSt0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c31e648-38dd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776265907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776265907, "uuid": "781bedf1-984a-4bbe-8f03-1f424c0c8ee3", "comment": "Malware payload", "value": "1b146afd2bc7168d96a9a62480f45dec", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "hostingshared99-com", "colour": "#52E029", "exportable": true, "hide_tag": false }, { "name": "novidade-eastharlemscholarsii-com", "colour": "#5F39E4", "exportable": true, "hide_tag": false }, { "name": "paysys20a9-hostingshared99-com", "colour": "#3F78EC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776265907, "uuid": "fd103e13-c211-4e2f-86af-2239e6e9d715", "comment": "Malware payload", "value": "696c226c6799ca83006d0a566d34784590eb48a26233a3b7b4de5726f49cb25c", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "hostingshared99-com", "colour": "#52E029", "exportable": true, "hide_tag": false }, { "name": "novidade-eastharlemscholarsii-com", "colour": "#5F39E4", "exportable": true, "hide_tag": false }, { "name": "paysys20a9-hostingshared99-com", "colour": "#3F78EC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776265907, "uuid": "c50c8f8f-947e-4a26-94ee-1d173efe877d", "comment": "Malware payload", "value": "8d068cbe235be3c9c921e8cf49a9dd5b4cff0107", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "hostingshared99-com", "colour": "#52E029", "exportable": true, "hide_tag": false }, { "name": "novidade-eastharlemscholarsii-com", "colour": "#5F39E4", "exportable": true, "hide_tag": false }, { "name": "paysys20a9-hostingshared99-com", "colour": "#3F78EC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776265907, "uuid": "77d943e3-a1a8-496d-aa82-137b8cf5f3e2", "comment": "Malware payload", "value": "b40fbbf5785a1a0a8260cf358221b2eaaf19f844e68c1bde81ac96f6471dab5cd26520a8808e2911df68f9002a588e8f", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "hostingshared99-com", "colour": "#52E029", "exportable": true, "hide_tag": false }, { "name": "novidade-eastharlemscholarsii-com", "colour": "#5F39E4", "exportable": true, "hide_tag": false }, { "name": "paysys20a9-hostingshared99-com", "colour": "#3F78EC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776265907, "uuid": "c08af15b-b356-43f2-a8d4-8b3e16ef6a28", "value": "T11A616C8474087B739D4658707EA30C910C202730D48BD425BBFC2C374CAABBE388A09A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776265907, "uuid": "1bf61fc9-1ca8-4884-aa76-6f835e921d9b", "value": "96:EbuuCUslHJjUzh+VmhCgo+rCmMJZxzwMNUB+P:zuUlHVkQpgoQCJDNUBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776265907, "uuid": "87fc338d-dc28-4192-abad-dbe4f4ba7098", "value": 3221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776265907, "uuid": "ad4b9aad-6b61-4f34-a73f-b35f1d86368d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776265907, "uuid": "01947e2f-1859-42c8-acbf-9d01d6c0712e", "value": "16699932521.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a77f22-38a6-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1776242382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242382, "uuid": "c0411059-0032-44c6-b29b-cf381ce401e7", "comment": "Malware payload (SalatStealer)", "value": "5f0fd5c652695c203259b1c5e49cdf5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242382, "uuid": "ae915d45-deb3-404b-98a4-348198745128", "comment": "Malware payload (SalatStealer)", "value": "69decd7906f215fb3f05f332fd6293715adf9ae7b0e88ff0bed77428a64e7b22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242382, "uuid": "52b8e35b-1fad-4367-aaef-c762cb907003", "comment": "Malware payload (SalatStealer)", "value": "2489b4d4e69a3d3febb9fa5bcbc343bebdfbe82b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242382, "uuid": "3ac667fe-0d5c-4ca1-b459-965f535ce762", "comment": "Malware payload (SalatStealer)", "value": "856ec71ce73c859b8c675d9463fba16ab42002adb4cf24f0492dbabc3807456cf9ed96eb905f6b1dec4b46369bdb0030", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242382, "uuid": "24b48655-288f-483d-b2a6-58d3a020d6d9", "value": "T133F533247745472ADD4C7530FE6B6508BE8ACE07A6FD4EDB80F5B4F86821B28325D21B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242382, "uuid": "876f92b8-5874-4e08-ac21-68c6726f3f2c", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242382, "uuid": "2cf47f9b-2966-4322-87e9-5b0d210a641a", "value": "98304:6fhFPwYPAaSPcp8WicbVOqZJg1NTQSuf7JH5wn4:6fhFNP9LlhZK81H5w4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776242382, "uuid": "33eece92-2bf7-4788-bdef-aa88add30991", "value": 3547136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776242382, "uuid": "8250cb76-92d3-455e-8b2d-e872937e5b10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242382, "uuid": "51a42891-d64f-4948-9694-050642d66f23", "value": "SecuriteInfo.com.Trojan.PWS.Salat.390.31478.20438", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70d0567c-38bd-11f1-a769-42010a9c0008", "comment": "Malware payload (MacSync)", "timestamp": 1776252171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252171, "uuid": "d996d341-7133-43e5-980a-ba905a47058c", "comment": "Malware payload (MacSync)", "value": "e58d91ef40850e7aabde1ec25ad2fe59", "object_relation": "md5", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252171, "uuid": "9add5ae6-ac8c-4b03-91b6-75fc253ae71f", "comment": "Malware payload (MacSync)", "value": "69ef599a58d03b3ff11947589162943110fa91ea734faf121787ee9aa34d8d0e", "object_relation": "sha256", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252171, "uuid": "089f4688-e82b-48cc-b91c-e5ea59f92455", "comment": "Malware payload (MacSync)", "value": "16a5e3979a0b3f4cdfc587fe85c1f1a2615c5ab9", "object_relation": "sha1", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252171, "uuid": "c6860cad-10b7-47a2-b390-4ac2b728b72a", "comment": "Malware payload (MacSync)", "value": "ba15666ae174e9c49457f3bc1e18c37112873100ae348fbda7f57e6df30edfac4fda4beb82c82f8e6a78a14730d22986", "object_relation": "sha3-384", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252171, "uuid": "f6d3b83c-4400-432a-8b70-5d0f82fcc866", "value": "T1CE21EB1CBE2C997DBFD9DE16EA55E635821914710D2911FA8E5C3F8128D17074010259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252171, "uuid": "18040fb4-533d-431b-8ccf-b92cd3731e32", "value": "24:3tYHnM+dqN7gtNvAXNndhCTMNzcrQhTckRzKQGby+71PbbnCQM/SCC3v:2HVdqWbrQSkCb9RPbA/+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776252171, "uuid": "18a95628-12a3-45f7-9b66-f300c35469b5", "value": 1432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776252171, "uuid": "ebbf47c7-dca3-4d5a-aaa4-4a88b04034a6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252171, "uuid": "bc16dbe6-5fed-405d-8641-d344af412cf1", "value": "69ef599a58d03b3ff11947589162943110fa91ea734faf121787ee9aa34d8d0e.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "379bf35f-38ba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776250787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776250787, "uuid": "73cb3953-2116-4eac-8318-1f14e2e8a9ae", "comment": "Malware payload", "value": "88caf44c90dad0b21407df3ecdd6afb1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776250787, "uuid": "55eb16ef-b0e5-4107-aa59-84215ef7aea6", "comment": "Malware payload", "value": "6a715ad48b776c5a49405d8f9350209e45052b202e9420ba80e2bada16d0c8bb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776250787, "uuid": "b31da8a9-b8ac-45ae-bed6-220f623a0661", "comment": "Malware payload", "value": "391ea16a54b39f9c7bb22e90b62145128716a938", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776250787, "uuid": "b2c82aef-06a5-452b-a745-b7d2f1ea898c", "comment": "Malware payload", "value": "38c9c6983f1983652f40ef34b4cf905c895285ae10b371ab403a5e0a357571b197030a74ca6bcb92aa3944baea4b5ff6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776250787, "uuid": "a40843cc-82a6-47d3-aeec-35b1292d549b", "value": "T139A5D03BF28BA53EE06A1A367A72E110543B7A2165164C1696ECF88CCF751701E3F787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776250787, "uuid": "42aa7e15-33e0-4955-8195-601622ee4ed0", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776250787, "uuid": "ff1ad0be-9ede-482c-9457-8bf9074ee316", "value": "49152:RuI2h3Iyun/ggS76zvJO5WImt0XDR6KG4VqYqp:R5OYX/gL7kBO5WIw0XDR6Pktg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776250787, "uuid": "ebfa188d-b24b-42e1-9911-252cee2b496b", "value": 2096129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776250787, "uuid": "6da4fac1-ce1a-4b32-92ec-5800ed448cfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776250787, "uuid": "81137b49-a379-4192-8bf3-9de9b039c117", "value": "CORTEX_Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e188bda9-38b1-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776247206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776247206, "uuid": "13e7e283-ebf6-4a03-ab68-0cd7a0e84de9", "comment": "Malware payload (RemcosRAT)", "value": "5f2913b187217336c7fef2b99560c88c", "object_relation": "md5", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776247206, "uuid": "7166e0aa-8bf3-4150-8abb-bd52a09e1e5f", "comment": "Malware payload (RemcosRAT)", "value": "6aec1b91b8f387fafbb986d5eb0ca896deeb3453f2a58584e53a34e5987b3f63", "object_relation": "sha256", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776247206, "uuid": "388f2018-6b7e-4469-8b45-52c751993094", "comment": "Malware payload (RemcosRAT)", "value": "3c300b2e985e1303fa0828077e4acf2fb687cafc", "object_relation": "sha1", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776247206, "uuid": "9eeba4cc-e319-4493-802e-b9ead07fec49", "comment": "Malware payload (RemcosRAT)", "value": "f27619ddc4475bb2790a915b9db76e3af61f427eb96b5e03b2c2d5b868279be6ef2828436951ed20f380524be0137a83", "object_relation": "sha3-384", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776247206, "uuid": "407293ea-13d7-470f-8da5-f23d34ecff96", "value": "T199D42340397CA425EC04E2B752A210F309342BE1E9976672187FE42CDC897DF95FD6B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776247206, "uuid": "1b68d701-a897-44b9-ae71-e9939beead25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776247206, "uuid": "4e40fd7d-a141-410a-968d-ee10d0360ccf", "value": "12288:tq48r+N1PJZR9OUQKKsxgRhmdZu6I5sUoMEj6GpZu7iCeLQZBTdV4kRbSo:Y486fP7+zK/46IlujxyiC3l4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776247206, "uuid": "76c57fc7-5dc6-4f2a-847c-a45bc6a1182f", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776247206, "uuid": "ec5b7809-31dd-4dee-8bab-8e7ba4b94876", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776247206, "uuid": "3b5773ad-3674-438d-8f99-bd52c8df9922", "value": "6aec1b91b8f387fafbb986d5eb0ca896deeb3453f2a58584e53a34e5987b3f63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad18d475-38fe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776280190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776280190, "uuid": "d71354b0-7998-441b-a5d2-7e52fe0017e6", "comment": "Malware payload", "value": "6c1342bbc4017ab1cc3eb8fe5d356c87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776280190, "uuid": "77424c49-6b28-4cab-85ea-c18f7603ac29", "comment": "Malware payload", "value": "6b7ff061eebeb9ead8812c410247768a7ba90786aeeb1bafa6412cc5b08237b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776280190, "uuid": "0fe3bca5-e9d9-44d2-97ee-b24c49406dde", "comment": "Malware payload", "value": "982c22670b380ade0f58ef486b9a3a659ec190dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776280190, "uuid": "76293abc-cf6f-4afc-850d-c8aecda5c855", "comment": "Malware payload", "value": "42809fc678391cc578166b5e57034f930ee8727b81fbad807ecac271023cf3607502d9b2264bab7eb44b1a919224bbde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776280190, "uuid": "279153a0-1fe6-4420-9486-30609a7baa11", "value": "T107B58D0B6CA048EAD4ADA3328CB761967B70BC560F3267D72E517A382FB27D09D75704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776280190, "uuid": "920640e5-094f-40d0-9804-ec70f3fb5ace", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776280190, "uuid": "6eb16176-a2d6-4a2c-b856-bd7122dbde31", "value": "24576:ZcBLMy+RP4ln+QGYogVNEqsGzTw0/oqWVgKyWNn7mnjolRM2+NTBele5y92XUMi5:ZG4bRQlrLogDGDyeRryji5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776280190, "uuid": "457ffcbc-1b14-4271-bccc-a76efa8bfdcf", "value": 2442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776280190, "uuid": "3ea7b9af-a060-46d1-825c-fb78089386c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776280190, "uuid": "0f0123ff-8994-43d2-aa87-24c0704fb601", "value": "Quantum v4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "814b7e54-38b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776246615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776246615, "uuid": "444e28a6-4c1c-4b10-85ec-743677bfbfba", "comment": "Malware payload", "value": "1e149e1d0e7c95cbd104ceec53009bef", "object_relation": "md5", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "tecnoruoteindustriali-it", "colour": "#1EC7BC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776246615, "uuid": "d16e6b47-12f5-4904-8216-480c8d0feb8a", "comment": "Malware payload", "value": "6b95f46f7cfc3aa3b6b909ae8197b26707e9920384b54d7095f45cb0cb27040a", "object_relation": "sha256", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "tecnoruoteindustriali-it", "colour": "#1EC7BC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776246615, "uuid": "05c0b858-d495-4dcd-95a0-56fbfdd7485f", "comment": "Malware payload", "value": "c1a433adb3c3ee29a2e4a63cbae210ac05887be2", "object_relation": "sha1", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "tecnoruoteindustriali-it", "colour": "#1EC7BC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776246615, "uuid": "65067568-fcab-4840-9998-583d5fa71f23", "comment": "Malware payload", "value": "5525bc197e81b7de0f3da90bbe6f05790f67aef06048fb4ad6709082062d94535621b326782931f5e44eb07bb956e18b", "object_relation": "sha3-384", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "tecnoruoteindustriali-it", "colour": "#1EC7BC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776246615, "uuid": "fcb33a62-4125-4baa-9ebd-ac1009a5f119", "value": "T1993423539E5DB6C9EC250320C8213CB089B43A369D5FA8E3351647CACE5FEA18DDF252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776246615, "uuid": "6f28a1bd-9257-430d-8004-09a7955db614", "value": "3072:TYTGu771u6BdyK/vieoeGogiu1qBCzIdiJaTVtxc8cUqtKe/OQyrIlDh0FcRG3M:T6GkrjTvkvJ1qBCw4M1cH/hyWDhAcg3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776246615, "uuid": "e9ffb25c-6323-4d58-8ffd-e858d8f43391", "value": 235694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776246615, "uuid": "71383f19-ab15-4fbb-9a52-7e431cc2bfc5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776246615, "uuid": "e5c0e79d-6ed8-4967-b05f-0c293b9b0d4b", "value": "NRtjBsNChHKAhi148.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef05159-3920-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776294688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776294688, "uuid": "fc5d3a87-ecbd-4179-852e-ce3fca982d98", "comment": "Malware payload (Mirai)", "value": "07d11d59a546322b8fa375198a94e0bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776294688, "uuid": "cb9eab11-28e8-4e8d-9f35-b2377ed3f528", "comment": "Malware payload (Mirai)", "value": "6bc2a651fe1fa718397d940038c2dd042dc8713067b89d9b27c223b1f599c553", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776294688, "uuid": "dfe1d5e5-6fdf-4e44-b874-0f22c2db4951", "comment": "Malware payload (Mirai)", "value": "b8905e103e9871ca34bbb7d93f4b4cdafafdbe0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776294688, "uuid": "8b1bebf8-8c69-4c40-ab1d-02cb124f35a2", "comment": "Malware payload (Mirai)", "value": "a5ed4cfa2f146f52f21d3d20562553f06cb6bee957a69d73abe1367dc2b8b4069e9062ad12c44ce2d2089076893671cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776294688, "uuid": "80790f69-3920-474b-a78b-1bec8965b765", "value": "T191332B48F783E0F0ED4A0571115BF77E96349E034124DE6EDBD4FE72AE32A12A12B618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776294688, "uuid": "340d8563-2290-4694-befd-518e37915b3a", "value": "768:RZAAq1qT+C5GcbizpRrnVXfUEAFeFHIruziqANOV+U2331gkLrGfRTgqDl2p8TEr:RSfyep3hFHh+U431gkLrG9HUfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776294688, "uuid": "5ef63fa2-9d79-4940-bda6-615d19a3fd07", "value": 50476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776294688, "uuid": "5ce5377c-f4fb-4cbf-991b-439b51e76087", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776294688, "uuid": "ab5c5ca6-e452-40ba-afac-286b8cf42093", "value": ".Sassy.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d19ffa9-38b1-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776246984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776246984, "uuid": "a3302d26-fa42-4fd8-8bba-df9b5d484e45", "comment": "Malware payload (AgentTesla)", "value": "e0e3123c0047ed145b6743b40c80603c", "object_relation": "md5", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "tecnoruoteindustriali-it", "colour": "#1EC7BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776246984, "uuid": "1ab3f72c-a965-49b3-9721-1ed2cc6d2649", "comment": "Malware payload (AgentTesla)", "value": "6c2025959b77c3958ef1f80b06a633edc649631b3d96536df1efa0f7b85cee2c", "object_relation": "sha256", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "tecnoruoteindustriali-it", "colour": "#1EC7BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776246984, "uuid": "a140d62c-a0fa-4a4b-851f-35cbb818405a", "comment": "Malware payload (AgentTesla)", "value": "68a39f9cfcb49fece31b9534d08d8bd26687937a", "object_relation": "sha1", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "tecnoruoteindustriali-it", "colour": "#1EC7BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776246984, "uuid": "bdb77d68-7b25-4892-8bf1-56e9c460cf53", "comment": "Malware payload (AgentTesla)", "value": "9ab6caa6a1e958ef34efbbe10b7c2ea460ee09b3dc50dd5c574d01b15e3d2d9a67764fdeb2900e8227a4002696173338", "object_relation": "sha3-384", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "tecnoruoteindustriali-it", "colour": "#1EC7BC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776246984, "uuid": "9942c920-390d-4ab6-9bd4-1092a9165298", "value": "T1B422BF89730707E3C6535539AD0A19D05C99833E78D17FB6ED7642A0D377B360CEAA48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776246984, "uuid": "1a2156a0-dca5-4fa3-abbe-44168ef3fa96", "value": "192:1jYJz/CoNeKqy9RdOMqtfpRkCzAk8pU6GJkhZTWs6hcMJHDWX:to/CoNefy9eMqtfpeCsNhuy96y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776246984, "uuid": "138eb63b-4ea1-4a96-9ad1-980aa9ea67a9", "value": 10827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776246984, "uuid": "bf792091-bb51-4c7e-a558-407ed65740f6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776246984, "uuid": "ccb524c8-e250-44b1-90ed-92745a9b925d", "value": "6c2025959b77c3958ef1f80b06a633edc649631b3d96536df1efa0f7b85cee2c.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81981fd2-38e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776268091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776268091, "uuid": "2bdee509-1cf3-4507-87cb-ed7557e280bf", "comment": "Malware payload", "value": "7a1061693a1cfeeb7f0610d447a33fbd", "object_relation": "md5", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776268091, "uuid": "ddb181e3-178e-486d-9464-429db24552b9", "comment": "Malware payload", "value": "6ce484fc135b51d7971a417db7bb5ea50883706651750a2b43fee306215c913b", "object_relation": "sha256", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776268091, "uuid": "f1894e57-2f95-4525-928b-ad5542e083ed", "comment": "Malware payload", "value": "25adb9a643c55d9001a9cb2ba3e81aeb3b12df30", "object_relation": "sha1", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776268091, "uuid": "3c31b723-af7e-444a-a74b-5351b1c48c3e", "comment": "Malware payload", "value": "3b6b1ea9b44c1abb0250f28f797ba9b012cf34af0f550ae94cc95f2fcd4f2f622fe51d3b6f7c44aaaf0a71c7e216407a", "object_relation": "sha3-384", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776268091, "uuid": "8e572e33-ec51-4269-9487-e2f5d9080178", "value": "T184B633654C8AD1E2F9356EED9B24B1A30CFC18F2935183B58B1067DF5A0F94BD83712A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776268091, "uuid": "93d7a0c2-beb0-4419-807a-caadc7ef324c", "value": "196608:oFcnu9m4Q5meei16D6+KO9WUxbUhvgw8/GvConM59kg3kif0j:o6uRQ5lh1T+Tgcbqd+8MXlUu0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776268091, "uuid": "de86d4a9-67e7-444c-a562-50d7a276c678", "value": 11152722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776268091, "uuid": "349e0846-f4e7-49a0-a5b9-e17f00bac983", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776268091, "uuid": "3d211503-781b-4f46-add1-1c911c674dc6", "value": "6ce484fc135b51d7971a417db7bb5ea50883706651750a2b43fee306215c913b.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f80979f-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776239767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239767, "uuid": "7493e2b9-3527-455f-a7dd-74068aff1633", "comment": "Malware payload (AgentTesla)", "value": "b57a7f74578d42e7dbf4e8a554431545", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239767, "uuid": "fb7ca461-b600-413a-95cb-12e698ccdeb8", "comment": "Malware payload (AgentTesla)", "value": "6e47778ad5046be5f42615654721464f1c96966084c446ecfd50bb5c8d22cb9b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239767, "uuid": "b1e49eba-c5ac-4c25-a005-b2a7612afe1f", "comment": "Malware payload (AgentTesla)", "value": "5e47c1f7a03f6c0dcf4fb436c2907dcbcc0be1b5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239767, "uuid": "3a8f9f9c-14df-48f3-95c8-aba44402b6dc", "comment": "Malware payload (AgentTesla)", "value": "737630a65457fdfa64f5f0db1afb090248a801e940ae63c490f11be94000243fba6eebb08e5c2934d8092cab0ffdbf24", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239767, "uuid": "a6aee6cb-959c-464d-a623-aae4d8a2be98", "value": "T11D65F2118AC43FB9CFDC561D90BE150EA3B0498A5019A58AFF73FD4AFFA7A00512B5D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239767, "uuid": "4735a34d-ad26-45b7-adac-20b59148f4cc", "value": "24576:vXR76zuCCtBOzGyhgjCC6cs9J79YVf73WvP0TEJ5:UaCoBscc8dhW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239767, "uuid": "fb48191c-cdd6-45f5-ad16-af326f773be3", "value": 1437534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239767, "uuid": "27f74642-9923-4574-be68-695178783fe0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239767, "uuid": "55b1498d-1110-46bf-984f-98898eef8562", "value": "Transaction_Payment_Confirmation_4-14-26.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "252c8819-38f2-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776274808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274808, "uuid": "2fa25fa9-76ec-4d63-bbd5-5ea7147924da", "comment": "Malware payload (ConnectWise)", "value": "5fa0a116b1e84626f3e5f87ed10f1103", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274808, "uuid": "645bf4da-da47-4368-a306-864272c5c9c5", "comment": "Malware payload (ConnectWise)", "value": "6ef9c4dc8f34488b67b1d735d4238f3ffe4181211bd93d3f20904d62d919ea08", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274808, "uuid": "28a44c13-61dc-490d-b41f-ff10845fe2ab", "comment": "Malware payload (ConnectWise)", "value": "583fefe9a9f01bbe409be5797bea2888ba887a41", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274808, "uuid": "4a9d6b4a-0b16-47c4-8782-17b4434fba0a", "comment": "Malware payload (ConnectWise)", "value": "9966bc10ec36b3dd392034f3a0f169c069f9bd9ec3a86fc480f83930d3c6c29cda507c07c98554fbd1919430ca50ffb1", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274808, "uuid": "f39b8061-dede-4795-aa16-4f01002ac182", "value": "T18BD61201B3D5A1B5D1BB0638E83A96656739BC144762C6AF5394BD6E2D33BC08E32373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274808, "uuid": "58831b05-b7dc-47b2-a83c-67dba14f2a39", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274808, "uuid": "c46ca78e-f93f-47d3-8472-0a3bc8422ec6", "value": "196608:5fefPLVi1viU331CbiVi1viU331aVi1viU3312Vi1viU331w:oQd0bSQdMQdwQdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776274808, "uuid": "d28671cb-3f84-4314-9a0b-dd8166980399", "value": 12782648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776274808, "uuid": "4e1fa10b-f88e-44a6-91b6-24436b31e73d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274808, "uuid": "74be4361-f94d-4787-8368-ea013c330ca7", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93117f0e-38ce-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776259530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259530, "uuid": "b054654a-51b4-4e1b-8c29-ccc4dc9a856b", "comment": "Malware payload (AgentTesla)", "value": "4bc7dab55bb836aaccef916aab0f8c64", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259530, "uuid": "7d08f36f-d7e7-4fef-aee0-d18685dc3fe9", "comment": "Malware payload (AgentTesla)", "value": "6f2d24d940e83558b7cac5b0b1463c960a8d3e7a4cf901564e6b7b707d4eda12", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259530, "uuid": "1e9126c8-6b0e-493e-8a5a-b86069fb3037", "comment": "Malware payload (AgentTesla)", "value": "b13992bbab0a576c8a4fe42adcf78dcf12a4e441", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259530, "uuid": "d1d82151-9e3a-4c86-b962-518736de4543", "comment": "Malware payload (AgentTesla)", "value": "548b05fe95f652944bf7c45b18a31631fc54c39717a713ecbfdde860b228593c53cccc8d9574eb77c9f39532dd34a29c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259530, "uuid": "e90558b2-adec-4986-9f87-67f6b9e8a9b3", "value": "T1CEA2F01E88018CE837001A7E5F5762225CD841CF6667B6B0D36B63B61039BD5DDAE2FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259530, "uuid": "05406ab5-4bf7-4299-97dd-1362a5f85efe", "value": "384:72oO3N5gWoQFv1IPwVYG30KyyLLiFilsuWrPlQLLEhhnWOfJt35:KjdC1Q5+jk0Kl3elCwhhWOfJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259530, "uuid": "3e8b8050-032e-4c5b-a4ec-0cd5db2724b4", "value": 22731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259530, "uuid": "859cdf62-d864-4107-b026-a4e94ed9f34a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259530, "uuid": "24396e1b-3464-4167-a31b-bb82a57f238e", "value": "20260415-03841.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "983fe39e-38bd-11f1-a769-42010a9c0008", "comment": "Malware payload (AmosStealer)", "timestamp": 1776252237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252237, "uuid": "dfa820b7-3788-455b-9de5-a257f549d5c8", "comment": "Malware payload (AmosStealer)", "value": "3e54a15863075466749f7d833f9b48f0", "object_relation": "md5", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252237, "uuid": "ab17f565-24d3-481e-bce8-fff244685f43", "comment": "Malware payload (AmosStealer)", "value": "6f33360d3a3dc60454a64d74e1ac586f6a184b3886df46471b10e520c5fe0644", "object_relation": "sha256", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252237, "uuid": "3d884dc0-f76b-4117-8b55-ac7e83ad5cc1", "comment": "Malware payload (AmosStealer)", "value": "fb511370119930b3217b91e7cfda1bd09eaed0b2", "object_relation": "sha1", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252237, "uuid": "e4f7bb1a-31e9-483c-960b-25b9e50d86d9", "comment": "Malware payload (AmosStealer)", "value": "8cfb92a2efd0aa754b3c5962ca2511fdb00d10907193df40fb9726065d405559684b9ac63949eaac39001ad3cfe4469f", "object_relation": "sha3-384", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252237, "uuid": "20462002-7f70-4ae9-b342-9907ca66f951", "value": "T185F285076958026F63F4D53AA10581B4831FC39F4292E529F6ECC26A2F1EAD5A1F36F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252237, "uuid": "25fc2467-53c2-4639-9e87-c3e73dae67a5", "value": "384:LbwA65jijnQHuzVc60sLHMNozusyoWynEm:gAOjidfEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776252237, "uuid": "a76e59de-786c-4096-aad8-3c1d88a4a2bd", "value": 35607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776252237, "uuid": "01186b39-a6b0-4f82-bb9b-e067dee085b0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252237, "uuid": "fc7fb445-fd33-4beb-94b4-27413583965c", "value": "6f33360d3a3dc60454a64d74e1ac586f6a184b3886df46471b10e520c5fe0644.vba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ef5c8a-38bf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776253250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253250, "uuid": "41412c63-7445-49e3-9fcf-13e63053a8aa", "comment": "Malware payload", "value": "a02f255369d11b1a70d19d1a26cde7fb", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253250, "uuid": "3d3a4574-05f7-4e9b-983c-fba0372db3b7", "comment": "Malware payload", "value": "6f426d9e13515ecdb0b62e77f200e6c6f3be0ccb72b729386f71d16bc4f8d5a3", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253250, "uuid": "967c6b9d-aed6-4b42-8045-9057014a8c3e", "comment": "Malware payload", "value": "3fe94b5788a56b2365922502d51b4d73bf8ab4af", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253250, "uuid": "b5a1b8c9-0f76-44b9-a15a-b32afec3f3c4", "comment": "Malware payload", "value": "f65a1c393f2612fa32b00c33ae747b7cdd2e90b7197da2f7527924a0a89c748d1b15626353309dc7386ddf1b3e660a7d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253250, "uuid": "ecca3e09-f410-4962-b7c9-80029c9db7a7", "value": "T18E6302AC2FD7C254CA0170FDEA064C8F68DA81BD9594F23E4ADB8D8171C4CB51CB69E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253250, "uuid": "a52c443e-fde0-4f9c-a9c5-0a17208e8da5", "value": "1536:VpusSJbcDAuzeJV/3mvM82FeVICMLijVJpFDGrpOXyVTdJekPRLdjPNY:/CJsAuzqV/3UM5Fe1Dg0ihne6zY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776253250, "uuid": "424e70f3-b89e-40dc-a9fa-3aecb910375d", "value": 71786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776253250, "uuid": "453bc690-de4f-407f-b792-65a59d386b4b", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253250, "uuid": "a30c761e-9d38-4d6f-817c-e515b39388e3", "value": "krypton.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31fab693-3880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776225867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225867, "uuid": "36f99343-71ff-43c7-b434-bf205e115791", "comment": "Malware payload (Mirai)", "value": "6ed8e60b2a4920782fbdc9ce594fb089", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225867, "uuid": "03a538f6-b355-4b3c-8901-f904d7fb79f9", "comment": "Malware payload (Mirai)", "value": "6f44e4ead7e3c7684baa14cae3d4401cc65e251caebe8cccb6571493abe5ea22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225867, "uuid": "21982a7c-68a2-43f3-9769-8e986a0639dd", "comment": "Malware payload (Mirai)", "value": "5be5693a2e1d2da4d45c1d7192b9ce331fbc4b95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225867, "uuid": "4c860f03-4a27-4a17-9ff6-5d67a0661c0b", "comment": "Malware payload (Mirai)", "value": "f43987ca085914351a9695db900977aa061da3e932fc53acf8a5949b0b1d6d8ba781147e9011e0a5a487300f740c8ec7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225867, "uuid": "3636d025-37f5-4d7b-b71e-2535b6419462", "value": "T18ED308C7F900D9FAF80AE3374853080AB230B7A649525A377257357FED7A1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225867, "uuid": "237ef550-aba1-48b1-aa55-c9e0db841fc9", "value": "3072:tIW4mq3PrmMIyLLvTvsyw2j9ho8s7ORV1jbixLX+XKDP:lxyLzjsd24H7OwLX+4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776225867, "uuid": "7a97fb97-a855-4bce-b373-4cb35c75f3a9", "value": 140064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776225867, "uuid": "169c5013-26d3-4440-9e64-feabb0a26f7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225867, "uuid": "f219df51-e7cc-40c4-bf5d-e6cbc8b2f06e", "value": ".Sassy.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09180631-3898-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776236106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236106, "uuid": "8f7ce814-0625-4a3d-bbdd-24d06d7967c7", "comment": "Malware payload (AgentTesla)", "value": "9acaf31586e28739d146f0d09339cc94", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236106, "uuid": "ca05c49d-4267-4e4b-99b0-e401266a0f41", "comment": "Malware payload (AgentTesla)", "value": "6f9fb70c2f5b6704b10ea9fc06c7c3e9d2f0c9369e9dd8ced20ca6c8f002fa94", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236106, "uuid": "c8078988-5597-486c-85e0-b80986ddfe32", "comment": "Malware payload (AgentTesla)", "value": "5481f4f6e7be2ef22e02c3647bb590c9356705e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236106, "uuid": "5caf6057-9308-458c-9a77-a0d703763506", "comment": "Malware payload (AgentTesla)", "value": "031d37a5608605ede39ca8b53beb13da6cec9498bf78e1daf8f36fc08ace02619125ef8310660a707e3fd55a12990b9f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236106, "uuid": "c74e42f2-125c-4a94-89b7-93977b8467f2", "value": "T1F1568408E0A9B20C58E3CF5BA667D4F1488F786A7E4E89B2A01F907D1C55F97D8211DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236106, "uuid": "3f08eda2-a9aa-4bbc-9d1f-c458d4ecf51e", "value": "98304:cPgvws0rko0hmnWiEB1nRNObOjViq9ojLEJOggLXro20wFYqVTOG8mcAxDk3jN4B:cPgvws0ruhmW/nLO8sEJOggLXrhDTObO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776236106, "uuid": "838a8466-2701-4fb6-ba8b-ff9b915aa380", "value": 6025784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776236106, "uuid": "2d84beeb-32ef-4245-92f1-46c4fc6a25df", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236106, "uuid": "b3ab9be3-5129-4ab5-b3f1-6cf1166bcabc", "value": "GENNEXCORPS LIFESCIENCES SMF TRADING.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ff478b-3926-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776297218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776297218, "uuid": "55d994b5-d130-4224-b487-6fd14987a7bb", "comment": "Malware payload (NetSupport)", "value": "2b321886b7153b4d66226c56fe61a4be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776297218, "uuid": "5593aa8e-a4ff-4502-b8d5-d1bc8349e049", "comment": "Malware payload (NetSupport)", "value": "70a5b9d58f368056dc478913338111c7f734de5219ac8c289e026033b49f8867", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776297218, "uuid": "39d42c1f-df55-4b96-916a-c6ea3bdc6d1a", "comment": "Malware payload (NetSupport)", "value": "1b94662b7fb2bc65a262d864e5a18391c265eb39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776297218, "uuid": "dc618533-33cb-4e5a-846b-2185efe273f1", "comment": "Malware payload (NetSupport)", "value": "b3e88228f764266232c8ad0d702599c86aa6cf796a3d1da2162aaf24056f825171b437b0b18a3bf5c61c0415db11af76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776297218, "uuid": "0ef7d98e-5a47-49d8-8161-1dffa780ab96", "value": "T1D5F55B07EDB98CF9D0E9B6344433A116BA64B8405B2163E72BD4B7682F737F09879B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776297218, "uuid": "542e8592-5c3e-46ce-ab94-92e4e7ce0ef9", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776297218, "uuid": "69d508b7-9e5c-465d-94e3-774d5a07f884", "value": "49152:CZMX9XiSsFitMUCkZNL9sEXmKFgjKYQc7zHUD:CZwei8um4tCHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776297218, "uuid": "7c1a0e6e-868f-4ab3-ae8e-82f421ff58ad", "value": 3446688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776297218, "uuid": "212e9008-ea3f-47b4-9770-5b39e0ee05a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776297218, "uuid": "b2364303-edee-437a-8cda-6ca1bdbbcf05", "value": "SecuriteInfo.com.Variant.Ulise.596178.8476.21273", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b91834-38f8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776277701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277701, "uuid": "bb0f1c44-2045-4abd-9cc9-1c4de5e3dfbd", "comment": "Malware payload (Mirai)", "value": "b2da80604c17212168cd1942b036f69c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277701, "uuid": "c00a719c-78f5-4b63-bd7b-44c927c5d9cb", "comment": "Malware payload (Mirai)", "value": "718670c5321b57dc37c5df9ecf1adb771d8b7bd7fcae36d9b65ffa7e22bb9d9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277701, "uuid": "019a44f5-e5f1-4b87-9a5b-b987a1841049", "comment": "Malware payload (Mirai)", "value": "646a994768a85b7ce5ea053bab85297a67bbb77e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277701, "uuid": "9985b4d2-bef6-4fb4-8bf2-c718251aa5b5", "comment": "Malware payload (Mirai)", "value": "7f54b18430d32cd25f33d62cf8346907314acff16f47cf31c1c894849f381c6786bc46f43e189b64a5ee9783e9c32be8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776277701, "uuid": "804e3c6e-fde5-4464-9152-cebfd33de83c", "value": "T102D2D1FC431A179AC688C0B663A812983BF2177AF0AF8C8D3565C54BDC885FA6D477D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776277701, "uuid": "a852556d-91f8-478b-94fe-5b9df55c90dc", "value": "768:/ACm3crFuJ0BNUXE+J1W4/b8hqd202QdJgGlzDpbuR1Jw:4d3V0G38WbVJuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776277701, "uuid": "2c44ff76-b9ec-4c6c-9e3e-20fd67f78ade", "value": 30472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776277701, "uuid": "75c218e0-cd10-4e11-9bdd-0c73f167071e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776277701, "uuid": "520a8035-c38b-456b-a2d3-2be43c4953f0", "value": "FGx8SNCa4txePA.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31053d33-389d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776238320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238320, "uuid": "976ba433-957a-4480-aa50-5ce52bab7f0c", "comment": "Malware payload", "value": "d6fd201d63192f8f045ce24c72d67357", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "ZIPLINE", "colour": "#23165C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238320, "uuid": "85d40074-c6b9-4fe6-afdf-2b010650b823", "comment": "Malware payload", "value": "71dec9789fef835975a209f6bc1a736c4f591e5eeab20bdff63809553085b192", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "ZIPLINE", "colour": "#23165C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238320, "uuid": "41840021-10e0-46ce-b567-29bd84199e9f", "comment": "Malware payload", "value": "dac49b33bedf5cb7c7e717a8dc3d15c99d6676d0", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "ZIPLINE", "colour": "#23165C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238320, "uuid": "5361b929-387a-451d-bd92-e35c91352bc7", "comment": "Malware payload", "value": "7604789caba72527d26fd47389dd1d5e015258e3c7b0f87d9ac6e200936ab7d9b1b8a739b1e10e2e4800ac3114998d2a", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "ZIPLINE", "colour": "#23165C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238320, "uuid": "424e5750-9452-4376-8b6b-b0acf10b8cf5", "value": "T1F751D14423F90614F6B72A39B93E5290593E7D1D9B27CA8D0128E08D0AF5A24D97BF37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238320, "uuid": "0fb607cf-995a-4691-ae09-f2e620ab05c1", "value": "48:8aglPYlF57hRgkgq1byOHORudYMviONSDY+zYn+eMF8t8eqvO1rOHORudxTHooj:8a0EFWLq1bLHOQYMKONSDPzY3MFMhqvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776238320, "uuid": "376aa28c-65f1-462f-8065-588e40803f17", "value": 2601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776238320, "uuid": "e3858b7f-c55a-4731-8dc0-935c9e3aeb93", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238320, "uuid": "d6406f28-180d-4ee4-8f59-38a6459310c0", "value": "71dec9789fef835975a209f6bc1a736c4f591e5eeab20bdff63809553085b192", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adca1b89-38fa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776278473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278473, "uuid": "6a7c4bd9-234e-4e93-9f94-68d2c4cd7e1c", "comment": "Malware payload (Mirai)", "value": "82f2b58bb1290d51fab8563283437c6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278473, "uuid": "8158883a-e8ce-4ee6-998a-e384928dc2fb", "comment": "Malware payload (Mirai)", "value": "7222ab2e8a0bd799919644f318a078686ee3e447524add479626c20425b6a809", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278473, "uuid": "7209c3aa-4503-4fa1-b895-b60ede36bad1", "comment": "Malware payload (Mirai)", "value": "da3b82f064d38d895a75284d805f1ad23e0f6043", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278473, "uuid": "7daac47f-3a00-4211-972e-cc08e264625a", "comment": "Malware payload (Mirai)", "value": "d32a321ffc50702c6451d600fef0087170a1d13dbc7db46cb98d4d2ae7ed50339a2afd0c066c22265a40890bc684b69b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278473, "uuid": "53784018-e018-485b-bb06-c749a7f6091d", "value": "T172E2D06FE8BCF946C9BD8474418D03698E44B4C2323F9B089760ACCD6A5DE17B5AD46C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278473, "uuid": "d5a9198c-1c9c-4c80-a15d-2980c80dbbea", "value": "768:9J1P1TBwNMennf+L7MveSiqGE00l6Btr+f+aWm:9DhBwNMofk70TiqGCYryf+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776278473, "uuid": "7fca74f1-659a-4b9d-83a9-3ce191a586c2", "value": 31572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776278473, "uuid": "3dddec92-135f-4efc-a925-0843951f4ce2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278473, "uuid": "f1dfeacf-52a6-4b28-b688-39099fba30f9", "value": "FGx8SNCa4txePA.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e6bee94-3880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776225887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225887, "uuid": "23bb9574-e312-4229-abfc-d236d2c8a552", "comment": "Malware payload (Mirai)", "value": "7b2a845fb4271fa7f8302d9adb7d39ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225887, "uuid": "a498a5ab-9f29-4f96-af6f-e791b18d4f0f", "comment": "Malware payload (Mirai)", "value": "7386d3cb4d2cea147b9c99a97f8184c0224745e65cf4ba96ad1c20ea1b1fcde2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225887, "uuid": "e832069f-7061-4e35-ad9b-bbca3eacc78a", "comment": "Malware payload (Mirai)", "value": "f1afa30de88a7287a140cb5d93b29d604e8ad631", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225887, "uuid": "1bbfc3ee-a25a-4bf1-87b5-bafe10146fc2", "comment": "Malware payload (Mirai)", "value": "0893c201da63fa1dda70ca9547d5e1bb4ca86d1870ac108c78729ffe077c9afe28ec8ddbdb66e14e27178c71743c0450", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225887, "uuid": "531c00c9-229d-4b13-8634-4095a9747d47", "value": "T185332B48F783E0F0ED4A0571115BF77E96349E035124DE6EDBD4FE72AE32A12A12B618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225887, "uuid": "dd8767f3-7c77-4a28-9a1c-659090bd0f54", "value": "768:DZAAq1qT+C5GcbizpRrnVXfUEAFeFHIruziqANOV+U2331gkLrGfRTgqDl2pZTEr:DSfyep3hFHh+U431gkLrG9HUSr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776225887, "uuid": "9d149056-3fde-473e-9e88-0282a5846473", "value": 50476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776225887, "uuid": "885191d6-9de7-4087-9678-d68b779ff139", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225887, "uuid": "f4198d8b-3006-4cb8-9c21-5911b5bf2685", "value": ".Sassy.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adcf1925-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776239818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239818, "uuid": "7818f0f1-2655-4a85-b08f-f80f83027db9", "comment": "Malware payload", "value": "ad75af3230bd195e07246ce52b04cc0c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239818, "uuid": "2aa5a202-b164-477c-99fb-770a0ca7cea3", "comment": "Malware payload", "value": "738f09e31a901c3506f4ae193476ff0773486865b2a3bb31b09ba67d9c9ba12a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239818, "uuid": "da7777f7-31f3-45b1-bc50-9ab9080bd5e8", "comment": "Malware payload", "value": "2a26824334dcd7ad495312adf1e55664c57e326f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239818, "uuid": "04774c48-be5b-419f-be46-1b4a4228b0ab", "comment": "Malware payload", "value": "6db7781d85f19812ad4251424313e4405797a6c93bbe3f4916b72e49e524a267d0b4a37a7c333875e455ba02d857ed62", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239818, "uuid": "27232744-b616-4968-8379-aa21f9bb2537", "value": "T1D3E4D06618BB5410420761EA5B3B63F97577C983BA0474B8F84FF17CEF8AC2C56A0639", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239818, "uuid": "f6100e37-742b-472a-83d1-5a49278f5e2a", "value": "3072:1SQsF+RzwQpQI+EfEZvb3FiTFsYlrOFJq/0XLDDOxmyh/RH2krRt/pxJmB4rNC3Y:1AQRzLKFEfEd3gAzY7G1Myv9Oqstb5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239818, "uuid": "685f43d6-8af0-4382-b4b3-4d5a18a7c672", "value": 700900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239818, "uuid": "a6196723-be65-430d-b3ef-0369ed457709", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239818, "uuid": "46cb9f49-be22-4746-8132-6397722e2825", "value": "GR5000171604.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9044423d-387b-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776223877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776223877, "uuid": "774211a4-3cb0-46a1-9d43-4e05c0a21551", "comment": "Malware payload (AgentTesla)", "value": "1b7207725c64d455be983e3b1041dd33", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776223877, "uuid": "78c2b736-c271-44cf-95b9-e391f6c77765", "comment": "Malware payload (AgentTesla)", "value": "74164a66eb155d2ef2e03a806a6247ac47c1b5a2cb4c69576f36f00397dd57bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776223877, "uuid": "df2e9d89-3575-427c-8b2e-0ed6b17e4990", "comment": "Malware payload (AgentTesla)", "value": "6119708d963249a92725376c9dfa72e6069f9ec8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776223877, "uuid": "4d47d303-fcac-4d33-83bf-80ccfe5c584a", "comment": "Malware payload (AgentTesla)", "value": "19695a8106a0522d73595ec35debad2fe26e6e55c35c5d4c8201a055bf731d146da6eb9326dc22a486404ac7a92707ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776223877, "uuid": "fcc071e4-43d2-47fb-b042-4c72f265828d", "value": "T132E4CF5A2C9D959AE2A14A7440E2B33D53FF62D23F88DBD79D2C495D6D21CCCEE22D00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776223877, "uuid": "509e68d7-3aae-43f6-bb83-47284f21924e", "value": "4fecd44dfc94ffab3c4ae3356e71b8f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776223877, "uuid": "b8cf90ee-5ab0-4b36-a9ba-39f9c2583b9d", "value": "12288:mdX9s4H7pg1bDU7TzwbNUh0ajwVnnnHnnntnnnNnnnunnn:EubDUfkbNUh7wVnnnGnnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776223877, "uuid": "4d196618-95d3-4446-87ac-fb18793fa197", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776223877, "uuid": "88d40007-3478-45a4-8c3f-4cb2f2c5c1bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776223877, "uuid": "92f054e5-2fe5-48e1-9ae4-92324759e5d2", "value": "MV_GARDENIA_K_VESSEL_PARTICULARS (5).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc147140-389d-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1776238661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238661, "uuid": "e312c037-48b9-4360-ad0b-ab8145b895ce", "comment": "Malware payload (GuLoader)", "value": "e29e1186f96593a93d0cefc47e93c712", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238661, "uuid": "59328d0f-669a-4630-8fac-cc13cc3d6489", "comment": "Malware payload (GuLoader)", "value": "754016da93b35b51d4abbbcec0bf4ff6e9670109a2b5ecbdbe04f010a7843539", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238661, "uuid": "f47aaedb-2034-4e73-b42a-09e1410ca1dd", "comment": "Malware payload (GuLoader)", "value": "b230bc94a0912260edfde2792d0f313c939275e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238661, "uuid": "5c111d38-524d-479a-9aa2-f036bde76999", "comment": "Malware payload (GuLoader)", "value": "8a7dc3adf2ab5abdc459be7ec80356328d0c596bf88fca2598888a219c4802d003f6de5e4b8d0ebf1fa81752ee874ec5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238661, "uuid": "dfb39ed0-ea34-4ccc-b088-a8de6fb25f62", "value": "T1C44533057170C1F3DE2211B207FABE761FB7A019729C0DE39784CB1BD52E68A1E0B969", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238661, "uuid": "981e13a2-8808-4ce6-a9e6-5111541dc208", "value": "e2f3f8ec66b7e1900c37978aca89d3c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238661, "uuid": "0b5481cd-28f9-4af1-a5a0-6d872350eb38", "value": "24576:05+Zlc33R8mRqn2moyLjJp2hJ0Su/gP3I2GIZxgQbtOH5Pg6MskE6fIZL0tqFU:Q3RDRqn2QLjJcz0S+wqCypg/s2QuqFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776238661, "uuid": "b2bba183-2ebe-42a1-ba36-9103de348d02", "value": 1204373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776238661, "uuid": "684abd68-3b26-4ba2-b8c5-9d0c4a256b40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238661, "uuid": "13d5aa8f-33c2-47d3-8472-d9132643c7cc", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.47590.23542.31651", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "833fc2a8-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776239747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239747, "uuid": "e5409e32-f1a2-454b-832f-399af5563b3e", "comment": "Malware payload (PhantomStealer)", "value": "0e50f74032d7e157f9ef65c1189211f4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239747, "uuid": "0f433fec-b8a8-406a-b4e0-80740ca1683e", "comment": "Malware payload (PhantomStealer)", "value": "7579a0da80dfd78d4b574d87c1c4fa48f82b589ae5feaac7148798bb6947f1af", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239747, "uuid": "ae47ce07-ecd8-4767-acd0-333c6b19bb35", "comment": "Malware payload (PhantomStealer)", "value": "88051b889f7cb7e3b373c944d274f9b3794c5914", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239747, "uuid": "48f75ab4-1582-4114-b025-45580ccb7fc4", "comment": "Malware payload (PhantomStealer)", "value": "f8351b799c04f37fd0d380af155c555c3c139cb273c88b39dcf9aafe1a0a1a24880f985a72bc40fe0bb9d41eb4f64f79", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239747, "uuid": "7174159b-9306-4407-832d-75dcc2133400", "value": "T1F526021189C42FB9CFAC5A1D80FE160E93F04A8E5026798AFB73BD46BFE7944411B19D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239747, "uuid": "ccefe943-f0bb-464b-95e5-c981a5586178", "value": "49152:Yqel1PAGi7t6310zEEceVrbjrxxq2XmALFgH4bplTR:T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239747, "uuid": "17a45bd9-5c25-44bd-a861-93a43f0ae004", "value": 4704198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239747, "uuid": "cbd46908-8784-4776-8117-7d53e04ff759", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239747, "uuid": "03511f93-68a2-47c5-bf07-cc51787e5221", "value": "Purchase Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d02e11d9-3913-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776289268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776289268, "uuid": "ba0f16b8-3c35-42fc-b165-08e910b9273b", "comment": "Malware payload", "value": "e32fc10c8ae39a3d6ba8594eb72abe7f", "object_relation": "md5", "Tag": [ { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776289268, "uuid": "c7e771a1-f574-4a50-9aa0-151c2910b128", "comment": "Malware payload", "value": "758527c909ad5194d44d97c8609ad8916d6d78c62c182531cddd939ce29d9074", "object_relation": "sha256", "Tag": [ { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776289268, "uuid": "77e6b919-8e51-457d-83ff-78ce445bf246", "comment": "Malware payload", "value": "8411bd75f2e4dda1b137aeda191aec3289647443", "object_relation": "sha1", "Tag": [ { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776289268, "uuid": "ceb15bd2-7566-4b07-9b82-8d3554b10d8c", "comment": "Malware payload", "value": "692d9c3c7b54154982d1229e3e2d41533645ef61ec34235b839264a26e930709b097fe0fe564a6380dc2f77b6ce4398f", "object_relation": "sha3-384", "Tag": [ { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776289268, "uuid": "d56940d7-50f9-43a9-975b-09f760e23f5d", "value": "T1C09423684E4C594C4EA39DAC34532B0DDBB2AF1299CF934393F067E1616B7831668DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776289268, "uuid": "64b81193-b728-4944-88d1-23a9e41eb270", "value": "6144:Fs1xFgzIfIjrhTlyVjjf3RBnKZSFb4lAjdSh9PIZ/3rkIH8HCmDVlzl3GI:FIgzDrdlyVjDh7fSh6ZAO8hDrzJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776289268, "uuid": "043ec0b0-295b-4c47-934d-8dcd07486e8d", "value": 414947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776289268, "uuid": "bd9aacbd-f5a2-42ac-9a4d-39b5f76e6c0a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776289268, "uuid": "a016317f-29a3-4c86-b517-8877083fa61f", "value": "edition.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba9aa88-38c2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirax)", "timestamp": 1776254283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776254283, "uuid": "69d19a1c-8762-46eb-824c-1db44ddc754d", "comment": "Malware payload (Mirax)", "value": "2ffd718025e8938b6b96e209091f7939", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Mirax", "colour": "#EA30CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776254283, "uuid": "721ed534-952d-40c1-b402-69fd9b4dfc3f", "comment": "Malware payload (Mirax)", "value": "759eed82699b86b6a792a63ccc76c2fa5ed71720b89132abdead9753f5d7bd11", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Mirax", "colour": "#EA30CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776254283, "uuid": "4d579798-0371-4835-bef4-6ea2e4be3b3e", "comment": "Malware payload (Mirax)", "value": "b741668b62f9c5fc0d4e7b399023dcd5eea5a637", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Mirax", "colour": "#EA30CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776254283, "uuid": "c924c759-3fcc-4947-b59a-1110d18c93a8", "comment": "Malware payload (Mirax)", "value": "8736c4f0c4bcf2a00c92cd89c14cf246e9ca71b6030a173783821bc6473c1dfc8dddeef4bbb5d8a39ec362e3edefd997", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Mirax", "colour": "#EA30CB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776254283, "uuid": "62994188-a294-430c-ba76-d227a880551f", "value": "T19C072346FF48E95BC4F323734875A62213075D2A4BA3C7876E58767C18BB5E04F4AAC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776254283, "uuid": "951b005b-4329-4c4d-83db-283ed87b68ae", "value": "393216:N3PjTqfDNEIWeGdOnSJ28KuQPjqi1DrhdlX:drTq+xe0E81QOUXhTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776254283, "uuid": "ba7564e8-ecb4-436d-9a76-de5d77570c38", "value": 18207887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776254283, "uuid": "62173ec4-dc75-451f-9205-eebf72057f2a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776254283, "uuid": "43f3860b-13b3-4da7-bf87-3e052d8fcec1", "value": "759eed82699b86b6a792a63ccc76c2fa5ed71720b89132abdead9753f5d7bd11.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3cf54fc-38af-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776246378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776246378, "uuid": "97967d90-2e87-4d68-8b63-1082867e64a0", "comment": "Malware payload (ValleyRAT)", "value": "28901a0151d6ff9066d0f3ce38f0adf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776246378, "uuid": "233c612a-acc7-424f-95a0-17ac6de06046", "comment": "Malware payload (ValleyRAT)", "value": "760f3242ffc9539dc12bd2c28b03f2ffcc43ccf8829aeaa3daeacd36a3950cf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776246378, "uuid": "8e4879a9-8b88-4a75-b8da-86fba12a718f", "comment": "Malware payload (ValleyRAT)", "value": "a6a73679c67c897f2f52c181bf8125beed1fc480", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776246378, "uuid": "318ca49c-1764-42d9-b8d2-d286c83d61ea", "comment": "Malware payload (ValleyRAT)", "value": "b0f0a727f801d280c75355fe80028a205be149068e8075dd29512fcf76eed818493f9cf44765626b04834cbffbb3aafe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776246378, "uuid": "c4d4c584-c6f3-4097-be6f-a0ebbb017290", "value": "T18E266B9EBA7E5395D4BBC1B0A7B38196E1307C419B7066CB2384536C2A335F09DE72D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776246378, "uuid": "f202e658-e656-4fdf-8ae3-ea3330c24798", "value": "8b58c25d39acfac15143d9c5019818c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776246378, "uuid": "0ef66cc4-3a1b-4b45-b5cd-10f016ffa830", "value": "49152:g5CdFXiOinzxL5LY2ROMlFMQ4vh7Yl/+Jsv6tWKFdu9CqPTvG7KEpHFhh6DhqacH:g5CvyRU5JJsv6tWKFdu9CqifMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776246378, "uuid": "4b9a6c0d-d4ad-4238-840c-3ffee305ada7", "value": 4522368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776246378, "uuid": "4d79973d-0831-4290-8adf-c746179563d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776246378, "uuid": "0eb0b9fa-a0cc-48b0-b809-85112c76a990", "value": "malware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a98f660-3890-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776232699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776232699, "uuid": "433a86d0-09e9-4080-abeb-9aa944698b28", "comment": "Malware payload (ConnectWise)", "value": "4d45a7a9b9e184021d7d15f3c41e458b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776232699, "uuid": "34b6e934-7bce-4ca4-85ae-9edf2ce7aace", "comment": "Malware payload (ConnectWise)", "value": "764a1084d9f90226c7386993d42b76957ec589dec014637fbcbbbe26107aa496", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776232699, "uuid": "19b0f6ba-ba12-4d22-9a59-753f13f522f7", "comment": "Malware payload (ConnectWise)", "value": "3b66bea03c422ee5e2f8bc96c3769337fbce5232", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776232699, "uuid": "b254e09e-460b-41ee-8aa9-43314a2025cf", "comment": "Malware payload (ConnectWise)", "value": "dadfc484a97ddf76131e4821f3941828516e383315bab0514227fede24d99d52b12deff0152f2b23628b1d6fd5661a7e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776232699, "uuid": "258b60f3-11b8-418d-9774-426e7331373d", "value": "T1CB647C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776232699, "uuid": "3cf5744b-6e6e-455b-8a1e-4cb05366af0a", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776232699, "uuid": "79756e2b-6251-44d0-9087-d5483e351617", "value": "6144:tmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji91:I1iw7gryNkSV1hy1Z1u2JLu91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776232699, "uuid": "38712443-c2a5-4225-af06-b65a5395d042", "value": 312616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776232699, "uuid": "5a8d9aa0-9dea-42bb-aeb7-a0deaf8c7b7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776232699, "uuid": "41ac7901-e7ec-420e-a8b2-544bd656f583", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62752e26-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776239692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239692, "uuid": "1f901dfd-2153-4108-8156-2a18f516100d", "comment": "Malware payload", "value": "b2b68867dd767d72d29dbec3db453127", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239692, "uuid": "0dd72a13-ce53-44b9-942d-74f7a06d1ad8", "comment": "Malware payload", "value": "76f0c102365587c45eee35f5ddedef9b014a675757e8543e18922c6b0f9a8f1a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239692, "uuid": "dd4a8159-d1e6-4993-ba12-f8fb8b20ea28", "comment": "Malware payload", "value": "c830912b95da714a6e85946d4e97caf344153436", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239692, "uuid": "bd307215-84fc-4262-a321-a1064fe868d4", "comment": "Malware payload", "value": "a9183adf48d7c47849217ab00ccbe5a8e80538439d04d51aa6abe5beb000d8c8ffb9821da1253f63a3173866eae2b73b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239692, "uuid": "b076aae6-9b9c-4e80-8dbc-47fc2e62b1b5", "value": "T1BF363371FFA528A70A58433AB09F5B267F6C8843848DB1C55ED4F1C2324A7C7816F9E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239692, "uuid": "baa1af7c-b295-43c7-9ea4-f18d886c9df7", "value": "49152:E2MSmtkS+azUpMbL68+CbAsyfvvHZL8Ygr6kI/8FjHc1tsoOiX8vQePsy6afEoI0:A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239692, "uuid": "d6a21642-18b7-44c9-a612-fcc59ab5c218", "value": 5201931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239692, "uuid": "85adc310-f84c-4f14-9554-d93e3662acf9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239692, "uuid": "42c8fcf4-650c-46c7-83e3-8d579e5aa8fe", "value": "0327814Patrim_KEBHpedfIX2B003045JXGHPQ55K30.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c9ed27-38cc-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776258756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776258756, "uuid": "0031a653-82e4-439f-b81d-cb13559d31bc", "comment": "Malware payload (RemcosRAT)", "value": "c06b5efb2c426f3e33da1355ccfe4db7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776258756, "uuid": "7d469302-c3a5-457b-a86c-43a197fed8f0", "comment": "Malware payload (RemcosRAT)", "value": "77909608655f3081e0a5003e967326a4b57f7f1285e659c58d3aeab9b6778a64", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776258756, "uuid": "908b0a43-cd79-4ad8-9365-f72b9ccf226f", "comment": "Malware payload (RemcosRAT)", "value": "7f9ba6a81da4a4c735c0762d4c3de8c134c20d66", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776258756, "uuid": "5d1e68c6-1fac-423a-824a-a040bf19eb6b", "comment": "Malware payload (RemcosRAT)", "value": "c576db980ef13d81efa8d78154f8aa928d78d013a61bc4f03f5048f813776af09a169253309877fc108357972476f185", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776258756, "uuid": "f736d1dd-b773-4b71-9bb7-80116da5b551", "value": "T1B2E502118AC43FF9CFAC661C50FE160EA3F14A8A5415B989EB33BD4ABFF76044217199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776258756, "uuid": "68ce186c-7217-4503-89a4-de05f2c75456", "value": "49152:IDEpgpqwPBApYZISn2jkD4hkYAHP8UwkjVJ0WT:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776258756, "uuid": "bd7f96b4-a8f8-4f37-ba20-b8aa696ea8d5", "value": 3311558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776258756, "uuid": "bfe7164f-4599-4e9a-8697-9c176e2e0583", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776258756, "uuid": "cbf3d3de-6b53-4719-a8fe-46d9144d072a", "value": "Order_list_6000069128_Eclipse_Supplies_&_Services_LLC_xlsx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ce38c6-38c6-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1776255938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776255938, "uuid": "3b348ea7-30d1-442e-b17a-5461b8834f0a", "comment": "Malware payload (SantaStealer)", "value": "ab7acd2b4f52619a386669ba462ade7b", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776255938, "uuid": "f1ac043a-779a-4e28-9834-9580882dbdfd", "comment": "Malware payload (SantaStealer)", "value": "781219a48ef47ad694cd5d00f02ad0267cd6c566ace478eecfd5b7a734ec08b3", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776255938, "uuid": "2a631514-1874-4569-b901-442dbdd66085", "comment": "Malware payload (SantaStealer)", "value": "2f5e04846ac778059baa262db31d0810f667b10b", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776255938, "uuid": "1e88f90c-c66b-4f66-b5ae-c5f428b7d878", "comment": "Malware payload (SantaStealer)", "value": "076b48080969a25e50c45fb6c85c8e0d4106b5becb5f04e29680e9ad316deab2bb2f6f58d5268716fe85b31afba9280f", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776255938, "uuid": "ebcd53d4-82b0-41bf-8766-27ebb97716c9", "value": "T12D6723E8EDCECED8AD9DF8707DEF43D01C549ACAF212884552D9C5B8F203A5B06419E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776255938, "uuid": "52fbecf8-67f1-4e01-b9ef-c247dd271938", "value": "786432:MdXBq7ygqOB67FcQwEn8aaRJSVa033U+2/XAf9uJtkqHt9:MdRq7ylOBgrTn8XT+QXAF6tJt9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776255938, "uuid": "b9704912-8e03-47eb-9dd6-0aa020617819", "value": 31482122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776255938, "uuid": "2cfa2240-ddc1-45d6-a8f3-f12153b26970", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776255938, "uuid": "282c09ea-26ec-490c-9554-5ad19a8634d5", "value": "RivalMods.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1a4753-38c5-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776255492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776255492, "uuid": "fc6b4f13-c7dc-4fd0-8d3b-ec9ba3243f23", "comment": "Malware payload (Vidar)", "value": "53b916eee8861d6b286cf4bd21d91121", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776255492, "uuid": "f4f09b67-d153-49c6-826c-f429807531b4", "comment": "Malware payload (Vidar)", "value": "7855f9285bf4b9b03c47bd5fda1e192113f0d55311651f3f7c9773110706d52e", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776255492, "uuid": "34535c78-2ba3-40fa-87c4-4225cf2de8cc", "comment": "Malware payload (Vidar)", "value": "16d4d3cfa5134c333a0f89cb4168097597694ead", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776255492, "uuid": "08c1432c-a9c6-43cb-8a1c-dcda9e5d566a", "comment": "Malware payload (Vidar)", "value": "c6a71db1e81d21df00a12a4fea8bb5f8d114f94d1e7694c5f71fad473e6042e32ad92423ab6fc65231f70a36fb995945", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776255492, "uuid": "412f3000-480d-49e8-964d-44fb009e6db0", "value": "T141A58E1BAC9145F6D06AA3368CB622D6BBB0F8190B3237C72E517A792F723D45C75708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776255492, "uuid": "23ab0ba7-c2a7-4ccc-bcdc-7efee3d50a93", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776255492, "uuid": "03ee2c08-6bbb-41e4-a982-863adaf4fac8", "value": "24576:jqPtzOVA1EoBCdV2A3zkeUvXGrswyH9DMM7CU+hU5M3YdDeleNK84HWbm7HBL:jq50A+ICfpzGN7CRK5M5d2wHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776255492, "uuid": "95b964e2-d4d6-4c48-b83d-44d142a17b65", "value": 2250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776255492, "uuid": "a25967d3-67ae-4a30-9ec5-2713501de0c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776255492, "uuid": "08ad2a4a-4fe3-4640-97a1-6bda8348014c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b73c489-38ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776245720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245720, "uuid": "0e7877f8-f34e-4593-b58c-39cd58018b8b", "comment": "Malware payload (Formbook)", "value": "e278f6558f4d2f78b2ac2f228d9389dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245720, "uuid": "630af06a-2092-47fc-bc69-eb414e5e42ca", "comment": "Malware payload (Formbook)", "value": "78ddb86c7e16686c4ef2cc8d7ebb72291ded39f9168247645e67cc0f650c15c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245720, "uuid": "3f334b47-e022-4f6a-a387-932378eb6b70", "comment": "Malware payload (Formbook)", "value": "13a313b6669ca8f828106db45ede5ee202c64d62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245720, "uuid": "0b99c0c2-0f0e-4d56-bf21-ccb6d5470ce1", "comment": "Malware payload (Formbook)", "value": "1a07cfd628b91145b93839307bec8aa8f227aaad57e29f1d27e6f5c814f13a178495886bf92ad2147f04dcc54d7db10a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245720, "uuid": "edc262ae-1237-4276-a6dd-d78e1698ea88", "value": "T13C54221CFEC30AF9FD74A6B6F543F4E905BC56A0408CB0EFE346229889569E897D3152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245720, "uuid": "5f1938d0-4464-472d-80cf-36847cd3ebb4", "value": "6144:OfNqytPyvdsjt2Am3OKN+NMZjH6e33Y6aB8elL59nD8iNqBreAO:OfuWKN+KJ3I6apnD8iNqBSAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776245720, "uuid": "4ec986cb-6a23-427b-ba9d-2caaffc16843", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776245720, "uuid": "f483f3d4-70b4-4239-a18a-4d1965884cd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245720, "uuid": "1c0f9aca-77f2-46aa-97c6-bfac32942702", "value": "SecuriteInfo.com.Variant.Application.Fragtor.34236.95677465", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1589223b-390b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776285519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776285519, "uuid": "12433c24-0739-4efa-b6c2-ab2879f6bed8", "comment": "Malware payload", "value": "66f99735ce115a6134eb562226050bf6", "object_relation": "md5", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776285519, "uuid": "f864e284-8e46-4019-8d30-6b06bc8f741a", "comment": "Malware payload", "value": "792ac0395d1cffee16d2358db6c3f2ec796c099cc5617a573c60cba01d234fea", "object_relation": "sha256", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776285519, "uuid": "1c6c26f8-7560-4956-9ae2-24fba0f5579a", "comment": "Malware payload", "value": "01ae69cd0ffc1961f747552019c2d6f1b64500fd", "object_relation": "sha1", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776285519, "uuid": "5266a66f-ee83-4c1c-b54b-ca137b4d8ff9", "comment": "Malware payload", "value": "2077937065da3ba4aef50ab71ad3cec72b98a8ecf912aaf993061edad52ff7f6e5bfaebd0600a627bde26c37954e5323", "object_relation": "sha3-384", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776285519, "uuid": "4786a8f2-6a50-45b3-9a72-ea8a44d5a429", "value": "T1881523B97B5979DBD3EEC3725EDF4E3E5B24EE89B1007A0B19198324761A44077013B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776285519, "uuid": "a14f801e-8562-45ea-b68c-ba486eac4f27", "value": "24576:nPDsdqugGAuVM1gcNICPhRH4zEGyrh4fWeKqISH:PwdqP5uVM1jN/PhRH32fWjqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776285519, "uuid": "c337c83b-a944-47c6-b568-aea188f58a00", "value": 877128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776285519, "uuid": "31609930-1e29-4073-aa76-3e53f6437047", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776285519, "uuid": "e0f4d5db-b7e5-4c60-b6b1-e04dae18d12f", "value": "setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c729c21-3907-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1776283813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776283813, "uuid": "45364697-23b0-412a-808b-9f3476dbbf2e", "comment": "Malware payload (OffLoader)", "value": "5bf93ff8e0c68cdfb6041725f80e8c88", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776283813, "uuid": "d879903f-401d-4dfd-b946-87218e8d918a", "comment": "Malware payload (OffLoader)", "value": "79452ce40dbd3e3146de591fbbd6df09bbb110ffd568e7b4370e4486a335df8f", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776283813, "uuid": "bde50e20-7fef-43d0-b125-e99ad724db2c", "comment": "Malware payload (OffLoader)", "value": "457f0b57bd691882fa486d3594d595ab5cb24c43", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776283813, "uuid": "f2b363b7-76d2-47b1-a11c-893c2c901670", "comment": "Malware payload (OffLoader)", "value": "a695f7bfc33320676fb04c7576342151fc44dc196f9f863c6ea6916b2647573920760afd811e1fae444aac089cfdd940", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776283813, "uuid": "7baee1e0-deee-497a-8981-58b8ab2c0608", "value": "T161E6232B71D9123FF036853359B6E22419FB761AB0198E16A6E03859CF2D9D00C7FBC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776283813, "uuid": "7ff20f9f-8148-466d-9716-5778df557c92", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776283813, "uuid": "68347e5e-388f-4300-ac11-0191a97d661b", "value": "393216:JxXpfcqKCPuRJratYhxiRyfbndXdA38uU22V:Iwu/ayhWC7Asp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776283813, "uuid": "cea52b7d-ca47-4d92-88ad-84cd252961d4", "value": 14220471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776283813, "uuid": "92f4fd3e-8b18-4795-b6cc-e89afdbe6ac6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776283813, "uuid": "d87640eb-ad8c-4ea3-a09a-634f5cb72282", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6803437e-38ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776259458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259458, "uuid": "c6b9f443-9133-4078-a9f5-73fd3065b979", "comment": "Malware payload (Formbook)", "value": "8e54e9c612d3057c7f5ff6f86c15e309", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259458, "uuid": "627e0312-05bd-49b2-afc6-d3563c1a4458", "comment": "Malware payload (Formbook)", "value": "79adda629a75a9542cf077e0f1b5837bba85c758b2ea31e735097097689fa0f1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259458, "uuid": "8e64c203-db12-4c66-852a-ca899106b92e", "comment": "Malware payload (Formbook)", "value": "d98254b1d0653a0fa77420c52797bcf03950362d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259458, "uuid": "6dd8cbbb-01c6-417b-b7ff-34eb7d40d4c4", "comment": "Malware payload (Formbook)", "value": "8515199749d0a4fe8f53df254fb577803866aacd73faed93ac37743089cc580554706dcce4fa38339ec83c65b756b194", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259458, "uuid": "5c74e93c-f02c-408f-965f-15d5717761f1", "value": "T17095021199C47FB9CFAC5A1C40FE150EA3F049895019798AEB73FE0BBFA7A04521B1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259458, "uuid": "3fd6790e-4a3d-47cd-84df-5453259448f8", "value": "24576:tP5qX00BZ7Pq29cINYKitO1E/Nfd1Pt3GcCHmzjVMe8/YbJGsnLPuW7aTlw7YM:IH7KIN6Nfn/NqYVpPuIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259458, "uuid": "bbbef9b3-872b-4979-b85f-92f0a872d9b0", "value": 2028188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259458, "uuid": "92784d14-494b-45c4-9b59-f81cf4591cfd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259458, "uuid": "53f87f16-a896-45c9-acca-4f6bb05c2cb2", "value": "Wire payment pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce4322bb-38c8-11f1-a769-42010a9c0008", "comment": "Malware payload (Facefish)", "timestamp": 1776257053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257053, "uuid": "487a34f7-b559-43b2-87d0-70d8cf122c8e", "comment": "Malware payload (Facefish)", "value": "e27fc8d2547fe72426240ddc64b513be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "facefish", "colour": "#58AC34", "exportable": true, "hide_tag": false }, { "name": "kernelupdate-net", "colour": "#5BBDB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257053, "uuid": "b1da10fc-5f3a-4d6c-ab4a-785f2bf157b1", "comment": "Malware payload (Facefish)", "value": "79aeaec3b6fa8deec5afb13183ad98653203b9c321ecd0652022d6aa0eee2a57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "facefish", "colour": "#58AC34", "exportable": true, "hide_tag": false }, { "name": "kernelupdate-net", "colour": "#5BBDB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257053, "uuid": "f48a7ddc-f71a-411c-8f9a-41a878e013c4", "comment": "Malware payload (Facefish)", "value": "991f1f32312dcbef5e71f8ab1d785f067a5569bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "facefish", "colour": "#58AC34", "exportable": true, "hide_tag": false }, { "name": "kernelupdate-net", "colour": "#5BBDB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257053, "uuid": "7b91f9c7-aedf-4e44-bbd4-253c1791a31d", "comment": "Malware payload (Facefish)", "value": "dbf5201409167b985362d8716de020f60539c284fb5adb6d7c4d4e53a8b4e7a491970d45eea630feefca3e1615dfc3c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "facefish", "colour": "#58AC34", "exportable": true, "hide_tag": false }, { "name": "kernelupdate-net", "colour": "#5BBDB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257053, "uuid": "f8ebb6c8-aa5f-4d72-b590-c376624ad8e4", "value": "T1DDE23B1BB478817DD1898730998FC129D6397497E6BDBA4E07C41E633982F90237FE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257053, "uuid": "73641c26-5cd9-47d6-8059-e22a7a419af2", "value": "768:3gIxgb+jIrOY7W75WLtygOf5CLEojFb7VHjgKMGgLa16:MygOBUvgNLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776257053, "uuid": "8095e0b2-7f20-42e4-8ce6-43afab927f20", "value": 31256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776257053, "uuid": "dd5a1f52-2536-4e7e-8fae-de3724dd8406", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257053, "uuid": "93a593b3-dd69-4056-b385-4be3673ded55", "value": "libs.so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "964952b1-3869-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1776216156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776216156, "uuid": "f7def41a-8f91-4529-ab40-7d9af6a0f4eb", "comment": "Malware payload (SnakeKeylogger)", "value": "e5bcb7d5f48b4a422bcdd6e24a64f64d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776216156, "uuid": "4f80ad12-deae-415e-9a0c-26bcf56a63a8", "comment": "Malware payload (SnakeKeylogger)", "value": "79e6b2c3d010500745a6a5a68b89b3453e16eca3ff359477718453301c17b034", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776216156, "uuid": "ae515dea-3926-41bf-828a-4d027e103c7c", "comment": "Malware payload (SnakeKeylogger)", "value": "c8de7f39880aabe3995f15bc2c7eb814b89dbaf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776216156, "uuid": "e1cfcbb4-6407-42bd-b51e-c86b48da5e85", "comment": "Malware payload (SnakeKeylogger)", "value": "f751f58b86c0e6f8aa701b7efa579d56c1b3b312bc7482202cd31a691d3f6e89e83289ea9ee2b04fbbd8c80da854bf4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776216156, "uuid": "df83f5e8-dc4b-4e30-89e1-f811be762d79", "value": "T14BE4BF762DDB9089E29385B0119173389BFED2E52DD6D7D39D3E05ADED24CC8AE22D00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776216156, "uuid": "f6dca098-95cd-406c-8d18-0c0376db7474", "value": "4fecd44dfc94ffab3c4ae3356e71b8f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776216156, "uuid": "e654e0fc-f8ac-4dcc-9531-c97f8f3c70fc", "value": "12288:mdX9s4H7pg1bdSvP3UleXv7qQYnnnnPnnnHnnntnnnNnnnunnn:EubdH4zqHnnnPnnnGnnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776216156, "uuid": "6e151574-8944-42bb-9e70-99750a5eb1a2", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776216156, "uuid": "ea4dafe4-9984-4c71-9bb5-0b45d50d0e09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776216156, "uuid": "7175c263-8837-4f37-8ba8-5acd4d2cdbaa", "value": "MV_GARDENIA_K_VESSEL_PARTICULARS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "165f5310-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1776239564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239564, "uuid": "2e8572b4-37ec-46b4-b0e4-debcb58ef5f6", "comment": "Malware payload (StrelaStealer)", "value": "bcb1952382493e027419c720e27f4ad6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239564, "uuid": "d5376740-b809-47a5-886e-bd2c252453ef", "comment": "Malware payload (StrelaStealer)", "value": "7ac8844c577a69405eaf28e397fe1d3bd2d98e899d4164dde2bc4367d95f0d7a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239564, "uuid": "02b1138a-7f03-42b0-b576-1120c1f939c3", "comment": "Malware payload (StrelaStealer)", "value": "152ebf56ed04ad5680e32efd883451fe704a7e5b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239564, "uuid": "78c30501-053f-4cfe-a6ac-e691450af9ba", "comment": "Malware payload (StrelaStealer)", "value": "ca566752fa785f10adc3b1411bcd14014a8624c588b38e30a8f74dd053ea11df529fa30a240d6adfb98a0ba9e5f68e1e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239564, "uuid": "71b729ae-17b3-43ac-8093-e161bd1129c1", "value": "T12A540F38ADEE001AB1B3EF55AEE47493D96FBB63370E989C1081034A4723945EDD563E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239564, "uuid": "2e458737-dd04-434f-b721-705147af525b", "value": "6144:0WmHCBjqVBgZSb/tttDKW6taOtVKBfg8NbuT8tUwTHsT:0WmmjwgZSrttJK9tauVKBfBi6zTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239564, "uuid": "f4b6b839-ae0d-4345-8f93-f63b6c2fd024", "value": 292860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239564, "uuid": "258d65d8-4d54-4608-ac3b-2d03c5551393", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239564, "uuid": "f245aa93-f306-4a20-95db-c431845b00d0", "value": "Riyadh Project 1107-991875 Kiosk Proj.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16e1e2f-3924-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776296545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776296545, "uuid": "8758f219-7685-46ef-a2dd-52dfe9aa862b", "comment": "Malware payload (Mirai)", "value": "d3741a076f7469f3163488ba3427306a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776296545, "uuid": "dcb35f60-57a7-41a6-8596-898d5625f8d4", "comment": "Malware payload (Mirai)", "value": "7ae60105127245b497ac611187bae5f0c4ca6a9f8de8bfe509ee97ca65c18d0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776296545, "uuid": "2da3df30-dd80-47aa-b5fa-40b5883b3089", "comment": "Malware payload (Mirai)", "value": "4737b7801a80755b4479d4a47cb84f7dd2895305", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776296545, "uuid": "63e53977-e97e-4995-8ac2-408cb4097c1d", "comment": "Malware payload (Mirai)", "value": "a2dc1d55db305832d5f1253256b57780b275ecf092d0961824689c80933b1278c234ac1a784a59664c4eebde175447cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776296545, "uuid": "dc1f737e-5e71-441f-97d9-6024836b3e2f", "value": "T17B82F61757BAEE97C0D167B711E703A0E1EB9FA812A0432F7E460C4DAE253949D2E780", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776296545, "uuid": "6e6f01a2-a6e1-4fe0-b61d-03513e0233c7", "value": "384:0ax403MOg922+bu8qWzA0H2HwyOsN6K6CdJ560fR3b/Y:0ax4+MOg922M5qIJqzNdDdv60f9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776296545, "uuid": "f34f6c4a-35f2-43f9-9369-34d984413628", "value": 18892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776296545, "uuid": "9afb54d6-6298-4ab4-be9a-e2d134467196", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776296545, "uuid": "8da19333-ab54-411c-9b4a-10930c06db95", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f80670ee-38f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776275591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776275591, "uuid": "cbaf1afb-1b98-49fe-a8c3-376fe11602c8", "comment": "Malware payload (Mirai)", "value": "f1e6b357aec6c70b129e372a1b8be81a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776275591, "uuid": "b4635e44-db3a-4886-b4ff-6180a6424894", "comment": "Malware payload (Mirai)", "value": "7b520c6ea73657d514fd82fd21f4c5b05adf07b6c1688dc01d9d81976fc0f2c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776275591, "uuid": "475175eb-a370-437c-a06f-49a02ff3fccf", "comment": "Malware payload (Mirai)", "value": "36291f09f9843e62770cfe72df05374ad2b2e1b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776275591, "uuid": "e1cab1eb-0b7c-4210-ac82-74fa49f947b9", "comment": "Malware payload (Mirai)", "value": "22d23ad0f7c27a139a932c7db71d9aa68649874ffa4b6ec80e37b4f5ad7197f8fc8d9d2d74c77088c946877a0bfc979b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776275591, "uuid": "d02bb0bb-41b7-4cf8-b74a-6b035735e4f2", "value": "T120C30945FC409B17CAC662B7FB4E428C7B2A5758D2FE72039D256F70379B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776275591, "uuid": "baafe95b-e97a-4bf4-9dd7-8096c44b4d33", "value": "1536:rPl4le+4kTAAfW44VYVrTrodN+GOzSIhnpJeJ85Qle+wywQkeOYxazdFpWNf6s:rN4le+9TAS4Qr/o/ynDeOQgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776275591, "uuid": "fbebf86d-01a1-4b53-8c16-b4f697b0b503", "value": 121376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776275591, "uuid": "3619fc0b-74af-4c36-ac02-07dc49c7a32b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776275591, "uuid": "3a4cf326-2f7e-4fea-a887-8ffc3008ffd5", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68503f31-3922-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776295536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295536, "uuid": "0fedbeeb-92f5-4ff4-ae45-f04d0c7a6bad", "comment": "Malware payload (Mirai)", "value": "c03ce22f0444001d8633da30f0a3e092", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295536, "uuid": "4bb3fdc0-5015-42f2-a388-3d26b7826f05", "comment": "Malware payload (Mirai)", "value": "7bf180a23a1791906926eeba7b9a1221eafec493a8f17ef728e684d5c32d9afd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295536, "uuid": "f2ea0d01-ebaa-4544-9d9d-00f272241522", "comment": "Malware payload (Mirai)", "value": "539168415e4230138618d0f0282e8842fbddb442", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295536, "uuid": "e6f1981b-b352-4671-8d8b-30647b95215d", "comment": "Malware payload (Mirai)", "value": "53a6d54bd12b882e0aa350f5bdd55ad9eb643852480430fae4490efe7faa97ca7dbc38cc5def4e466ffa2ca8e9eff4d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776295536, "uuid": "c0b2cdc7-b703-4fd7-a542-4a15d16e6c93", "value": "T162E3881A6E328FAEF67C833147B74A24A75D23D623E1D684D2ADC1141F2028E545FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776295536, "uuid": "c9d325f5-46db-479f-b23b-c9817cf6f3b1", "value": "1536:fbff+Q5rzEwvJ2sjaj9ffNlOyOGLVew355cgNFQuYTNDg3+RxdoWAlW:fbvEY2sjaj9fFlOyOGLL5c6SgORxdclW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776295536, "uuid": "adf01905-e866-42bd-b4a9-66f8c352d0e9", "value": 156720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776295536, "uuid": "5c74be71-fc6c-43ab-b00b-982a26996808", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776295536, "uuid": "e8bf0323-9cf4-408b-a25b-ab99ecf74cf0", "value": ".Sassy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43bb97b9-391e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776293757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293757, "uuid": "e8fa23e9-17ea-4acd-bf49-355520303a82", "comment": "Malware payload (Mirai)", "value": "c57f449f2d672e695c1b1837e9021c92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293757, "uuid": "bf285b35-167c-4917-9a13-2f0afb64bbed", "comment": "Malware payload (Mirai)", "value": "7c4c7a933557bcc965d63a582dce5caa1170766c49db1c7297e522b5e2c06f9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293757, "uuid": "0ad0fab5-f71d-4fb4-b5b4-1265c0cedaf9", "comment": "Malware payload (Mirai)", "value": "cfe145174559f7d8fe3b68c3753582dcfdf8bb60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293757, "uuid": "b0f7b699-1898-4893-8971-fb7ebaca0cc8", "comment": "Malware payload (Mirai)", "value": "d4cfea3fc457d35d70e82772f1e82c96fd9cbf6d18204c79f94e58a8b297bb3dbd58eed3947683b61ccae7987f8d5a52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293757, "uuid": "25baa1e0-1fd0-4475-8a23-f74a569aa4fd", "value": "T177A32963CC262F18D628D5B5B0B19F796BA39960818B1FBF1677C6744083D8DF6093B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293757, "uuid": "5129027b-7326-46b2-8b6e-89bf0ab6075b", "value": "1536:LQ5ihIo2bCSzKdPaU7NHAaLAqBM92oW7MncilDBP9S:8MX2b12dHeaLATooWoncO9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776293757, "uuid": "07abd7bd-208b-4f3f-89bc-eb3b89aa2b4e", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776293757, "uuid": "85e6454b-37df-4acb-ad95-f68053a003d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293757, "uuid": "599df1c9-c2fe-49a0-b03e-1deca28056c9", "value": ".Sassy.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d885dcc4-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776239890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239890, "uuid": "77395ce5-191f-42af-bd84-8f8a1560fd1b", "comment": "Malware payload", "value": "22fb324299535276a09110f6bbf527a4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239890, "uuid": "852263b2-1a83-43a0-ae77-246a9dca6fb1", "comment": "Malware payload", "value": "7cbb91f11660a003d8bc6bbd1afe873873f37cf95487d668eb01d2b6ee1c5aa0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239890, "uuid": "35e1a226-ae11-4154-aaef-aed50d729dc0", "comment": "Malware payload", "value": "01f568ee26da53dd1bd6829990da8022d5c7dded", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239890, "uuid": "ddf75800-ada6-4e8b-a18e-ae29a0da05ef", "comment": "Malware payload", "value": "e4d917f509e3e577767f141022b4333a5ae497274617d1f5657101bc916d2ac2ac25c45793e329c492531427f8033591", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239890, "uuid": "b1b9e49e-f90e-4804-aa72-50862dc9577b", "value": "T1D6C2B4CEA7C6F294831230B72426A1B2F52E9CC0315581C5F6C4B29DFE78B44DAA54F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239890, "uuid": "05be9b11-2824-41d0-91a3-13bdffc47cd7", "value": "384:oGLWvUXCpFGtlPxwqQf89e9QWMPK05k2OQqcz7LrcK9E4/fzFkamU++TPv0g2Cb3:oGLxAcxxwQs8iczHrc+3x2U+C2QYWOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239890, "uuid": "e91d5536-c775-4cb5-ae39-3dd69222fe68", "value": 27796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239890, "uuid": "4f903fe4-04b7-4d83-b280-8018c0473b3b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239890, "uuid": "b4cb6d41-0db8-4c27-a719-772d18924158", "value": "Pedido - FX049.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59cab108-38b1-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1776246979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776246979, "uuid": "6b91a6ad-643c-4cff-a261-b5464c177a30", "comment": "Malware payload (a310Logger)", "value": "6f81c1f154e29e9ce6a747d27da5fd79", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776246979, "uuid": "09855024-4cda-4499-8d5a-6a5ef2114cba", "comment": "Malware payload (a310Logger)", "value": "7ccb10e99f67295a4d737673305b9326ad772835acbf281cd97217c2a07c10f4", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776246979, "uuid": "80d776ca-7302-45ef-8260-e9be0838a90c", "comment": "Malware payload (a310Logger)", "value": "913dd154a2dbe3b437fa327872852e445612a4af", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776246979, "uuid": "ed276400-2ecc-4b1b-9241-f3142e4acbad", "comment": "Malware payload (a310Logger)", "value": "9b0b23764c18e3f45198182c31c08c2b257ffeab00e23aacbd225840e8152c11659a21b49a67d092e6ab6681151dafe0", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776246979, "uuid": "09dcc67b-25cb-4e5f-8115-0374fff479e5", "value": "T190A42812EB20A12EF097C8F1A8B8915768257D391A89EC5BF3426F5C35311E7A8F171F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776246979, "uuid": "dd00c569-164b-4ab8-8cba-3a81a63e9f95", "value": "fa5639a0fbd730eb5a3efdf2740f91d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776246979, "uuid": "0957934e-6cdd-4516-b63d-ec93fce324ec", "value": "6144:7bsTCQ8d1/w5KA81IJ8GpF6nuTmOOUWTsD92d0jpa5cUO4lEDOM3Zvo6ymRP4BLl:7uCzjYKkJj6GmZUWg92Y4jlMC6ymRgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776246979, "uuid": "e9d772ad-1f4e-4f30-a6ba-87229202b6a0", "value": 462848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776246979, "uuid": "6a53f8f9-391b-431d-9816-0a101ba6d5ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776246979, "uuid": "fd2a2c2c-cf65-4f57-b656-3b3ae814cf58", "value": "T. HALK BANKASI A.S,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb5f6326-389f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776239411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239411, "uuid": "a08e5c39-2e44-479c-ba4c-530f6f6cf149", "comment": "Malware payload", "value": "7ece20db128e118485f6281be698ccf4", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239411, "uuid": "4f892557-51b1-407c-a4d4-b37adc32a131", "comment": "Malware payload", "value": "7d91edf5789c50a20d93dde3671b33ca204c319d5a78a9ace5090da66faa6f9b", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239411, "uuid": "b85b11e0-03fe-49e1-b239-57b042f6eac4", "comment": "Malware payload", "value": "76a6caab506799bf5ef326bfb2948e9a1ebc75f1", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239411, "uuid": "476c1b3c-3926-413d-b2a2-cc6a9a3586b4", "comment": "Malware payload", "value": "56204a61425f5662620d7c74609c44a8e17c0438f2e131ad2ef461a83b0677293d6da34e21a76e24b593c87e05eb2ba0", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239411, "uuid": "f6aaccc2-ea83-41ff-8e89-80d3eec19681", "value": "T122E59DFEF0683AE9052A7C4BAC1FE5AC81D5C25CDF6A699333E05B30C14965381D3DA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239411, "uuid": "2e0ff8c0-7d3c-417a-93f0-fe6adb6b863a", "value": "96:JNbNbNbNbNbNbNbNbNbNbNbNbNbNbNbNbNbNbNbNbNbNbNbNbNbNbNbNbNbNbNb/:l+oUleBUe8GE4KcD4KIQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239411, "uuid": "9a282b9f-414b-41c9-906b-46eae47400ee", "value": 3163173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239411, "uuid": "b667cfb7-a9e6-42e1-988b-af1001971360", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239411, "uuid": "08510ef9-3508-421d-a1f3-57b62d864f2b", "value": "N\u00f3mina de ABRIL de 2026 148484000.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79174b12-38c2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776254333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776254333, "uuid": "a249b927-a504-4a1f-9ddf-f8234ed86606", "comment": "Malware payload (Mirai)", "value": "b153c2624395318b28c9b63232549ac9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776254333, "uuid": "fa1fb27f-a836-4c1e-a115-71bc53b2389d", "comment": "Malware payload (Mirai)", "value": "7d91fd6b34f11e81b744a841ec2a1015994abb2ba23c46a49630f3d8f191847b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776254333, "uuid": "6806a155-d6c8-43c1-b8fb-2d995958557b", "comment": "Malware payload (Mirai)", "value": "a4b656f4c4d0b3dd1a025f634fc9eb021304395b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776254333, "uuid": "f0a0b682-db58-4aea-b162-99115e02f237", "comment": "Malware payload (Mirai)", "value": "47454f23a6d3d2ef0460da365cf71cda97da83785733216c48eaae2bf2347aa1ba9659435c549a624461042a10ef002d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776254333, "uuid": "5d8a63f9-00e7-475c-9641-6193b4fcf804", "value": "T11E440706BB610EFBD8AFCD3706F9070529CC641722A43B7A7A74D918B54B64B4AE3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776254333, "uuid": "f8822373-6128-4727-afa0-9a074836e9cd", "value": "3072:9It1QneHpv6f6WOez8vJ63DJmbR+k0gNAppcWp1:6t1Qcv6fOezHDJG+wAAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776254333, "uuid": "9839247f-895a-4138-b55d-cc374b00c9d8", "value": 260296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776254333, "uuid": "1cfd8a06-b8ca-411e-8e39-3c8649f8f299", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776254333, "uuid": "527d64eb-e369-4c7d-a4c4-826ec4af4602", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94593192-38c0-11f1-a769-42010a9c0008", "comment": "Malware payload (Pony)", "timestamp": 1776253519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253519, "uuid": "512a3c22-3998-41f2-99bc-65cd2dacb0d9", "comment": "Malware payload (Pony)", "value": "da49f65a4695a037b11df7f2c20444df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253519, "uuid": "95a4c9be-4a89-490f-b503-268784796e5e", "comment": "Malware payload (Pony)", "value": "805b1dbf373986fb98f346b491cea9ce75c44ea7cc55339260c344606773e236", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253519, "uuid": "dd0b4a5a-82d6-43da-bccc-63bd647b3482", "comment": "Malware payload (Pony)", "value": "94fd3ca6f5fccac582289bb01cf4a17e96f2e6ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253519, "uuid": "92b49b33-4f27-40ea-877e-c90f24767cde", "comment": "Malware payload (Pony)", "value": "10dceff953f8a2d9c2d2d2f47853e4f2a51bc07eaefd96ad361a393bb12ac20251a9dec368651190ada7ee0b810e6fc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253519, "uuid": "370674e1-9aa6-4425-b2b9-35ae21b44bc8", "value": "T102930803F480B0F1D1A22AB137C217A1E7F99E797C7A8D4EEF9C55856CF168B6B12052", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253519, "uuid": "5ac97324-42ac-4f9c-b7c8-96cc8defcde5", "value": "2c8567c932832b8c3359ddf9343a4028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253519, "uuid": "a3af49d5-e0ef-4655-9a2b-7bcb3f0c7750", "value": "1536:T0nR3ItISbDqTmHFh91zb5hqCpgFugt6otHMO+U93TvOECSkzZn:4xxSbL91zbOCpoRtGO+8SEC9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776253519, "uuid": "939c52a5-3c0f-485d-aee5-94045ab6cad6", "value": 92160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776253519, "uuid": "05ba8a7e-3d16-4816-8879-177c37376a73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253519, "uuid": "ada00a10-230a-4857-b957-dcfa317d1fec", "value": "DA49F65A4695A037B11DF7F2C20444DF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a862350-389d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776238390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238390, "uuid": "9fe76cbb-9363-48e8-8290-dbe7d80c7fd1", "comment": "Malware payload", "value": "4ba5bcf21e2b14a86080fcf46241fcbf", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "ZIPLINE", "colour": "#23165C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238390, "uuid": "bba2e196-6088-4b29-9f21-e822359a0a85", "comment": "Malware payload", "value": "81c1a8e624306c8a66a44bfe341ec70c6e3a3c9e70ac15c7876fcbbe364d01cd", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "ZIPLINE", "colour": "#23165C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238390, "uuid": "57f4f9ee-3376-4970-b35a-446c07d644cd", "comment": "Malware payload", "value": "86d9f0e8ff59d6e3e6897eba04f20220ec94e3c4", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "ZIPLINE", "colour": "#23165C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238390, "uuid": "0f3b74c5-9800-441c-8efe-8a00c327b99c", "comment": "Malware payload", "value": "8173c29b2e99c34cb9f7e3acc4aaf298423e4d6ebeaa4fc8d83734974b2e0beec1d3b8345d52043f4fb84d9b62e98314", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "ZIPLINE", "colour": "#23165C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238390, "uuid": "a9e38d74-2e75-4269-a4c5-b7513fecf94d", "value": "T12111E5A06DE73DC5CA75D47D0E0665285216475748194405751EC00C2FF817CBBF6DFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238390, "uuid": "3264b504-964e-4de9-ba49-abcbf41a67f9", "value": "24:bkzZbOnXnOYrg9A7E/1p7a6kCb1Kew0ID:K9OXOYr/Sp7JDdw0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776238390, "uuid": "9a0ef138-f83c-4898-986b-28eaa79cef98", "value": 1036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776238390, "uuid": "84e816d7-55ba-41ee-9ebf-31393e7bace3", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238390, "uuid": "c1a9c421-8825-4da2-98af-f998a070f4a0", "value": "81c1a8e624306c8a66a44bfe341ec70c6e3a3c9e70ac15c7876fcbbe364d01cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c96ee1-389b-11f1-a769-42010a9c0008", "comment": "Malware payload (LodaRAT)", "timestamp": 1776237488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776237488, "uuid": "6126ba4c-afd8-4144-a225-2cfc5d9669cb", "comment": "Malware payload (LodaRAT)", "value": "a20ba154910598160b4efec822b10c19", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "LodaRAT", "colour": "#DEDEF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776237488, "uuid": "5718612e-89cb-42b1-bbad-a335c706ddd6", "comment": "Malware payload (LodaRAT)", "value": "82f6a3c51a93d604d30ca824c81cfca765d1c59f2df8705f132afc7874d84c41", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "LodaRAT", "colour": "#DEDEF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776237488, "uuid": "67259d42-041c-4359-9223-42b49d9770e3", "comment": "Malware payload (LodaRAT)", "value": "10217fa81b6c4ddfea15e2ef3ab7dbb870acc40d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "LodaRAT", "colour": "#DEDEF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776237488, "uuid": "a47fea4c-ec95-49da-85b8-9d482371659a", "comment": "Malware payload (LodaRAT)", "value": "c5a15e8a8ec6ac32dc1da4af75b5689bbc070eda1801646101065cc82a007ad1e8525c3f4b0b47f23c3e01c84a8815d3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "LodaRAT", "colour": "#DEDEF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776237488, "uuid": "87b86ec9-cb27-4ebd-be6b-60d0637ec410", "value": "T1E024123AC5D25031F6ACB77E2C2E0860D64B82EA5D1D176439D4AD8C71CCD7602DAAFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776237488, "uuid": "655ede93-d9f7-420e-b790-4029417fefe2", "value": "6144:oHJsWIDOewt8Mo3DVLxkqECtALkO1bl/v1JEM:oHJL6wt8M+9iqu5b3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776237488, "uuid": "5e6922d0-450d-41e4-83f7-9c0da46be889", "value": 216798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776237488, "uuid": "fe51278f-cce2-4f00-b38f-0081c46ff69d", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776237488, "uuid": "1557165d-c384-4d16-ae4f-a074bc132a99", "value": "Confirmacion_Reserva_MACH_REF-784392.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35fab210-389d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776238329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238329, "uuid": "9b88cb93-8856-4ae6-bb1d-c6f90bef2fd2", "comment": "Malware payload", "value": "9a0c81cd4ebae6c5a6e6820a42b216ff", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "ZIPLINE", "colour": "#23165C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238329, "uuid": "41bcd90e-5891-4f0b-8ec9-a38026770337", "comment": "Malware payload", "value": "83b27e52c420b6132f8034e7a0fd9943b1f4af3bdb06cdbb873c80360e1e5419", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "ZIPLINE", "colour": "#23165C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238329, "uuid": "66da48d8-802a-4579-bf14-4b64a24fc9e9", "comment": "Malware payload", "value": "bec48dd5b2b0c91d6a78266295b77eb0b70f1980", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "ZIPLINE", "colour": "#23165C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238329, "uuid": "b85f48b2-1ec0-4a75-b76b-c3cdb73161a7", "comment": "Malware payload", "value": "1502ce85efa63e3e5c2334f14ab01524b957f6224940bf48f9e3a06b8143e812502b5b36b9b184d670bdf9eb4677b435", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "ZIPLINE", "colour": "#23165C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238329, "uuid": "bfbf9034-10e7-4162-b090-5bc848cbaf27", "value": "T122542206F1EE5E88A5CB687BD170A7857D438FB70AAD9A87CCDD8C028DD093052AE54D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238329, "uuid": "a30902e7-539d-430f-9faf-b99d6401c8d9", "value": "6144:qwujqtY/Ys370zakhZgiTIh7fY1ZZmkX2W1aPZ+k2Ox:T8Loz5Zgbh7fYLJ2GaP4k3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776238329, "uuid": "626d83ba-afc1-45f2-95ad-5ce3ede78e1f", "value": 280244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776238329, "uuid": "f802edc1-9751-4519-8699-be114db27d05", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238329, "uuid": "fe9e6336-428e-4922-a071-4cb17db0505c", "value": "83b27e52c420b6132f8034e7a0fd9943b1f4af3bdb06cdbb873c80360e1e5419", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f73fbf6-3880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776225916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225916, "uuid": "8fb977a7-0dae-4d7a-a81b-675f895147a1", "comment": "Malware payload (Mirai)", "value": "2ceb5f72c86a60d2b0a7576e97bdeb07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225916, "uuid": "e49fdad8-4dfe-438a-9515-160a74b1b66a", "comment": "Malware payload (Mirai)", "value": "858944162e6e16f2f042a7bb8f1030721104ffbbff2b7fd94ef5b3247c476db7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225916, "uuid": "f13fda9d-4859-45c1-a397-f8d29a2bd896", "comment": "Malware payload (Mirai)", "value": "27a0701766d491dd2c051eed7d53b70a6f896236", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225916, "uuid": "0fa0c0ac-589f-4a23-a2a9-05041ef8d9cd", "comment": "Malware payload (Mirai)", "value": "8edb4aa0c7c8fe355ad863c71eab5b257279fa8870d8201b0257d5f27db304e856feb5aa62ba3267e116c3fca5f58dcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225916, "uuid": "eac2df53-3df2-46dc-bcc1-b66bed84a782", "value": "T1E9C30946F8819B15D5C151BAFF0E124E77231B3CE2DE73029D24AB747B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225916, "uuid": "f2703b46-4c1e-4a6a-83e5-003a600c46ed", "value": "3072:paUJUwTHv6X6BltjHakuJyqxuWfmscpLdJNT:paUJPz6Xilt7a8FWfmdLdjT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776225916, "uuid": "3a3e2ca4-577c-47d9-a112-1e7233aed11e", "value": 129244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776225916, "uuid": "a86587dd-37a1-471a-acde-5676cbb22a35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225916, "uuid": "36c34110-c823-4a5c-b3f1-99f2e140de40", "value": ".Sassy.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea5e9bb3-38f8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776277716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277716, "uuid": "30d9e46c-cdda-405d-8a33-b693101bc0d9", "comment": "Malware payload (Mirai)", "value": "6c943d7c0b118fb1b1884541d43e32a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277716, "uuid": "c26fecac-21ac-4e9d-b625-3fc941078c4c", "comment": "Malware payload (Mirai)", "value": "865612726362f9134dfb9def80fa6adf79e1ab123e033ad3ce91d103c2b93dae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277716, "uuid": "b49c59a0-ac14-4543-bd53-4c14b744a5c2", "comment": "Malware payload (Mirai)", "value": "bb529e729624d85a1277641000fbf3543375eab0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277716, "uuid": "67d0c614-5213-4684-99b7-52027129014c", "comment": "Malware payload (Mirai)", "value": "302bf065b10a77dbc00a1eb0f93257ce52002f0db732cfb62fad0ae034d05a476cfa0ddf942bd7d14acafb04d6ddd363", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776277716, "uuid": "a0819870-326f-4abf-b9f8-14b8b4656d94", "value": "T1F0C2F1E4246921AFC081427A912D0DF7B0713AB49423B6FDAB527CFDC59B57CC13E946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776277716, "uuid": "b9731b34-7fa5-4cf9-b70c-8d25c498afc2", "value": "384:MpKpIDb1DFUbrJhFKU3g2TSl04dWthWtItcn/XdmXSSa6G52l9ViAziwWC1ehbB6:HIrjU3slz8hWt7/tmiSrl9XiWYhbLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776277716, "uuid": "cadb7daf-b74a-48d9-9d06-e858cecd49fe", "value": 27812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776277716, "uuid": "dbabd97d-0393-4273-b0f4-aa8ed0dd15f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776277716, "uuid": "3e717c42-8e5f-4973-a74b-1f138e05ec2c", "value": "FGx8SNCa4txePA.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3203f92-391e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776293997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293997, "uuid": "d7288b7b-3cf7-4201-87a9-432a0b2f9f6b", "comment": "Malware payload (Mirai)", "value": "5abc26f386e69170fdc985450b0757c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293997, "uuid": "51be97e0-742b-472c-9f8f-cd524252f01b", "comment": "Malware payload (Mirai)", "value": "86574e0ff082592a19c0033884e93ea16d472cc54b96affccfa992747fe70315", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293997, "uuid": "a75c1242-9f07-44d0-9886-7b895d0ae715", "comment": "Malware payload (Mirai)", "value": "147d5f3a4a9df64eb02d593cb3b0751aa728c880", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293997, "uuid": "e27402c5-67bc-469c-9fa9-1da2e488e384", "comment": "Malware payload (Mirai)", "value": "8e5ca22422077353cd7adaf7dbe1735e0c148811c25c24d864b9ab8900500aeecfb55718120a54fc72b55c4a822d9682", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293997, "uuid": "8ece3cc0-7a9a-47ef-a87b-2987e6fb9711", "value": "T198B34A63CC692F68D629D4B4B0B19F792BA3A96080472FBE1577C2798083DCDF5057B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293997, "uuid": "067feee7-f424-41bc-b2ec-5f0cb5169786", "value": "1536:3JbhZVRr7CVKvLDX7dfUO0WbZ6hWAF3UYdrA2nA:BNd7JvXmO0QchWOkYl3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776293997, "uuid": "a6ae7192-7d49-4842-a267-bf0ece5b579e", "value": 113248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776293997, "uuid": "a1ec1066-9fd4-40c6-8eb2-1de17c4378ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293997, "uuid": "ed7e84a3-de32-47da-996c-aa2fc1900abc", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "853191aa-38a9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776243616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776243616, "uuid": "17bc2ccc-89b3-40b7-a012-afac8143400a", "comment": "Malware payload (AgentTesla)", "value": "687ed6efa2d58480e3f99f1191cd737d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776243616, "uuid": "c68025a0-6d02-42bb-ac42-231ab077624c", "comment": "Malware payload (AgentTesla)", "value": "86aaf69bc8b82fde31ffbf766086a159420961df3d06f8c905a4bdbbcdc5b86e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776243616, "uuid": "9c5ac3aa-4f92-4805-ad20-356539e77862", "comment": "Malware payload (AgentTesla)", "value": "b8f7b8f1e8b55bd4ab80d69a4b6502969235457e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776243616, "uuid": "e5deab7d-4819-4d20-89e4-c59d46cda630", "comment": "Malware payload (AgentTesla)", "value": "22ae51e1163e9f7d61b11dc2174d1c3477bc5033eb1078cea8d9b64419f78eb5c4d02eb1d153c0e821ff003505aee2bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776243616, "uuid": "22535f14-054a-4845-b6e2-31c1abb4c01a", "value": "T1C822BFD5A8912825AE18442DDAC5E8F50EE0CB2926B431FD71BB09D1E5F4317C82FFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776243616, "uuid": "6c81d15f-1b8d-438f-8b0e-a8b04a6cbcd0", "value": "192:05YP1qAIBrLOhp0uavomgGbKmzPZ3vaTYr7GvlrROZ4F9DCkTxKsHJ9:0etqAaOhC/fzPZvry9lOZIZVKkJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776243616, "uuid": "85490370-3331-4d96-a593-ac8007620f87", "value": 10699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776243616, "uuid": "9fc717b6-d41f-4a8c-9b35-021e4b044293", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776243616, "uuid": "a891edc3-fbef-48eb-bd07-e07f0b851a8c", "value": "n20260415-03841.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1496f88-38c9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776257487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257487, "uuid": "aaa4ce29-04b3-49bd-b83c-9e315ad83f84", "comment": "Malware payload", "value": "c3315d582e71412e830e019d036d811d", "object_relation": "md5", "Tag": [ { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "livemap-back-ddns-net", "colour": "#E73106", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257487, "uuid": "8624e31f-513e-4fb7-9cf2-400f7988d2fc", "comment": "Malware payload", "value": "86ebb2e4384e3c0d4aa973c07c1d237e3f4042c773f4b2aa5fcd19d8f7383172", "object_relation": "sha256", "Tag": [ { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "livemap-back-ddns-net", "colour": "#E73106", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257487, "uuid": "69d79718-8390-4db6-8f10-f89068813423", "comment": "Malware payload", "value": "85801125db56d750d1136c0c9700ea6a6052f80f", "object_relation": "sha1", "Tag": [ { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "livemap-back-ddns-net", "colour": "#E73106", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257487, "uuid": "d49cb8e9-27ee-4db0-b683-7acf1285aaa9", "comment": "Malware payload", "value": "6dd47eb70293f336c7ee60b9b7e75e4bd718202684f48f440da603e9a87732ae8c8b14942be485fa4329cb842f961b9c", "object_relation": "sha3-384", "Tag": [ { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "livemap-back-ddns-net", "colour": "#E73106", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257487, "uuid": "ab8a4801-6ca9-42b1-9d4c-acafa21349b3", "value": "T1B4B61296F758952FCC3710724EAA533152678D82CE83AB43394833AC68B76D84F49BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257487, "uuid": "c32e8abc-73eb-4497-8ec2-9072cc2c08e0", "value": "196608:RfrokwDZXoRoqeZ0EYHkolZzy8C5LozvbDfhpBboSUaurEC4nvwdWF:ZokKwohZzqPlU19m/fhpBbaY7LF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776257487, "uuid": "cd70392d-1a80-41ad-8a04-0dc8306a2725", "value": 11407657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776257487, "uuid": "b3f5b8f7-8fe8-4656-961f-405acd9b1ebb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257487, "uuid": "07900723-3d76-44ea-a713-b331d89692d1", "value": "86ebb2e4384e3c0d4aa973c07c1d237e3f4042c773f4b2aa5fcd19d8f7383172.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ebe5dfb-38bd-11f1-a769-42010a9c0008", "comment": "Malware payload (AmosStealer)", "timestamp": 1776252141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252141, "uuid": "6e36ecb3-4efd-4c84-8586-6a770bfab835", "comment": "Malware payload (AmosStealer)", "value": "00b09a930ce5ffa9c304c636a783bc36", "object_relation": "md5", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "osascript", "colour": "#746871", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252141, "uuid": "fec91384-58e5-4211-957b-156babdf4133", "comment": "Malware payload (AmosStealer)", "value": "8809d3421c09669f88330adf3007b933abec13bf6ed105a785a97c7df2625301", "object_relation": "sha256", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "osascript", "colour": "#746871", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252141, "uuid": "916f5151-e742-4616-b5de-c9f158644b78", "comment": "Malware payload (AmosStealer)", "value": "37165f32ee21f087ad13512f930b696cae6444e8", "object_relation": "sha1", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "osascript", "colour": "#746871", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252141, "uuid": "fa186466-c021-43d6-af43-1088725aee40", "comment": "Malware payload (AmosStealer)", "value": "5b34145d0cde57119c01238c7bd8b10e84059dd9f7157078e56b0b8acd046e0f8fc030505d5e9717d98604d4d88f7b88", "object_relation": "sha3-384", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "osascript", "colour": "#746871", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252141, "uuid": "e54e7478-afc9-4d5e-8a70-6132d1ed0198", "value": "T102F29607695802AF63F4C53AA10581B5831FC39F4292E529F5ECC26A2F1E6D5A1F37F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252141, "uuid": "ef9882a8-7774-4294-a771-87b7d90c392d", "value": "384:LbwA6TjijnQHuzVc60sLHMNozusyoWyJSwa:gAijidQwa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776252141, "uuid": "9274e4e9-10d0-4e45-8035-2b512ce04bf3", "value": 35814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776252141, "uuid": "1407abd4-f8cc-48bd-97c3-8e2bfe5e2657", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252141, "uuid": "267e285c-1796-461e-9c1a-0804c246d408", "value": "8809d3421c09669f88330adf3007b933abec13bf6ed105a785a97c7df2625301.osacript", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "836c3828-3912-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776288710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288710, "uuid": "72b93640-d92d-49df-b28f-c67981395529", "comment": "Malware payload (Mirai)", "value": "d28513c57588d0262bc039e77245d70f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288710, "uuid": "175f0886-b1d9-4e96-bcc1-4a3c2f2e5d7b", "comment": "Malware payload (Mirai)", "value": "889648ff2939921071925b0b2da652784e939fd3b42e6c775e2fe7644a83cec7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288710, "uuid": "ae14a2d5-290b-46c3-86af-ed5726bde364", "comment": "Malware payload (Mirai)", "value": "8c153d3b1d8d94e19689e9fc5f88e6e3d08e7cae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288710, "uuid": "9421e568-7358-46fa-9b11-4043c6e49abc", "comment": "Malware payload (Mirai)", "value": "fe6bf58d1b40647e3ee579cadbb7e531528f0c61343f807ced448ec92e82ecd2f8dbaf18aa52a6f28b7cce873dae0bcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288710, "uuid": "09ef232c-c52f-4169-8495-6a4451a0c8b3", "value": "T1ABA32A8ABC85C712C5E1A1F6FB1E51CD371643B8D3EA7147CD18AF29274B86B0A3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288710, "uuid": "f9d9a4c4-1e8d-4261-8cef-984cb06a43bb", "value": "1536:LgfDmCmJdmkClJIaa4LcJeixckhR4xkbJQ5V689U8MDa0vUn4b+R:LgfDvgskYJ5oJxxckhR4yJW6UUGSUn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776288710, "uuid": "29afda8c-582a-4192-bce6-aabebfd8c5ce", "value": 103820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776288710, "uuid": "7623e129-1d83-4f5f-83e9-279167e01319", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288710, "uuid": "f59c5a5c-ab74-49d6-9064-1b5022d55f83", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61981447-38c2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirax)", "timestamp": 1776254293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776254293, "uuid": "b33ddbaf-eaed-4643-983e-30a90ca27267", "comment": "Malware payload (Mirax)", "value": "e443f9beb0fcbf496e3afb45bad28bad", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Mirax", "colour": "#EA30CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776254293, "uuid": "2ed8dff3-4fb3-4ac0-b6da-794cb161dd85", "comment": "Malware payload (Mirax)", "value": "88e6e4a5478a3ee7bfdfc5e7614ae6f3f121e0d470741a9cc84a111fe9b266db", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Mirax", "colour": "#EA30CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776254293, "uuid": "0836407a-88c4-487a-96e9-d581dbbd880d", "comment": "Malware payload (Mirax)", "value": "dc426f04cec865ff475055b7019ffe1201d8eab1", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Mirax", "colour": "#EA30CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776254293, "uuid": "e3635f4a-5576-4b6e-80b0-533195611a7d", "comment": "Malware payload (Mirax)", "value": "579f5fe59b572588fc23455710168c2d64423c372be8c4a1902de9baa85ce99f4693c0739acc93127deee06d6b2f8df1", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Mirax", "colour": "#EA30CB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776254293, "uuid": "b8f2eeed-4310-4b6e-9015-d95b3e05e8ce", "value": "T10CB60286FFC5D95AC4F3473289B6927141474D268B83CA875E58763C18BB6F04F0AEC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776254293, "uuid": "76bbec94-64ee-455e-b127-79a98d1ac0db", "value": "98304:8RlyHmPQG1YoTwrAeTh2pBddtcXE3585HZgxPkUz199qZiUg+W2KLuveqlKS85zN:MUHmoG1ogRwipNh9u/vea+zKUJRYSa+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776254293, "uuid": "18dc03ab-2b2e-4465-b3a3-e7cfde4c00d1", "value": 10491731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776254293, "uuid": "aad4fdf7-d5d2-4a68-9217-e6417098ecc3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776254293, "uuid": "abfb5d69-6825-44bf-b9d1-5d46b9a54af7", "value": "88e6e4a5478a3ee7bfdfc5e7614ae6f3f121e0d470741a9cc84a111fe9b266db.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab18953-38ae-11f1-a769-42010a9c0008", "comment": "Malware payload (PureCrypter)", "timestamp": 1776245772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245772, "uuid": "a33dad06-9eda-4175-82f1-b704a43516a8", "comment": "Malware payload (PureCrypter)", "value": "da7f96f81de79815fd51884f453fa9cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245772, "uuid": "9bad25f6-cff4-47df-ac79-559f7006ab88", "comment": "Malware payload (PureCrypter)", "value": "88e9fddf31ff59fc486dd61bdefb8449a3deea14dedb71831034e586b0679827", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245772, "uuid": "33676fe9-f68e-4bc7-ba2d-23a7c9000919", "comment": "Malware payload (PureCrypter)", "value": "ecd5807ff3150131088058e41db2955b7e7ad8fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245772, "uuid": "f319fd5a-53c6-4409-9459-627988260276", "comment": "Malware payload (PureCrypter)", "value": "1311c15a0dfd187e31962455b86abf7ae19e09b4d647b878237806d4f7a948fc8065271276efe74688f04d8131a7d0c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245772, "uuid": "61f3236a-eb1b-44c2-93e0-bb7047353066", "value": "T1C4A3A8A42AA88C1FF3F06731575DD1160906ADA5F49C573930963A39F670284A82EFFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245772, "uuid": "8d588984-814a-465c-8eec-59ddfbf071ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245772, "uuid": "e77f67c0-f02e-4496-a454-7e2e02dc128a", "value": "384:CPr/dW82EljzexuXK4oceN3xX20nr6X0iZhe6/QEX4wjjImnN/:t96uceN39Fnr6X0QgWX4w1N/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776245772, "uuid": "1aed1091-4a01-4199-ba0a-2bccc5226b30", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776245772, "uuid": "920dfb47-727f-42fd-adce-c9d179406a41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245772, "uuid": "78eae217-7177-4408-b7d5-c3e5dfa23997", "value": "SecuriteInfo.com.Variant.Jalapeno.20291.46456925", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5ce357-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776239678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239678, "uuid": "71ec057c-1e87-4898-b13b-3a961c06bfcd", "comment": "Malware payload (ConnectWise)", "value": "9e001eb3a234f41a83bf9c18c51afb55", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239678, "uuid": "6b7098c1-347e-4f58-a150-8bfd64118cbf", "comment": "Malware payload (ConnectWise)", "value": "8981cf71ef3bff3bb3c49c49e8a2312c4f78b4a10a748c342074142d4ee0180a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239678, "uuid": "a348d77d-308e-4bc2-b832-6829f1e04134", "comment": "Malware payload (ConnectWise)", "value": "3d1b290149dd7e36f1e4058cded245ed47c0c7ab", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239678, "uuid": "a619ec2b-c827-46ac-8753-bc76b9d6e3f1", "comment": "Malware payload (ConnectWise)", "value": "09974bb5c056e873719fe4e0c19410bb00c80ca1c12528ef35d6f4dfbdac604e35982e158d812e5df58cee1af1711ff1", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239678, "uuid": "55978de3-0cd9-4abf-a5ef-f1acce618daa", "value": "T1148152CAAA07523495720617892BA83EE7F01637572014A87DDD48849F7536CF3E22EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239678, "uuid": "43cc37d4-a6db-48a6-be1e-eb9c5bfc3309", "value": "96:9nJOLOKGU+oKquOOEflhGx3/xGAzOyc//OXD/BDFj:9ngLBKp4M/xZQ//sD/9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239678, "uuid": "7f4285d2-6d5c-4bbf-bb1d-badbc50d506c", "value": 3882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239678, "uuid": "e1c73720-f22f-4230-91ae-143c0879b76b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239678, "uuid": "e0194ff9-1560-4419-b97f-df8674c538f0", "value": "Installer.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06aa413-3921-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776295308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295308, "uuid": "61b88053-53e1-4898-ad23-0c720a9d795b", "comment": "Malware payload (Mirai)", "value": "c4aaef15343feb4d9270f5148359cc0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295308, "uuid": "8ed0565c-1dff-42de-be75-764ec80c0966", "comment": "Malware payload (Mirai)", "value": "898b9114e3c744efe250c6b43f554504f448ee0c0e09097037057834128c6eec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295308, "uuid": "6b56683a-47f8-4a76-9e77-2fdef15a9806", "comment": "Malware payload (Mirai)", "value": "1438eeb5011c2089b6df71179a64d7a3eaf258a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295308, "uuid": "f0bd8127-bca2-453b-b25e-b55a46c13f3c", "comment": "Malware payload (Mirai)", "value": "57f51fc9bf77119d0e99e6de0cee7730376105c7a1963fd47b8d0824bf2620252c2dd65add31a10212e9d3250011402e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776295308, "uuid": "602f9ff7-53c3-4bd0-90a0-30a2ee0b7ed8", "value": "T132C34B1774C1C0FECCEAD1B88FEAE126DA73B4295134B21E27D46A261F5DE205F6E610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776295308, "uuid": "124b006a-a345-407d-b628-ee0c24258ed5", "value": "1536:sPYZ7qo81LlymV6fC4axMvB61ce5XjMiE2b2xW50N1MwccxF3z:sgZ7HMAJaxM81ce5XjM2b2xW50Mvcjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776295308, "uuid": "002c3c0e-72ee-4caf-9e0b-03cee917295a", "value": 123464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776295308, "uuid": "1fdc221e-7889-4c18-a9ad-9a3a9169a1a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776295308, "uuid": "5dd391b6-4013-438e-9a84-404846ccd872", "value": ".Sassy.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f07bbc45-38fa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776278585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278585, "uuid": "738e08ae-cc87-43ba-9a54-e7143c096dbf", "comment": "Malware payload (Mirai)", "value": "3f905c10f57142156b9848b20b5c281f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278585, "uuid": "6a72beb1-62b2-4f0c-83fc-7f4e3f15dfc7", "comment": "Malware payload (Mirai)", "value": "8a483435352aef1b8f9a0d15559c65ea017985ad17d46b14f2008801e0ca6bfb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278585, "uuid": "d548e087-1ddb-46d7-a91d-ebdefbbb0ea0", "comment": "Malware payload (Mirai)", "value": "5c162e663e8e1d041bd2ea41dd64467298ba5592", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278585, "uuid": "01746370-9fe5-4e5c-89f2-ddd3557fbf62", "comment": "Malware payload (Mirai)", "value": "62b2cc6cde0e7f08143a220b457d4252b6dc30a0c4895b793946275f80cc5f636b3026d353b0c57be2bea762308f96ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278585, "uuid": "7a54b211-1c10-49e4-89db-06cc3d4039ec", "value": "T1EC534A02B31C0A43C1A71970293F2BD19BFBFAD122E4F689251F9B969671E335485FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278585, "uuid": "a34f5e44-9d4e-4e33-8e17-67936377eebd", "value": "1536:8Mp9lKxanh3KS5jc0ujthwtvlIWhaJ3akl:VhVRKS5jcRjAlIWaBaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776278585, "uuid": "6563a292-044b-483e-81e1-131b50b3d767", "value": 63208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776278585, "uuid": "c0409353-a5cd-456b-b05d-46d917eb5e6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278585, "uuid": "2bb33a9c-b6be-4283-a83a-cfd271a62877", "value": "FGx8SNCa4txePA.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "327c9245-385e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776211265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776211265, "uuid": "2123ae01-6eae-4068-b5ac-25eef5badbd3", "comment": "Malware payload", "value": "d53a4044787007f25f804c4a19d1f096", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776211265, "uuid": "3f8bd622-77e4-4a29-985d-48ca5ae20a35", "comment": "Malware payload", "value": "8ac11d5521d22fc6d486457418ecfd866f8d3c4528cbb22438b966cdc2600402", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776211265, "uuid": "6ffd16fe-bc42-4380-98bc-94c54c388965", "comment": "Malware payload", "value": "ed5877708cb88aa49a52e963e511f7b547f131a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776211265, "uuid": "4a8dccca-72e3-400f-8aae-2794cc910a5a", "comment": "Malware payload", "value": "328cb407c27bf9725fcdff28c38f6290cc29d704f13f72b8020ae6ead818b686c8c69d50682f3509eaf90560ee1a2488", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776211265, "uuid": "769714a8-ea8a-464b-92df-8bcafdda1ffa", "value": "T1D4357B83E7A385D8C116D9B5534BF137F9627C8E4B153197ABC41E633A67BA4E22CB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776211265, "uuid": "a8079652-0f11-4fe9-9a9c-4f6fee09868e", "value": "73f461c771aef77ec43d53a0c54f0c8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776211265, "uuid": "561fd8a7-0ff2-422c-a470-bf653a0dba25", "value": "12288:/bs/m0E54jwaFXGc8lEBBBHGBKq2IZwDyvfqItNqdg:/bOVE5ifGPRZw+vf3fd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776211265, "uuid": "cb61ec23-431f-4f80-a142-54d6f7636745", "value": 1139712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776211265, "uuid": "2f920b8f-4feb-4acd-8f71-11830e08fa04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776211265, "uuid": "41e19abc-bcec-45e8-b23d-7d24687aed17", "value": "SecuriteInfo.com.Generic.Dacic.11262.BFF78FC1.29221291", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0144514b-3898-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776236093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236093, "uuid": "d2677681-d33b-4566-9819-b10e93478098", "comment": "Malware payload (NetSupport)", "value": "f891f745d5fc8348819a16e94f9e61f3", "object_relation": "md5", "Tag": [ { "name": "5-188-86-165", "colour": "#DE80D8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236093, "uuid": "aaa215b2-0ac3-46d3-99dd-3bcb6d1fd25a", "comment": "Malware payload (NetSupport)", "value": "8ad1b095c37d777e7388ee4d37f3534fdca3891ce02be8002fbd0a50db9b5653", "object_relation": "sha256", "Tag": [ { "name": "5-188-86-165", "colour": "#DE80D8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236093, "uuid": "748e6305-c2ec-4cdb-b867-7666d7eb704b", "comment": "Malware payload (NetSupport)", "value": "52cc87abf7387aee427689d8b6d1acc3cad32a68", "object_relation": "sha1", "Tag": [ { "name": "5-188-86-165", "colour": "#DE80D8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236093, "uuid": "d811d9c1-0bbb-4917-806e-f2044d0ed669", "comment": "Malware payload (NetSupport)", "value": "ca29e850ba19ef7c63fcccbeb8f9fcc81d83d339c3a0019e2113dc4f9a9abfcbe0b609de396f751d8317d187ed665c98", "object_relation": "sha3-384", "Tag": [ { "name": "5-188-86-165", "colour": "#DE80D8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236093, "uuid": "2ffe0fc6-b96d-43ee-a71e-03178e01739e", "value": "T192967CB88B84975EBE6E1A07E078571E67F37F26D09271FC5A62370B226FD085239C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236093, "uuid": "9d4aa240-6994-4907-ae2d-9c254e15973c", "value": "49152:2OTV9JJl7k1IvBaA1UzZtfLXiKKuaRGw66w7b0AIMsvqU4qLEUCONM3aX:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776236093, "uuid": "a053c8a7-4d4d-4dc5-b2ef-1a7689d1d39f", "value": 9412075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776236093, "uuid": "a6d70b71-7c7d-4a26-82ff-f959a2e8a461", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236093, "uuid": "9446abeb-caac-4c37-9dc7-680a608d775c", "value": "isgsofgey.com.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba5353a-3921-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776295005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295005, "uuid": "1701d4ea-2759-4458-b84c-72d22fc1b012", "comment": "Malware payload", "value": "6b7c093f5e213d871579de023e567b31", "object_relation": "md5", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295005, "uuid": "a18bdd81-6120-480c-aa6a-bd5c83ca6738", "comment": "Malware payload", "value": "8af226c0aa71fefe5228e881f4b5c5d90a8b41c290b96f44f56990d8dc3fac1c", "object_relation": "sha256", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295005, "uuid": "0796aa91-343d-4878-9fd5-d7dd8eaf69e1", "comment": "Malware payload", "value": "8a3a2d73ae86b9dde16a521ae55b3d4d1cc600d7", "object_relation": "sha1", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295005, "uuid": "a701efae-9ec6-407a-bb99-c3f12e8ea0eb", "comment": "Malware payload", "value": "867f8f0cb5805a149a2bce8e73bdf192e4d110a612da42605fb757f32f0ae862b53f83e73a6eabe7913ae8e45ee2105a", "object_relation": "sha3-384", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776295005, "uuid": "072b0a1a-ff28-4a28-a894-fa089143098a", "value": "T1ED77239451B91677CEAF7AFBF1C1A2A25DCDDAC69E207D2A082C27CE4C630B04BC551D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776295005, "uuid": "43262908-d1b5-4802-8c45-0b8ab7ef776c", "value": "786432:dCs/wUkt2lz2El5sJ6Xc368u2IIlbc4v79X4R:dLIviYJJGURIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776295005, "uuid": "23ade33b-29a8-4ff6-ac4e-d62239b77941", "value": 33175325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776295005, "uuid": "d70d4f0d-e7e6-4c12-b6fe-80b3488c3a3a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776295005, "uuid": "9077c446-243a-4515-85c3-bfcd7263b5eb", "value": "node-v22.9.0-win-x64.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "897536f4-3912-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776288720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288720, "uuid": "82b87cd6-fc49-4706-93bd-7708866b19fa", "comment": "Malware payload (Mirai)", "value": "d2ffb0b432df7bd318a4ec30a50a0ad7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288720, "uuid": "ad0ec897-dabf-4bcd-99de-ad5688cbbc43", "comment": "Malware payload (Mirai)", "value": "8af3bba4ba06cf7fde6e50a4a1312f3acc9975e5c6b078cad8a98c8fc8915e36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288720, "uuid": "b7dc7b8b-61f7-45af-a141-a4c4932fcc0d", "comment": "Malware payload (Mirai)", "value": "8bcbead3ff68364dd81496d263b8f98f79506b7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288720, "uuid": "f69d601c-0cd4-4820-a1de-2f0831caec3c", "comment": "Malware payload (Mirai)", "value": "ff720ed7bf0e390bb226b5ee458037a5fedf6e69b24bf8d3419f5a12bb119fd728b5a0aea48541d7bd35b0a8f47cdcb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288720, "uuid": "183dda4a-3371-4b60-8a8a-294dae8ce515", "value": "T1A9B32C86BC81CB11D5C656BAFE0E61CD33134B78E3EE7213CE185B2D674A86B0A3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288720, "uuid": "94caa444-ca57-421f-9fbd-49e36d341d08", "value": "3072:m63++Z5HzFxEYaflS4iDPhzIRzWo3aJf2MR/uE/Yfcn4:DzFISxDPhzIRp302M1u+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776288720, "uuid": "2cea7e17-e33c-4865-86be-17ac040d0b42", "value": 107900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776288720, "uuid": "2d5e8f0a-0d27-49ff-98c7-fde490b133bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288720, "uuid": "12e7c7ca-cbe5-46b0-9ddb-a1793bf44774", "value": "splarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79334d18-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776239730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239730, "uuid": "f6bb884d-1f33-4f65-80d8-b7a917a8b96e", "comment": "Malware payload", "value": "72f8fa16da72948b2b375e57659a81e7", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239730, "uuid": "a115de6f-6df1-4760-9f7a-f0014ee03d36", "comment": "Malware payload", "value": "8b27ff0aafd2226737d967e1aa25e9b9aa4ab64ecea4d8f1bfa2e1625e54c0c4", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239730, "uuid": "8cbb6ac2-2296-4956-8e72-db2bc21ffcd6", "comment": "Malware payload", "value": "bcbb0a3cfb112c2f94eff3acec5a8b7c1ad57bd5", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239730, "uuid": "5a049420-d28e-48e9-af65-3bac80db957f", "comment": "Malware payload", "value": "b85727a0e00f8f66d6c7f6a1ba57a7c829ffe8b2385a96f4f9b5bdd0748c2ac47b4dad795c4498be7052d3f06b1a0187", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239730, "uuid": "f561fba7-d0bf-45f7-9310-9f11f2b3ece2", "value": "T1E3D52893C6E66E371A12436FB4545F723A0D03A4D124CEC1AD888BFA1CF71E6DBD4A61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239730, "uuid": "a177c8c8-cc12-45e6-a3ba-39584e030c41", "value": "192:NyxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxZ:/2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239730, "uuid": "99daf265-aa8a-42f2-b964-13ed446ff24f", "value": 2937218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239730, "uuid": "7bd22779-336f-4e04-84c0-cbf25248a15d", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239730, "uuid": "cc7de658-7f42-4ef5-80eb-3e55855d66e7", "value": "Inward Remittance Advice_confirmation.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b51e0a82-391d-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1776293518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293518, "uuid": "b810c681-2fbd-453d-89dd-b7e5585f2385", "comment": "Malware payload (SantaStealer)", "value": "b25dda7ed07903a9880fdf80048cd22b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293518, "uuid": "716f3c34-18f7-49f0-8868-ef6e17fccbbf", "comment": "Malware payload (SantaStealer)", "value": "8be0e9ec635bbef3b04d026792d4d5b5e17d5e50702d99d62a109fc66ac96679", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293518, "uuid": "7dfb3544-fbec-4245-9c12-81c8b5dfbc05", "comment": "Malware payload (SantaStealer)", "value": "83a456c719c792970755a61db7bf43135d7cb2e4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293518, "uuid": "3bf9375f-6e85-4a9f-95be-53d49a30a82a", "comment": "Malware payload (SantaStealer)", "value": "9a4fbbd01a6ef4de26f1a660bc0bd6d9279ee307099891111fb54975cade65924b13a6bb97a33a945627e6c123296e9b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293518, "uuid": "ac8e4289-183f-42eb-8eec-82685e7613a1", "value": "T1C7269D27F2D260ECC57BD1F0A787A272B938F84B0035FD2A45A4C7213E66E605B9DB54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293518, "uuid": "fd791559-e372-43a2-ab3d-58222cb1390e", "value": "ed6edba9ec77ed904b0920d79686675c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293518, "uuid": "b7d46114-5b5f-4938-8f19-80a666c40a16", "value": "98304:NJ69mv0newpgGQvhAWN8uqj1LlEtSNnboiKoFcumTpRgNxMUB:NUcRhzgp/QoFcuoRgN9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776293518, "uuid": "fc1f1cc8-5aa8-4d70-b485-b07bb27d01b0", "value": 4511744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776293518, "uuid": "e9929cc6-e86e-46ce-b002-b1ff0421152a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293518, "uuid": "fb193371-2d29-422a-a010-6fd0926107b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "232b8cc8-389d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776238297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238297, "uuid": "91cc7b86-f7f2-4030-a97e-12c2d5ab182e", "comment": "Malware payload", "value": "a322b34727d452d2fb07385545dd16f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238297, "uuid": "18cd9e9c-7cd2-4ce7-9ec1-f4e0e3d80945", "comment": "Malware payload", "value": "8c6816642a185bc540cb57873c48ea715c899be104e81ed23036551fefd4c160", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238297, "uuid": "966801de-0573-4c1e-b1da-5181dbb60d66", "comment": "Malware payload", "value": "70179f1dbea92c07eb1548080fe6bc8a525e687e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238297, "uuid": "c24cd601-aa5f-4d5b-9781-c0c963b36044", "comment": "Malware payload", "value": "40c5119654527b14a56907cbd73a292658b3d0f3366e7658a46e7b57dc5784a7c8a6d8376038cb22fb69e098df605d75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238297, "uuid": "4471df92-2e7b-4dc8-9212-aba81ae6d534", "value": "T13A54C7243BFE4419F1BBAF765BF475968E3EF6A32A03955D0491034B0A32E40DD91B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238297, "uuid": "1953872d-c407-4e71-96d3-b3cfc5fe0bef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238297, "uuid": "4935fba5-e6ce-44d5-8f08-89671f93cf46", "value": "6144:H9olYc8M6zvISu2WgXY9SJb7Z75k6e/i8:elYfMg/Xzld66e/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776238297, "uuid": "c17c1c86-7be0-4c86-b6b6-db52290e3ffc", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776238297, "uuid": "c770f689-92f7-485a-9c18-814a90c0040a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238297, "uuid": "b21b8405-5eb3-4408-bd7c-bc4cb5f0ceec", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d169b65-38bb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776251306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251306, "uuid": "d6f9e6d2-62fe-4f42-b37b-d372cdb071bb", "comment": "Malware payload (Mirai)", "value": "9bfb1c020fc94d422dbd533ffc04f667", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251306, "uuid": "8effe145-d607-4259-a6f3-c16b688d5e41", "comment": "Malware payload (Mirai)", "value": "8d2722c00797ae133d1ed025c67d65c711ee1e2e0a094781c8c6b8e64ce5306c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251306, "uuid": "3ddaebd6-eabf-4ee7-9a08-f1ccafff928f", "comment": "Malware payload (Mirai)", "value": "fb08d32c0b6e19471edd789bb8a3b63696b0dd14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251306, "uuid": "146d6d16-65ae-43c8-8944-e7861f93ecb0", "comment": "Malware payload (Mirai)", "value": "8813bc43e9db925f9c77dc87dba2fe088d644d0fadf1c50a5b90a5ade425300c68708e5fd804e6888182778d00bea880", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251306, "uuid": "56027093-3b5f-4237-881c-8d2b1ebe7afa", "value": "T16EE34BC0A643D4F6ED5601706137F7374B32A07A512EED83D7A89E33AC62950D91BB6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251306, "uuid": "55614dea-431f-432d-9a22-784049eb08a2", "value": "3072:v43S/I559CqfdWLpFkiGF1ZawvxeCgAWV+/7zeHk5Q+Rgkc8hf:vgSAlCqfdWt9GF1ZakxenAWVJh7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776251306, "uuid": "b5a29559-80db-441b-928e-6f3fd1c6cc33", "value": 145768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776251306, "uuid": "6106f519-b5c8-4a7d-966a-579d616f4227", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251306, "uuid": "ca3de40f-cfa2-4098-ac12-d5e9cfe0dd6a", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "777e3d88-390e-11f1-a769-42010a9c0008", "comment": "Malware payload (SNOWLIGHT)", "timestamp": 1776286972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776286972, "uuid": "7b559e5d-eda5-4dc2-a9ae-3eca5a54c34f", "comment": "Malware payload (SNOWLIGHT)", "value": "785c06cbacc0ace07fa5683e6f4aa6e1", "object_relation": "md5", "Tag": [ { "name": "38-60-253-35", "colour": "#3E21E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SNOWLIGHT", "colour": "#36607F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776286972, "uuid": "49a41861-c34a-4290-a331-65481ab0628f", "comment": "Malware payload (SNOWLIGHT)", "value": "8d52016d33545820b8502dd467e600be42fe0f95d990f0bc0316d018da3d8566", "object_relation": "sha256", "Tag": [ { "name": "38-60-253-35", "colour": "#3E21E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SNOWLIGHT", "colour": "#36607F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776286972, "uuid": "a8c9d016-0d8a-464b-81c7-2affc58ec8a1", "comment": "Malware payload (SNOWLIGHT)", "value": "50252a99903019566bd83f66b72dbc9818799750", "object_relation": "sha1", "Tag": [ { "name": "38-60-253-35", "colour": "#3E21E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SNOWLIGHT", "colour": "#36607F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776286972, "uuid": "7a7f5205-20bd-4808-9a1b-f1691089da0a", "comment": "Malware payload (SNOWLIGHT)", "value": "3c1ed675605e04af566f4eef732b158c5672e937868872b25aa27d2d0b04e261fee31fc2be071402c9bcc8c5948dd6ed", "object_relation": "sha3-384", "Tag": [ { "name": "38-60-253-35", "colour": "#3E21E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SNOWLIGHT", "colour": "#36607F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776286972, "uuid": "eae8833c-b482-4514-b611-0950df6757ed", "value": "T13C92290EB39364FCC61AC53888EF537AA7B5F42656961B251738D3313EE0678AE39148", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776286972, "uuid": "8091e11c-745f-43d3-aae9-55bd0ad4abb3", "value": "d1a7d73e0df819af6a00778362f2c567", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776286972, "uuid": "b84a8c6a-d302-463a-8398-e457bb903306", "value": "384:ELZynL9R9f8LGQA0XSFGzhxsNXG1qw1qqjcMcdrxUhlps:E93LGQAfqD0XG1qUjcMcdr83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776286972, "uuid": "0f4744e2-70fe-45d3-9e82-c4882595e8ef", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776286972, "uuid": "0ea9a5d9-cb1b-43fc-95bb-bc35d5d32d8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776286972, "uuid": "83c3021f-06d5-4411-a249-34cfd26845a9", "value": "loader_v2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d12b5af-3865-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776214342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776214342, "uuid": "13abb0d9-8527-4927-bdbd-fcb7e3e3be35", "comment": "Malware payload (Formbook)", "value": "2ca8e5c25d45a71c31c64d49e8971a5c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776214342, "uuid": "011fe3b6-2b8d-4acc-8124-0241f86558ad", "comment": "Malware payload (Formbook)", "value": "8d813d5d24a74b6ccdacffec91fae2e003e96bcffeaac2f8156c3ba8d34f489b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776214342, "uuid": "5c1c1ab5-6527-427b-8c75-56a068145053", "comment": "Malware payload (Formbook)", "value": "aa693b4279f3f7937d7cef02ee69e6edffbbe3d1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776214342, "uuid": "b94e5b9f-f171-4c26-a3c7-79a2ec2cc95e", "comment": "Malware payload (Formbook)", "value": "2b93b5f047e573b812e68cfb2f0a3305fdaa1e4f9e4b2afb53f80319dac3b5ca3a7fb56367776697e33a2ac7bde0999c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776214342, "uuid": "34376048-e6a7-4f9a-9d6d-7699c5ffd219", "value": "T15F25334488BD239FB62C7C9542E8002F5129FB4F8F66FD34355AAA465A37094EC6C33B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776214342, "uuid": "a12b1e0d-7469-4f17-913c-535efc6065b0", "value": "24576:D339kDHq5pEIyj6qcyJ/Q4hOkBv24zcLP9:b6TypEI26ryB1OkV24zcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776214342, "uuid": "93709ccb-8917-4ceb-a24c-88d8b5b6c1cb", "value": 972820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776214342, "uuid": "f7a6b0b2-2a6a-47e2-8601-38dff545003a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776214342, "uuid": "a18e99cd-7b32-4c96-971c-92194d944149", "value": "request and questionier with collaboration.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f41a644-38a6-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1776242371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242371, "uuid": "624ef93a-9f91-4f03-8e86-a35036b817df", "comment": "Malware payload (SalatStealer)", "value": "ced048238c36e7a7db0a40c6b5896c72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242371, "uuid": "a10bed78-d45a-4d8f-9ad3-b98504faedf9", "comment": "Malware payload (SalatStealer)", "value": "8dbfee40c640c8b38a30623029cc4a23e332bb94c56be2e349001f2f6f8bf845", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242371, "uuid": "d0af2090-4222-4f92-95ad-10d6c0c33bd6", "comment": "Malware payload (SalatStealer)", "value": "aff5b9ef738acb5e1c380c6e793cafeec1ec0b08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242371, "uuid": "4cdc1769-967b-4140-ad5f-e9a0d2fde138", "comment": "Malware payload (SalatStealer)", "value": "2f25f40fa34367d51a429c141917a009c723a67b7998de8332e9f1635ad0de30807e513e26d06e3c6a0e375b9b733c4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242371, "uuid": "906a438d-3b3b-4a0a-a6d6-5f9668c10760", "value": "T142F5330D04AD03D1F2E54F37E5671B06E1DDA33AA7A9A4FF695986440F0CB9818BE0BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242371, "uuid": "fdf26c63-aea9-4899-81af-0eee60db8612", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242371, "uuid": "9c055337-cba9-407e-9c56-0565b4b5e9ad", "value": "98304:tJ4KWfVI+OPqfTG0RgAM34t4Hg8O/mkBDbMsMR:tqfI+fTZgP34Ubki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776242371, "uuid": "23433ece-8aee-4ade-9306-da6d2d58c7f9", "value": 3593728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776242371, "uuid": "9c8162c1-0e4d-426c-bfe3-5632c97caa53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242371, "uuid": "0e76e5fc-78f3-462c-946b-2daf1dfc8aed", "value": "SecuriteInfo.com.Trojan.PWS.Salat.390.22539.16092", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f980a434-38f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776276023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776276023, "uuid": "a6e82c9d-385b-4a0a-81b9-caced6c118f2", "comment": "Malware payload (Mirai)", "value": "c9ebdb73aede3892675038513bd8e565", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776276023, "uuid": "9b6e1bd1-e7eb-4e82-abed-fc2f5747522f", "comment": "Malware payload (Mirai)", "value": "8edfce10b660cdbd7382fec9f1c8ec87ad88ba672f62d7571a1f1f025212c0c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776276023, "uuid": "b37cc4ea-39d7-4a10-8749-f530fb9ec6c3", "comment": "Malware payload (Mirai)", "value": "36c3d38e16be7e1593679c176cb2a4e3a46ca8a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776276023, "uuid": "f724b330-88a3-4618-884b-9ba47196b599", "comment": "Malware payload (Mirai)", "value": "346562239e373bcd92235b0afe9143916d796d8d4f5108da7732365cb173836994fde6730412227178f30d852a88f889", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776276023, "uuid": "c614fbd0-81e5-44e2-876e-c2b8b846e3d0", "value": "T1B4B34B73CC252F68C665D6B1B1B08F79AB53996080871FBE1977C2788483D8DF5463B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776276023, "uuid": "de9a5036-2548-4c62-8b7d-21483f9564af", "value": "1536:jYrGNO0ep8xCoKZ9wT7DnBVco1x43TlWL3YPAsqxccX1of:Y0s8xGZ8JVceCJWAAsajof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776276023, "uuid": "3bf5ec76-eea1-4ca2-9692-076f75ac14ab", "value": 109152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776276023, "uuid": "8e6c6d1f-2a5a-460a-9501-2b4f39793540", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776276023, "uuid": "b8194c0d-e189-47ab-a9a8-d8ac4b8b3e7b", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b7542e0-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (N-W0rm)", "timestamp": 1776239653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239653, "uuid": "8d694464-9e9a-4421-9098-67fd52c1f872", "comment": "Malware payload (N-W0rm)", "value": "15817e3ef9b2077637f2d5eb68c12618", "object_relation": "md5", "Tag": [ { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239653, "uuid": "4f6643d2-ac1e-4797-a67c-ee7cd1327572", "comment": "Malware payload (N-W0rm)", "value": "8fbc6e130495a84791fe0fddb2f49e158b52a2fa3207c58c8576b79be40cb1df", "object_relation": "sha256", "Tag": [ { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239653, "uuid": "0fd0c8a4-7bac-433c-9b90-77d6d4e1264d", "comment": "Malware payload (N-W0rm)", "value": "568ee387e33b793b13c0c84129864f9d47313653", "object_relation": "sha1", "Tag": [ { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239653, "uuid": "8c8082cf-78fb-4e7f-a5e3-63674c8c5ae1", "comment": "Malware payload (N-W0rm)", "value": "f1997138ca74534a490c3c0dd94bd7d9d61f9ee1bc4b63370ac2b5ac43ee7a4abd232d75b75c2dd82fdabe9f6dc94d25", "object_relation": "sha3-384", "Tag": [ { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239653, "uuid": "13546829-a780-4156-ae2f-d01409fb15a7", "value": "T13E246B163BF9D908B7F38E8799E6B0AF1A3FFB612D15D60E33840B4D057421095A17AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239653, "uuid": "edbab4c8-fae8-4c28-a7ad-53c3d97af90f", "value": "6144:6AXJpZTWBoNyxfisCXnzSFlc0bVq+MI4N154WrrBn4f:6mJDTUocxffCXzSFlc0bk+2N154WF4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239653, "uuid": "b3cddea5-5258-455a-9c2a-39b36e372672", "value": 220120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239653, "uuid": "e936ec56-955d-4e5f-a2ea-2054518264d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239653, "uuid": "96a5bc87-3d91-498a-8e58-07548803385a", "value": "Listas de productos.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a465d3-3923-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776295902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295902, "uuid": "f37cc38e-42de-4230-9ab2-c4689a073c74", "comment": "Malware payload (Mirai)", "value": "d66d05088e96835042e4d2ee8c119390", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295902, "uuid": "5bb1638b-b9fc-4aa5-b296-f8031a768bf6", "comment": "Malware payload (Mirai)", "value": "8ff4e5c0dfd0c9698cd2c44925319095443ccdffd286e383e10c05819cceeed0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295902, "uuid": "776cf177-8735-4592-989c-cd9289daad3b", "comment": "Malware payload (Mirai)", "value": "d3b725eb342f69d3602172a93c518234c9d6b889", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295902, "uuid": "647b1f70-4020-41e0-90d8-c4e87887fdd1", "comment": "Malware payload (Mirai)", "value": "2c3f97f8b3eed17bbcd024bb1b3c2fcf2b6197f03bfcefff41a0d7021799c09db92f4ab8291066aad47c8cbc6808fe95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776295902, "uuid": "0f52adaf-ea23-465b-a35a-ce2a98eeacba", "value": "T189F33969BA0F6C41F2C2C3F8DA8C87E13E1735E3C67B8DA1790152EDDBA39D95980512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776295902, "uuid": "31573f04-08df-49d8-9194-b4b5889a5859", "value": "1536:WZp34PkF4G/2r07HYXh5B8yOlz29b1X75J1+l50VyBIRM4QEn5p5M/LW:i3AB8yAMR7P1+/0Vy+RM4Qxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776295902, "uuid": "9a2163dc-a75a-4d5b-9500-b587e81b76ee", "value": 157544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776295902, "uuid": "43ab0058-c8e0-419f-9281-2ecaa170ae3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776295902, "uuid": "61029b24-6a03-49ed-8622-67c0ec3c91f0", "value": ".Sassy.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c08ee4a0-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776239850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239850, "uuid": "762bbc61-01ee-4ec7-a145-2549b842fe0c", "comment": "Malware payload (Formbook)", "value": "1aa48d4aad782fdc284d1c071d91478f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239850, "uuid": "c835ad6a-1517-4c18-aea7-61bd6acc8a37", "comment": "Malware payload (Formbook)", "value": "900056b089817031ccd3a8c5ce8e31918584f264c76a45b86c4f15ca9fe2af7a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239850, "uuid": "14ae1e68-c490-4f21-96a6-821846b7331f", "comment": "Malware payload (Formbook)", "value": "5b9073be9335f6c13397f6c69adbed2940bbcfdb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239850, "uuid": "db0e9001-2c6a-4544-83c9-3373c63aaae9", "comment": "Malware payload (Formbook)", "value": "0685f8f1fd44fe062d71d89931178b71e741f4c3125413ff7a1b8177c4d5b6825f619638b1e05f767f7f5f1a40158736", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239850, "uuid": "88b7df53-6041-4bd6-9580-a3d0bf9858f0", "value": "T13C95021589C43FB8DFAC591D40BE160AA3F14A8B501AA58AFB33FD4AFFB7704511B198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239850, "uuid": "f9f62257-80a6-49c2-87d2-a5b3c296a6cd", "value": "24576:vaqoGh9Oa5KxSG8WN9/aM/O6MLurX3u0Na65wVYpGkNN9Ifx7ptRpe4wW2lkzO6X:qLdGqstfpzPj2yNScV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239850, "uuid": "a7aeb570-3672-45f3-aec6-c46f8a4d0f96", "value": 2047494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239850, "uuid": "72456637-b744-4d11-aecf-0252b83ccab0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239850, "uuid": "9f7c6164-77e9-4286-aab8-f92e18c4a939", "value": "OC-28147.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed4dcea7-38cf-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776260111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260111, "uuid": "8bc7d430-9f4a-4842-aba7-c39658cb5b90", "comment": "Malware payload (ConnectWise)", "value": "7cdb2bfa6691dd01df8ed0f254a70d63", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260111, "uuid": "cdf7718f-f5e2-4578-bb31-e7c8bfe53b65", "comment": "Malware payload (ConnectWise)", "value": "90a701b03fa0adc946424c7994fafaebbb2e7b4719321b4bdeff965ab977925f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260111, "uuid": "0f8cb021-4513-4722-be28-c41987ffe371", "comment": "Malware payload (ConnectWise)", "value": "39b1bc833bad7457f2ca23ae034c56cdcb3f81d5", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776260111, "uuid": "43354de7-d3be-4654-88bc-4223a0fb6cd4", "comment": "Malware payload (ConnectWise)", "value": "b6734c0b8934bcdee94f6c31f8e18203b0324f11774872ffaef1c243bda3c822f55809b8fbfea1849ac45ccdfab2f8d8", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776260111, "uuid": "c767a259-f666-432b-b228-623c66602972", "value": "T1AC65011172E6843DE6F61B32FF7A96215E79FD229A30C15E9394390E0D70AD19BB1323", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776260111, "uuid": "0a9de940-5989-4a7f-9ea8-4cbf7e357964", "value": "24576:Led07PGt8MKpSTJinaS0oAPzUffc5LK+oBqzkXatkZdy1B5MAnUUGGu+N2B9urh0:KDt8bSliaS0qajtkZeIAgGuQ2BK1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776260111, "uuid": "30c80743-5974-4a01-af73-eb3f3f053594", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776260111, "uuid": "c160875f-d159-44c4-b2fe-5c7d05724f55", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776260111, "uuid": "9ee626f3-8d6d-40aa-835f-300257e6f907", "value": "SecuriteInfo.com.Riskware.MSIL.ScreenConnect.Heur.30237.16328", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95545f19-38e8-11f1-a769-42010a9c0008", "comment": "Malware payload (VENON)", "timestamp": 1776270701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776270701, "uuid": "54b70bd0-437e-4fcf-8952-81d2f3d6af5d", "comment": "Malware payload (VENON)", "value": "a765278cb7a4a80cbbe0a55c7c068e86", "object_relation": "md5", "Tag": [ { "name": "photgridyelow-site", "colour": "#F94EDA", "exportable": true, "hide_tag": false }, { "name": "pre-planolocal-store", "colour": "#8D252C", "exportable": true, "hide_tag": false }, { "name": "VENON", "colour": "#088B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776270701, "uuid": "95ba9855-5c01-4992-b60c-08ea64e214e7", "comment": "Malware payload (VENON)", "value": "91a54d1d72dadb38f5da5f25121a715f42293487f9079af16830c3e3a6f0734a", "object_relation": "sha256", "Tag": [ { "name": "photgridyelow-site", "colour": "#F94EDA", "exportable": true, "hide_tag": false }, { "name": "pre-planolocal-store", "colour": "#8D252C", "exportable": true, "hide_tag": false }, { "name": "VENON", "colour": "#088B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776270701, "uuid": "40e81cdf-37c7-4141-abf4-9d32aa5b6467", "comment": "Malware payload (VENON)", "value": "03c117641845e82b58d07725cdbb73b9e828b56c", "object_relation": "sha1", "Tag": [ { "name": "photgridyelow-site", "colour": "#F94EDA", "exportable": true, "hide_tag": false }, { "name": "pre-planolocal-store", "colour": "#8D252C", "exportable": true, "hide_tag": false }, { "name": "VENON", "colour": "#088B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776270701, "uuid": "74e21229-ed07-4ba2-91f1-eb9cf4ba919b", "comment": "Malware payload (VENON)", "value": "3aca1650604fb44887f96c41642d4060a1bfb3564526b561db5391bb33977b0bf79b3b28ba04dfa6619aebe1606ed412", "object_relation": "sha3-384", "Tag": [ { "name": "photgridyelow-site", "colour": "#F94EDA", "exportable": true, "hide_tag": false }, { "name": "pre-planolocal-store", "colour": "#8D252C", "exportable": true, "hide_tag": false }, { "name": "VENON", "colour": "#088B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776270701, "uuid": "2f696d9b-6a4a-46bc-934e-577ca136960e", "value": "T1DFB633DF8012BDAEE83E7A467B1C86E441D493A336C914435DA84E014F139D6FF19EBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776270701, "uuid": "9cd46b8b-c24e-48eb-a4e8-16d30e106f7f", "value": "196608:3MzFoyRou9R9E2pstETx3ydsDBjMUdRrQ+l6KB+YVOmZLEh0lp8Da1jrV5J2/JzA:3Yo2dL9HstOx3EsJ3jr16KB+4Xa8sA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776270701, "uuid": "c3a6f67c-b2f0-43da-8eb9-2ac102915eaf", "value": 11418835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776270701, "uuid": "41bddd83-5cf5-4f25-8c19-4924d6249ec9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776270701, "uuid": "d51dedbf-3a35-492c-a299-c86014ffe806", "value": "91a54d1d72dadb38f5da5f25121a715f42293487f9079af16830c3e3a6f0734a.ZIP", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cae702c3-38bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776251893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251893, "uuid": "6f13f702-fa98-4f32-8387-78ebd7dcd484", "comment": "Malware payload (Formbook)", "value": "247661ae2c8c2040ba8bbb12464bdca3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251893, "uuid": "f36e9a18-3f47-4637-8731-a463f4713ed4", "comment": "Malware payload (Formbook)", "value": "92354fb4e971d88d3b4aee3e946ad8364f7a302de82acaa1ea7bcb233b2c463e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251893, "uuid": "e789f729-dcbb-48e8-99a4-38117fc8a419", "comment": "Malware payload (Formbook)", "value": "4660be16beb1795f448553ee78dce4b66fbf6164", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251893, "uuid": "176b65c9-9ec3-4ff2-ad6c-92630aa918ee", "comment": "Malware payload (Formbook)", "value": "cd809e1e0fbb73907ba297914f4b409f5f4047a894cf718a862ca0271fa70c433e52599fc3d1d5fae0b8f0623029b39e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251893, "uuid": "3f178b46-e469-4151-afc6-2713b3a640c4", "value": "T1C724ACF801A88CCB3E5C75F282D642677EAD09DE5132C008FA6C955E19B985DFC4FDA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251893, "uuid": "2e814e4a-2f2c-41e7-9ef3-471cb054cf14", "value": "384:7llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll7:FhHMbzxg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776251893, "uuid": "412609d7-5dd5-452d-89a0-25a644f61e3e", "value": 229166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776251893, "uuid": "b901b685-9cdb-4446-b65e-5ed103fc5bb9", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251893, "uuid": "565dace3-7b52-4e6a-ab8c-2759bd89b219", "value": "greatattitudeforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2639b6-38ce-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1776259544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259544, "uuid": "e7951b0d-54e2-49fa-9516-ccae3d626dd2", "comment": "Malware payload (XWorm)", "value": "3da6ff747b4ea5399e2ad5dd7da73dbc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259544, "uuid": "af87939f-9191-4d70-a61f-2e40f4a53769", "comment": "Malware payload (XWorm)", "value": "9312d0d6ac5933420c803540f90fd6a41150f14077d1d3a920b1c9a99d76c2a8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259544, "uuid": "98808f5e-5827-42da-8e4f-61e442da8a76", "comment": "Malware payload (XWorm)", "value": "d542d69bd7c48c4882d385d62768a15d014c23d2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259544, "uuid": "98228c3a-4ec0-4f53-b375-5ec6a6d25931", "comment": "Malware payload (XWorm)", "value": "711bac6c31ea417e1a1b7dc02397a78b7078bc5e9516ffc50c09a6e64b59386962979b86aaa7619dbd37912c348c123d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259544, "uuid": "c2b84eaf-7f65-4df6-928a-3dfd53d0d726", "value": "T152F57179C982084FAD5AEDB60E6D2D830B964ED1BF8251D92F661382413316FBF9F0D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259544, "uuid": "8c708306-c5bf-40f0-a488-72531fb550c2", "value": "1536:h2wVzSWkLOUK1szd2b0etSo31gwW0/5eJLiigX3zWgoJijUtsZpB8NfHagPUmg1F:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259544, "uuid": "44dfe4d6-eb9c-4efc-99d1-ec7d1a9a3c2a", "value": 3393174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259544, "uuid": "742e5c20-f9e0-462f-a598-2715827f1443", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259544, "uuid": "efda51fb-3210-4d41-afb1-21cf8ac5a551", "value": "Purchase Order_003936-Xls.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "866033ca-3902-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776281843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776281843, "uuid": "25df0fde-7a03-427b-b704-19ea83677e4e", "comment": "Malware payload", "value": "cdafef0209c6ea580496f5f729f231fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hmbr-org-br", "colour": "#28549B", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776281843, "uuid": "5ca67992-98f9-431f-b96f-59aa2dbb9df9", "comment": "Malware payload", "value": "9333c323c3fe82695c58625412e5163cf0db4804e3740b941bde6aef4375999a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hmbr-org-br", "colour": "#28549B", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776281843, "uuid": "40cf3ac1-7a0e-44d4-b9c0-62f759bcec92", "comment": "Malware payload", "value": "550f38f9aa9b46d2737f3b589eeebc3e2ee1d69b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hmbr-org-br", "colour": "#28549B", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776281843, "uuid": "ad9c4b44-1b22-44cf-9ec5-e090c6eeac3d", "comment": "Malware payload", "value": "635441bbff16b4913a730a7b4383fb5792aa333960a7f19d5b16bad8d40ae8171e98280717859b6277fe01e3ad784e65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hmbr-org-br", "colour": "#28549B", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776281843, "uuid": "708fbe09-aef9-4f73-8130-4951bbb29807", "value": "T1B504094ABEE601E8D1364639B4A64B41E725FF1146284BFF115872DF1F326C09CBAA1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776281843, "uuid": "37f97a84-c16a-43e7-acd2-b265a4c5f0f7", "value": "f1b68ca79cbcadd0e6e325dcf892eb21", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776281843, "uuid": "31940adf-72bd-427a-98e0-82c826b679ac", "value": "3072:Wjo8/GoiUlPGWm29E8LdXQxyBMu9CGeIq3tuuml8Ed:Wz/3iURG38LNSIq9uuvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776281843, "uuid": "25caa736-7251-4aa4-aeb4-368b17ed5ba2", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776281843, "uuid": "76859512-f0d2-4635-97a9-be4e3406cb2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776281843, "uuid": "a1e4526d-feb8-4fa7-bbcb-a30d3323362b", "value": "9333c323c3fe82695c58625412e5163cf0db4804e3740b941bde6aef4375999a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "075b4ecf-38bd-11f1-a769-42010a9c0008", "comment": "Malware payload (MacSync)", "timestamp": 1776251994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251994, "uuid": "4a4f6510-1bae-4147-af4f-9339819be190", "comment": "Malware payload (MacSync)", "value": "89cd106522464f79f783b031d7449a69", "object_relation": "md5", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251994, "uuid": "6baf3e00-88d3-41d7-9f1d-14313fb8beda", "comment": "Malware payload (MacSync)", "value": "93caa4d9bf4bf9412a2200afd334a5a839d8e488f8a7eda5c479bc9590757e6c", "object_relation": "sha256", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251994, "uuid": "222b5c74-ed66-4943-98f2-6f2e09572ba1", "comment": "Malware payload (MacSync)", "value": "6c96045c1cf417ce6ce93baf5f6d710c17b6b384", "object_relation": "sha1", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251994, "uuid": "d5b720ba-c531-4af6-bef7-4bc193bc80ef", "comment": "Malware payload (MacSync)", "value": "450a3ff0b0653d39547113fe1f1b0ff5e282729b685167fc1f250f4d0457b9d3835b761fca33ca8b357fb1089349499e", "object_relation": "sha3-384", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251994, "uuid": "9d4e9103-01d1-4e47-8902-0e603af784a8", "value": "T11531E92F21511EB57493434ACAD6A763DFC9CDC3B774386867D18A5306F98B5B0B0984", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251994, "uuid": "218b9c81-3da8-47e8-865e-b03ea7da8b65", "value": "24:Zthy6JGSCEs0rVgq5lhsrWx3aBtNZE+42V1Vec9zYjuMwGP/fh+0Qdhft5dQSwdn:E6JGS60GqX2W8BveQ7sSMJHfh4DdRKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776251994, "uuid": "f58f7729-6607-474a-9f3e-3750100ce9a1", "value": 1450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776251994, "uuid": "46686037-4e2b-45c0-acde-7a19be9f93dd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251994, "uuid": "142df712-ce3a-4f22-8d00-39ee85f8cb09", "value": "93caa4d9bf4bf9412a2200afd334a5a839d8e488f8a7eda5c479bc9590757e6c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873611b5-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776239753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239753, "uuid": "b56c4f60-fbf6-4d69-ba2e-d8a0d5179c34", "comment": "Malware payload (AsyncRAT)", "value": "d218273fc525f26c3e7cfead1f918526", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239753, "uuid": "8d610d24-cbe2-45c3-942a-941e420a693b", "comment": "Malware payload (AsyncRAT)", "value": "93d455a4a7f171ee527d4393034bbeefe0dd034c44d4f88edbc4992fecd70d65", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239753, "uuid": "06dea8c6-f318-4040-be7f-476fbda4c125", "comment": "Malware payload (AsyncRAT)", "value": "b5050f39518de430659445aaae3c04c937d20bc7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239753, "uuid": "9fec03b0-5e8a-4583-9719-a63dfac0852b", "comment": "Malware payload (AsyncRAT)", "value": "46f740c35261695051a3d69222fe9e0416ccdfba7301af63f559087adee9138b7e23f4c1cf0d4b28a061a40dbfb2ae30", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239753, "uuid": "0c0e64a6-675b-4562-8da7-8e3c4ef0ed80", "value": "T1F494F15C19E57F689B592137147A200EF7B54E40603C909CE7ABBC8DBF67718A02E6F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239753, "uuid": "0acb4354-c079-411d-97e1-87899da95ca1", "value": "6144:3McXIvrV7+sHm5gLl5TxHZrD2e2Oi6D1p1BGhZBZhj9IojsU5bJ01ti:8B+snLfbrqfOi6D1XBQ7n5I4Mi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239753, "uuid": "3aec95a2-e6c3-448a-b43b-731494e6bbd1", "value": 412560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239753, "uuid": "ab7043d5-e979-461f-937c-fd863302f553", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239753, "uuid": "715be74d-12c6-47e3-b572-314a28de85c0", "value": "FH098765470.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901428eb-3917-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776290878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290878, "uuid": "deab71c1-2fba-425d-9d56-839941e6fe07", "comment": "Malware payload", "value": "6aaeb21ad63c006c8a8be7f9e4c0582d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290878, "uuid": "ac59c793-98cc-435e-8b26-9d8b1aa4f1f4", "comment": "Malware payload", "value": "93fb6a99be064a1bb014110ea21eb2822f8d075299c833dbb515e63acde1cb72", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290878, "uuid": "4136d89b-84fa-4aa8-aa7e-4b0b4d335f2f", "comment": "Malware payload", "value": "578980b5e457aac1f958e9baf73ac675358b048b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290878, "uuid": "bd7494e9-418a-49e0-8154-9821e6a4a51e", "comment": "Malware payload", "value": "8e5e6d66214da618d0424c17644dd3eb0c79008cb1803d7beaba324b196b19866fd8b5a7219df5187a39612573045541", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290878, "uuid": "4f7447d8-c6f6-4239-921d-92094c5ba443", "value": "T1D1A312DBAF58E827CA1D5C7994F8D13BEFB193A3A1609787171361207FA15B50EE001E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290878, "uuid": "4755d284-8a2a-4178-8220-17efcbdf9d87", "value": "3072:uVpOmwBMAghNZV68C69/hCAILPwNfJo6L8BCO:mpthN9CK/3gaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776290878, "uuid": "f6ab1788-eadd-496f-8fa1-461a2dcf9a5a", "value": 107190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776290878, "uuid": "b6ecb4d5-a7d4-4f11-b931-64174bbe9e8b", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290878, "uuid": "9fd81b85-646a-4cd2-a543-b73b1265faf5", "value": "NApp_1.0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6211c994-38c0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776253435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253435, "uuid": "aab9bdb4-7547-40ff-96b7-36f6dfb8c759", "comment": "Malware payload", "value": "5f815c395ef0506a0aded4273b1bc041", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253435, "uuid": "005c0437-998d-4d49-9df3-90567a9529f0", "comment": "Malware payload", "value": "946da69810003119276af97883b7c4dfdc9ea38bdc336b09840c3f640922ce34", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253435, "uuid": "acc8021f-3a15-456a-9e01-c9730f0f6728", "comment": "Malware payload", "value": "487220d65c98e354c283ca71eced14b47a5be23c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253435, "uuid": "95806004-1ae4-4651-bd18-c027d6f33757", "comment": "Malware payload", "value": "2b467e3020d5b389f92ed5f547cc3b12057ad9c10084d9ca68005dc5345f84617773c694721a1b1575882afa30a9e1b2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253435, "uuid": "f0058902-1dd0-4369-b065-083a218c5ada", "value": "T121C523917A6A6037C924D73441C6BA5C751FFE985E220E27336D7F3C68B91086E2DB83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253435, "uuid": "1cc74c69-347f-4698-918c-4360ebe3eec3", "value": "815e1ba56e855b07daa7197697b159cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253435, "uuid": "502782c2-97bc-424b-957d-6a624e11e650", "value": "49152:FuWq9EymyQtPjMKPUhl5b1vPMKDd6Cycs9+JCmEPgntPvutdBH7:pyKPjMK8hlPkad6XEEmhtPvIdBH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776253435, "uuid": "54361dec-f044-49da-9b28-349fe75f93d0", "value": 2559488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776253435, "uuid": "71c020ab-af72-40ad-8352-44e90e797315", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253435, "uuid": "c6eb5334-4674-40ec-aebd-29dce32e8062", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd40b61b-3897-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776236086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236086, "uuid": "279e15d5-3704-4bf3-87d4-04ebb31e7eba", "comment": "Malware payload (NetSupport)", "value": "2590aaf1b71d08936c31fcd25e0f52cc", "object_relation": "md5", "Tag": [ { "name": "5-188-86-165", "colour": "#DE80D8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236086, "uuid": "a19918b4-7bba-46af-a842-59e80a268c20", "comment": "Malware payload (NetSupport)", "value": "9490ffefab233299f0e39d3caa223914f3b812ba35e19f9c3bdbf6326d7f627d", "object_relation": "sha256", "Tag": [ { "name": "5-188-86-165", "colour": "#DE80D8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236086, "uuid": "bf529726-c5f0-45f2-a418-d99a3d68768e", "comment": "Malware payload (NetSupport)", "value": "a084f55ba1242001038f265631535406b0112f88", "object_relation": "sha1", "Tag": [ { "name": "5-188-86-165", "colour": "#DE80D8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236086, "uuid": "c48ef165-b7e2-4665-9ddc-60aace1ef839", "comment": "Malware payload (NetSupport)", "value": "31b2c5ebe8ee4d6020368e31e66450f78887ab0f7e467959faccbbe9589a976b5c3efc9e8d4f987ac977dcf38c3eb0c3", "object_relation": "sha3-384", "Tag": [ { "name": "5-188-86-165", "colour": "#DE80D8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236086, "uuid": "c72b9049-b010-40d8-a549-161bfaef4a5e", "value": "T19FC08034194A84BFD1FAF13401A370770572E6070CF35A4F11F44544410241CF716564", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236086, "uuid": "6774e01e-7acd-4b89-a14c-d8274b70662f", "value": "3:VSJJLNy/F61N+gnWdewy+/2+/x0ML6FBPMe/QM3TNFBPMe/XAEMSAcZYn:snyNaNfn2H5x0Mm7R/QMD9R/XrF5Kn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776236086, "uuid": "ebd0523e-5a31-4da1-ad11-3fab3be09763", "value": 167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776236086, "uuid": "f18de5df-36ec-4ed2-ae07-c9fb71578662", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236086, "uuid": "4f39025a-52c8-4a1f-86dd-e581072ce2e7", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631d7e68-38a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776240122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776240122, "uuid": "53101d62-4993-45d3-85ce-afcaf2025e82", "comment": "Malware payload (Formbook)", "value": "6b553c7b110d2a4327e648409143423f", "object_relation": "md5", "Tag": [ { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776240122, "uuid": "cf49a809-b18c-420b-a497-dde6e7a08802", "comment": "Malware payload (Formbook)", "value": "949eb105fbe7d0c40f7f706002966081809592f518ee091494311292421d3f68", "object_relation": "sha256", "Tag": [ { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776240122, "uuid": "1a071271-23a2-42e6-8c05-66540c1ca8c2", "comment": "Malware payload (Formbook)", "value": "a2b51499d0603ec549a2b30aaac1626ab217e443", "object_relation": "sha1", "Tag": [ { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776240122, "uuid": "8718bb48-5901-4c86-9915-5dd3338648a1", "comment": "Malware payload (Formbook)", "value": "67ccebb6d257d1de5c8cb3d9f1d2f18bf5b1a7ce3bdd574ec2eb8bb71c0432303eb443463de51a5697827ed6dbd80497", "object_relation": "sha3-384", "Tag": [ { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776240122, "uuid": "fc4cd8af-77ec-495f-ba2c-4c2e6cd0ba9f", "value": "T1CB54230760431016EA856AFB06E22BD7F768C5F20AF7E9DA36553C5748572DDA301F0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776240122, "uuid": "bc2b31f2-14c5-4a4b-80ed-957a194643a9", "value": "6144:X8mR78Gtymrprh9VCbYmDEr0o7cJn66fVl:XdnhzPm8HcJn6+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776240122, "uuid": "eede1fd6-7d97-4f35-9992-412a3d8c1665", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776240122, "uuid": "5abc19a7-d30c-4b84-9bf0-e88aa3228219", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776240122, "uuid": "6c954557-9788-46a9-aff6-895a32751987", "value": "949eb105fbe7d0c40f7f706002966081809592f518ee091494311292421d3f68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7fe6f8b-38c7-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776256666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776256666, "uuid": "ad63d8e5-3604-41b6-88d2-c035f49e9fde", "comment": "Malware payload (AgentTesla)", "value": "2969383e59c8c085fab213fef2cffcfb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-crescentegramas-com-br", "colour": "#ABA7E7", "exportable": true, "hide_tag": false }, { "name": "sativagina--crescentegramas-com-br", "colour": "#B9AE42", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776256666, "uuid": "99976019-2b5e-4f74-8e84-8fde090071d9", "comment": "Malware payload (AgentTesla)", "value": "966db77aadcffd5a26f558080d931473816f2c823105899226b78d513f9a9fa5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-crescentegramas-com-br", "colour": "#ABA7E7", "exportable": true, "hide_tag": false }, { "name": "sativagina--crescentegramas-com-br", "colour": "#B9AE42", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776256666, "uuid": "dfd4ac41-1620-4b41-ac87-1fead7eb686c", "comment": "Malware payload (AgentTesla)", "value": "30aabb6ba286b797144d4e12136a0c65ba30b5d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-crescentegramas-com-br", "colour": "#ABA7E7", "exportable": true, "hide_tag": false }, { "name": "sativagina--crescentegramas-com-br", "colour": "#B9AE42", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776256666, "uuid": "328bd5df-9594-400c-8544-6438699877f0", "comment": "Malware payload (AgentTesla)", "value": "321373cebe61b511de74ba2d3a00869cf7e91dce17cb3de03a9310ffdf2596fab3235cdb059b0fae4fbfa9cb79a9a6eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-crescentegramas-com-br", "colour": "#ABA7E7", "exportable": true, "hide_tag": false }, { "name": "sativagina--crescentegramas-com-br", "colour": "#B9AE42", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776256666, "uuid": "16ac7eec-57ca-48ef-8e6f-5c15a9ec6fdf", "value": "T1C8A5335F7820633C992EE382D6921F175E82A3C4B0E11577C05A74CBF2FA491CB8A59B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776256666, "uuid": "e02bd9ad-628b-4f2f-839f-1d26402b7878", "value": "49152:RJ475c6eYg02G9pAvlzsFXseW1U8CiwOWICKaz:r4+6lV9pANsEfCnICKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776256666, "uuid": "cc5b1ac7-7e64-4f2c-ab52-0c7cceb1c53b", "value": 2160011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776256666, "uuid": "dad2d393-6118-4b24-a86c-e8df87e7f4d7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776256666, "uuid": "67536a0d-d2f8-4b26-a9a6-7af2ebc51581", "value": "966db77aadcffd5a26f558080d931473816f2c823105899226b78d513f9a9fa5.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df5d5edc-38f6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776276838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776276838, "uuid": "77f9998f-762b-43dc-8ae1-c3ff92aa7d14", "comment": "Malware payload", "value": "9fb1e294c0897138626ba040603c4656", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776276838, "uuid": "3888443d-7791-4078-a167-a1d5f9b94760", "comment": "Malware payload", "value": "97007c669e1a93334464b6e08d0b3c3c9dd9368864b112b466dfb9f2c9d9f979", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776276838, "uuid": "48e77ef1-d6a3-461e-9dc3-5b98cc0805ad", "comment": "Malware payload", "value": "528d737946e32cc3b15ab8fe30055439e1c27b07", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776276838, "uuid": "5340b6ca-2859-408b-9d48-6e0637350e92", "comment": "Malware payload", "value": "9c8c737260f0750b32a98863b84d9bf4cad5c7dda5cf844f4d215764f5d9f7ad34a8bc989d73e2e79b582665ebcacc2f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776276838, "uuid": "2111837f-8896-46a5-8d38-8ef4fc06aa53", "value": "T1DC831BD2CEC0D126581E5A87792DB5841C496D8C966BBF13BAFE37767CE80138790BC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776276838, "uuid": "c0c28321-2d50-43ae-b2fc-45e8e2f989b3", "value": "1536:7XiqebIwrNbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbq:7HeZNbbbbbbbbbbbbbbbbbbbbbbbbbbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776276838, "uuid": "179480a7-9ce4-431c-9634-ae69e3fa2606", "value": 84434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776276838, "uuid": "8daf3d24-71d5-4d2e-965d-3adf919c90b2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776276838, "uuid": "8ca64b92-fa52-40f1-90d4-b5d91dbc0abf", "value": "Scan_4_15_6_1387_14.04.2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb245475-3897-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1776236056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236056, "uuid": "16361349-eaef-4b5c-ab90-7fcd3d9ee1be", "comment": "Malware payload (StrelaStealer)", "value": "a79b3095599b7eb8b4d7932c23c52089", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236056, "uuid": "071686cd-3aac-4261-b683-9d81b650112f", "comment": "Malware payload (StrelaStealer)", "value": "976375b82b1ef466d7d76f8afce7b75958edb3cf63fc4b430e7680a34cf90835", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236056, "uuid": "08888286-8e4b-42ea-adc0-0e5a8c55eccc", "comment": "Malware payload (StrelaStealer)", "value": "5213e451cd66fda2781db982665da2ea2765cacd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236056, "uuid": "f9fd3fda-9f0b-4105-9f59-14201ece9d9d", "comment": "Malware payload (StrelaStealer)", "value": "dd8b8b770811223289e3b1378287fde8a31a5b69f4533ef2e80f4205845cc17e5d3623494d863ed3472bfe6d7c375f7f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236056, "uuid": "f340c0df-a222-4274-a930-04d99263bf85", "value": "T1F4343B3ECAE50426A1B6C614FDA60813F16B7B57273D8C9C12C912494BB310EB5EEB5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236056, "uuid": "fc3505d5-a469-4ab7-b8ef-086a4370f7e1", "value": "6144:Kp59uCtjUSO8JDsajHRSxQFjQ36Omj4oysGIpXzpfmjTFEfW0K8xz:KpbtIOltcxQw3+qs1pdWF0WZKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776236056, "uuid": "532a93fc-71d1-4bdb-821c-953f607704be", "value": 230742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776236056, "uuid": "c844cae6-d6c4-4591-917a-6b1b7dc3ad43", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236056, "uuid": "6756dc5b-56db-449a-af43-ef46819dc258", "value": "PO 4500272644.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea3eb046-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776239920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239920, "uuid": "6248345f-a658-47ce-a64d-3799592a16cd", "comment": "Malware payload (Formbook)", "value": "0353760d217d5ee5e4085af950237ea5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239920, "uuid": "bc23c9d8-7e3e-4bd4-8c27-51c41b9488d4", "comment": "Malware payload (Formbook)", "value": "97a6697bdf6b79e86895f5f7af8307fa9b101a518d8c1d803de856bdea1a6f8a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239920, "uuid": "3a106f8d-7967-431b-82b1-4e6c2d3fe487", "comment": "Malware payload (Formbook)", "value": "c71e27c6c962f41e066bf6de51061afbd2392d13", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239920, "uuid": "6ea8ace5-2126-4173-b775-38659d461597", "comment": "Malware payload (Formbook)", "value": "10744b3698ead7e57ec1e5d0d51abdb9db312261140d5f55add238294ca9103b7e9ec4a19621b98f3bd8a46e27dd69f4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239920, "uuid": "3baac8ac-1627-4cc3-8202-a48959eeb8ad", "value": "T12A95021549C42FB9CFAC2A1940FE161EA3F04A8E5016698AEF33FE47FFE7A045117199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239920, "uuid": "7182f8df-d281-412b-b30e-9fa766949754", "value": "24576:ZBjfaBGiWNhrIBohZtTXGtEr+kdzc230ynhgGSXy+QnY63JOfSJbfAn8XabmLDWm:z74Io8oWcPrdQ13tvG2Xn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239920, "uuid": "2671c76a-1db4-47bb-852c-662572893acf", "value": 2026020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239920, "uuid": "406a4dc2-1f6e-498d-9c90-62869da6d7b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239920, "uuid": "e48b7749-43a9-4edc-bcf8-647bcc0a0ecc", "value": "Quotation request #2026-017.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b862791-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1776239600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239600, "uuid": "91eb58c8-c30d-44cc-8477-e5e89fbb0b48", "comment": "Malware payload (DonutLoader)", "value": "e6b19a24f78156567391b67a2cb881c5", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239600, "uuid": "00434a9f-2847-4e56-9119-98d3b0340720", "comment": "Malware payload (DonutLoader)", "value": "97e8c56c2c3b63c21ae389ac057d2b305dfa13ed5708b852af6d40abc7bb77b3", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239600, "uuid": "4682366c-3f73-49ff-a863-4cf83bbfcac9", "comment": "Malware payload (DonutLoader)", "value": "66a2e1be9883c65ff4be6cf7aabae8167664e8ca", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239600, "uuid": "b9674793-b04f-4507-a8e7-54a5d9a2a616", "comment": "Malware payload (DonutLoader)", "value": "b00d2cec196e4ebc6fdcd992b46dcbec3055f150b5327843bcbb90416fe617f41010465b669a50f6ca9cda5432af7655", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239600, "uuid": "fccee9ff-c17c-4867-9b8f-6fd1c212572a", "value": "T1C366A514D1BDB6199CC6DB8AC86FFDB04C8E6CAB1A1CAA83200F9A7C1C45F5765105EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239600, "uuid": "46d23163-0e2d-43fe-bcc9-2e3ea1f6b07e", "value": "98304:cAIc2HHfzKo7Ojv95wMN2zMgCJU4/sQDBJEXjGdYjWh5MMsb:YcyG9zgTz0U4/ZuXS953a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239600, "uuid": "8be05d9c-7008-43a8-bb28-ea179e54dbe0", "value": 6692782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239600, "uuid": "3349c02b-34bc-4756-b300-e478c2e0081e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239600, "uuid": "6382d44b-0628-495e-94b6-4aacd17b3bcd", "value": "overdue account.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc795ae-3879-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776223147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776223147, "uuid": "37d2ebf4-f4fc-4949-a7bf-6afead2a0efc", "comment": "Malware payload", "value": "39286bbb12d108c3a4c3188928abe308", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776223147, "uuid": "49222428-ae0b-4d23-b6fd-cca7f7ed53d1", "comment": "Malware payload", "value": "9805635b0d4218518829843661381f2eef8c986402f84871fd320fb2a254b254", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776223147, "uuid": "7cc3dc66-1da3-4cbf-a63f-61024ba59cce", "comment": "Malware payload", "value": "39484eae3550a12f9f0fac4373858cd48db6efc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776223147, "uuid": "57d23ea4-7e77-4d4b-9204-e8f7330f8750", "comment": "Malware payload", "value": "9b9e510b217024bdac4d4adaf4d28b23a7f570a25f5ede32df33b9539b9ba1c398c3b2c11004dea41c985b6c3e40aebe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776223147, "uuid": "6de0c630-7a37-4c77-8673-8b1ae25304fd", "value": "T1AB340291E410E86DD9BEC2784FCBE137657A7987131C32BF2240AEA02D35F93439E5A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776223147, "uuid": "8af8f50d-bc08-425b-b0c5-74a6cad594e1", "value": "6144:GCdNamWymLWnC7PYK0C2u3mOyNkbPlVvTCO1hapv9REjGSGT0HLUoY:QTjzYW2SmZMPlVWEhMwL/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776223147, "uuid": "62d871ae-4912-4765-9b05-fb6d172048d6", "value": 238378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776223147, "uuid": "0dbff48c-e02a-42a2-9a46-d7d4eba2736a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776223147, "uuid": "7b3c49ee-683c-492e-8743-1b41bbc4c664", "value": "x2gv5tlkca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dbb4453-38dc-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776265346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776265346, "uuid": "a8daccb9-aec2-4175-bd3f-e536148dadcf", "comment": "Malware payload (AgentTesla)", "value": "3c2f1c9987a203d2da7fac0524bea988", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776265346, "uuid": "965ab5cb-d874-4c82-8302-55dae6e45a6d", "comment": "Malware payload (AgentTesla)", "value": "98472b134ae427132d830061d85ad2251cdc9c8901ae84fb435d75ed383c0763", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776265346, "uuid": "9adc8f48-e961-494b-a593-eea00b099ba2", "comment": "Malware payload (AgentTesla)", "value": "ad16f0af454788910ba4898c3ae062f8e71ec9dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776265346, "uuid": "bbc2e87f-5df4-463b-a9a9-998eeb62deed", "comment": "Malware payload (AgentTesla)", "value": "c15ca02b0be6448387621b34e02464ab1333f9f1dd8fb3b995770782575c270e858eca64886652bb1a096581b35aa623", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776265346, "uuid": "24766956-9335-4b36-8e72-b5a2fb198371", "value": "T151C45116EA61A42FF49389B1697896567C283D3616C0EC5BF7801F5930B0AABF1F071F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776265346, "uuid": "e0f2f467-58b9-46ee-bdf1-fb589f86247a", "value": "556306d8fd82c1d68a957dcdf08365e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776265346, "uuid": "86ac9e55-41ec-418c-990f-59701c0e208b", "value": "12288:KeFT9GiFRuyDmlg7hyMuJwAwR18ciVKbpqR4ykR00NtR4BneeH:NCRenpqyd00N/4N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776265346, "uuid": "19385ffa-5523-48cb-bc63-dbb8defbca3c", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776265346, "uuid": "fcabf3be-2b9c-4b2d-bd25-ab3b5ce80fec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776265346, "uuid": "2bff9d67-9a77-4827-bf1a-c10106b47c9a", "value": "transferencia interbancaria (BBVA).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649dc7dc-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1776239695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239695, "uuid": "2cdccebe-8402-46f3-9a5c-a4e915ff8a9a", "comment": "Malware payload (VIPKeylogger)", "value": "95c41253a1b671cd8cbfac3283bc41f9", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239695, "uuid": "0d224d86-16c0-48cc-ad12-6289c985db95", "comment": "Malware payload (VIPKeylogger)", "value": "9a1f41c42b120a15864995065799f3a825b1e1da50f4c7792214fdcb6e8c0427", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239695, "uuid": "a0455b76-1f75-44e4-ba3c-4600e3eda67f", "comment": "Malware payload (VIPKeylogger)", "value": "88223cabf1e6a6aa33376f55f4955a3a4b4ab7d9", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239695, "uuid": "353cf4e6-50e9-496c-b690-92c2b8902d96", "comment": "Malware payload (VIPKeylogger)", "value": "b40abcd81dddb73c0dc46fc779a7311546f95b90791d50201f549bd6018d57b88551f1ac935471eb9e6d3135908dd98e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239695, "uuid": "5a5a3e74-9d7d-4ef0-9c48-524d1ca0bc0f", "value": "T1BEB21D3EC985DFF00B6A31E1656F7A1699540363B9386E4DB8CEC1993B35610CBB10ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239695, "uuid": "b28edd08-d59c-406a-bcf8-351ec9af5dcb", "value": "384:Kk8Zi71bIwZlt0585cbbF/9hbl+qajhca0Eck1rmA+gNNkRlNvAnKMGeyRIknh1i:Kk8Zi77TKaCd9QG8HDNN5B+1iSV5I4oh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239695, "uuid": "a728859d-259e-4ca3-8b9e-b736e4156fe7", "value": 24132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239695, "uuid": "47442288-8b4e-4580-90c0-ef18b71ce6aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239695, "uuid": "0c936a30-61e6-4606-ae09-9197d4dbc95d", "value": "FAKTURA.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d154a54e-38c8-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1776257058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257058, "uuid": "78b16660-4104-4d44-9fc0-df252f57505e", "comment": "Malware payload (Stealc)", "value": "1ceea849fcc870aba59694a78f2369d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257058, "uuid": "aac17702-0aa1-448e-89a8-7b79a53f7c68", "comment": "Malware payload (Stealc)", "value": "9a7c87d58a7ab1f2d99c5390d04c3875e41587b46f0632518e6108286ca45e2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257058, "uuid": "a0da828f-880f-4b5b-a6d1-f67b9f2016fa", "comment": "Malware payload (Stealc)", "value": "c5d93d4c5715ac89be95b067266d0f9804796dbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257058, "uuid": "b7715604-63b4-42ba-a3b2-ae8aaa23617a", "comment": "Malware payload (Stealc)", "value": "2a8b9639d7ab3366688e15aa4ed724b0df237597b44f3af890380f9c83177df975e798318311b83ec141d7623ae378f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257058, "uuid": "e7f393e3-bfba-4fcc-b5a5-2ecea1f9a226", "value": "T179F48C1BE7A602F9D1B7C274CA424957E772B8065370978F03E14AA61F376909F3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257058, "uuid": "ed3dafbb-bfc5-4b80-b2c7-517da74f7d56", "value": "f456face36cfa724bf01290dd8927512", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257058, "uuid": "c2e31d3b-13ee-4d77-816e-889b0b87293c", "value": "12288:JzvOznjd7Dkqya3OJXJyZzNP8GTop8mWC88yxBlDetAqxSva:8XOqyzJXIPkEWRbvybS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776257058, "uuid": "e5afe92e-2e09-447a-b6a4-9811a84e247c", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776257058, "uuid": "0744ed43-ad14-4f3f-bccf-0087219309d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257058, "uuid": "c33cc836-a865-4151-9989-8d33630a3353", "value": "525252_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf148f5-389f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776239523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239523, "uuid": "48f36c38-ff64-4efa-9f21-2dfdca4bd3c7", "comment": "Malware payload", "value": "c370870f2517c33c1f107c12242106fd", "object_relation": "md5", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239523, "uuid": "11becc58-08fb-4a15-9c18-be27a3b29f68", "comment": "Malware payload", "value": "9ad6427937610c1d427e183082bdbf26a3f5f78644230a2552dba4c9c69160d2", "object_relation": "sha256", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239523, "uuid": "4684a691-4fb5-4520-9f6c-d126a2560f93", "comment": "Malware payload", "value": "3d2c8dde4c8f37ef24df51ca6bb9aaa950a02cc8", "object_relation": "sha1", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239523, "uuid": "5b336b30-4cd4-472f-9c3d-8c4e24484a64", "comment": "Malware payload", "value": "9b80dad1a2eb727c1d6ba5f47d60c7175369a85c3c9d0348f21b03de1852512e74c1f2416fb19682025611456d90f778", "object_relation": "sha3-384", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239523, "uuid": "d24653a7-e3e1-408b-9800-c0469e3a85e7", "value": "T112E4221178D85D0FC0E343F99FD486C6AB9CFC5A2B46E99B3280377A5839B3509AF214", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239523, "uuid": "3741fcc4-181e-4bbc-9711-99a1abdda672", "value": "12288:WeCl5Gd4FacNR/LvxKiAbJTBdXYRT80/KadjnGs4bKKE0k/hbBkkv6e:WeCnGd4LJ7CYRT80/KadbGfwbEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239523, "uuid": "a3572070-143e-4944-bbb3-831f48b8337a", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239523, "uuid": "a7529f15-7f1e-4c0c-8e76-40b33554f137", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239523, "uuid": "ed5f3c33-6196-497f-a0e7-340baee88946", "value": "HSBC Payment Advice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "497de472-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776239650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239650, "uuid": "6e89ef5e-04f9-45da-9bf4-f99c6a24710e", "comment": "Malware payload (AgentTesla)", "value": "bb84793c5fe7c5f0d2a5bc060d781902", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239650, "uuid": "d3430ebe-384c-47da-91f7-c7f8b9b12946", "comment": "Malware payload (AgentTesla)", "value": "9bc212887407c19fb0be007c4a1d3afaa7c421976bd4faa5aab6f83e3e4845b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239650, "uuid": "fc0a9621-ac55-4b11-9614-9d51fc20a6df", "comment": "Malware payload (AgentTesla)", "value": "3ee10f0954faf59931f813da0de461e7c1a86f27", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239650, "uuid": "951a604d-e1ba-4273-b683-06cae5b76e0c", "comment": "Malware payload (AgentTesla)", "value": "c70d470d34f61e9e16226c4c08e0b3e1b73ba86e6fdd5ba759721d70b5d54207ec9248fa493a7e774fa988ec816891f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239650, "uuid": "c19a520f-9110-4dad-8fcf-b9be4ebad194", "value": "T110B4446176A64699492170A3468E86207F7ECF3F376D182D8D075B3F8B34C12E7B626C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239650, "uuid": "cb438507-4a3d-49b5-8310-19b62ab3adcf", "value": "96:RAbfYRSu3N29/2OOy1tOgSUeRAE4HHV0IsmOfVVQCVfVwd8VlVbIGa5eAVlG73EX:J6iS/ipEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239650, "uuid": "dad5729d-f732-45c7-98d3-86252fa88e4b", "value": 512675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239650, "uuid": "90a8470f-b19d-44a8-a14b-88cd57b524e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239650, "uuid": "edc549a0-5ed0-4858-925c-54ea9eee76ee", "value": "EX770068372396.PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f70619-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776239594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239594, "uuid": "5f585a09-72b5-4f4c-948a-738f8556b53c", "comment": "Malware payload (Formbook)", "value": "cadd79c922800b700bf981e42db3e001", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239594, "uuid": "077ff009-378f-4971-8c49-1b34eb0218f0", "comment": "Malware payload (Formbook)", "value": "9c5df9080e5fb19a547ad2e7368ec07a57bc47f6a59195293beeb277b2a3800e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239594, "uuid": "04201b7c-c0b7-4ea4-a496-1122534639e7", "comment": "Malware payload (Formbook)", "value": "647ff060a9ed41a9527d89562048de34ed97fa54", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239594, "uuid": "29fac1dc-9ce4-4c91-ad6e-9c831e1c39d2", "comment": "Malware payload (Formbook)", "value": "19804573727dccb5027b1716b7144ffefaa5a5a6f9165ac9782f9b46e314abc6069296719665e1b6c4efa350c7529a2a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239594, "uuid": "575808ac-e3c8-475f-8575-1d889f6ea113", "value": "T17EF6D011327FC30CB6730A2D86F670A56ABBFB97AA75CBD801B0090D19E5D11C962F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239594, "uuid": "58946d99-6721-4e04-bbc8-b804b474e074", "value": "3072:9kkVtLkkVtLkkVtLkkVtLkkVtLkkVtLkkVtLkkVtLkkVtLkkVtLkkVtLkkVtLkk7:/bbbbbbbbbbbbbbbbbbb1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239594, "uuid": "84f255a4-da59-44bd-b6b9-6246aa2bba83", "value": 16114918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239594, "uuid": "aa8ab186-0d10-4e36-ba59-3374d67bb6fc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239594, "uuid": "1b6d69d4-bfc9-4cce-9ed8-c492f5b88a36", "value": "New instruction.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "324c3e8c-38ce-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776259368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259368, "uuid": "705893a2-7755-4c4b-ae25-bc0d589ee1d5", "comment": "Malware payload (AgentTesla)", "value": "1e5a7f864af5c61ca14796ed2a28d5b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259368, "uuid": "d3aaf6f6-3913-4d6c-abeb-879a234645bc", "comment": "Malware payload (AgentTesla)", "value": "9d27ae295284736c1db47fc319ed7e460bf8d5f2ca3081eeba0eeaf4cc4f285a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259368, "uuid": "95e01483-5a72-4c58-8d02-a6f891dd2a13", "comment": "Malware payload (AgentTesla)", "value": "f037066f83e853cbc90edb2901f16893429195b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259368, "uuid": "c8bfd6a3-ab50-42b8-802c-97eefe5f0a00", "comment": "Malware payload (AgentTesla)", "value": "28bc9205587355bab6e455675194ea83dfab53df4ee02ff333f3548149b3d796872acd7c56e5cb9b8cf6fe8708f197cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259368, "uuid": "cc2d5f0d-fe20-46b2-b14c-4abfc7442d25", "value": "T18A55021149C42FB9CFAC561990FD1A0EA3F04A8A941AB98DFB33BD47AFE7A4401171DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259368, "uuid": "51b61a5b-5e32-43e3-b14b-c72c74b80707", "value": "24576:DKDnRrh+X/xW8aiMQxBbdF1xAWHW+HZlbxM:cUxWEtGoPRxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259368, "uuid": "e6b530e1-a410-44e9-bd59-b34b587c148c", "value": 1368585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259368, "uuid": "7436c6bb-2f34-4ed3-ac20-1af0e68357ba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259368, "uuid": "4823289a-aa8c-4dca-ae3b-9663a04fb2a7", "value": "Solicitud de cotizaci\u00f3n - RFQ adjunta.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa23447-38f1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776274414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274414, "uuid": "6290f576-0481-4df1-8bcb-a1f58bc2caff", "comment": "Malware payload (Mirai)", "value": "3dd723a20bc3b0e725cac642bad4b520", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274414, "uuid": "9a96d2f2-1f41-41ee-8deb-6d13796320fe", "comment": "Malware payload (Mirai)", "value": "9d76b150e46633898f491ca374e06ccc0030d41a939a3ada7e19348eec0a4a00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274414, "uuid": "fcd84bb7-0267-48e0-b1a6-0884feddf26f", "comment": "Malware payload (Mirai)", "value": "765fd5efe14d6f0bd2e4b3adabc9fe27fe6d89d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274414, "uuid": "0fde76e2-2d72-4ca4-a159-61f8dd022ba6", "comment": "Malware payload (Mirai)", "value": "334bdb01b132901a7844690621ecdcbabe071bf477e98ed8cf925cfbb0265005d2c5ca1949c6b0af94e3d60901db575e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274414, "uuid": "853426aa-2c41-4552-a616-7c44d56e4f0f", "value": "T1A072F816967BEE97C0E173B712E70350B0EB1FA861A0834F7E064C896E253406D3EB95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274414, "uuid": "bf2856eb-c5ea-4bc5-8551-d0c698969a84", "value": "384:SPUWDbG3iQcrLqchN2taHw8XUSMqyLdVQYuyTvX:kFPG3iFCoZwGUeyLXQYuyTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776274414, "uuid": "c2faf257-5cea-45ff-a4e2-24678c99ec5d", "value": 16632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776274414, "uuid": "4924115a-76d3-4666-89c5-dd389703cbb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274414, "uuid": "dc8a3f7a-abc7-450f-9c6f-11ed4b659bb5", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dac6eed-38bf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776253025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253025, "uuid": "f7a219b6-1aa7-4a24-95e5-7c911249763e", "comment": "Malware payload (Mirai)", "value": "d3272e3a58413ea12d4ec6401ac3812b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253025, "uuid": "c9a95fe9-b7bb-4e53-9498-8ad5b840a633", "comment": "Malware payload (Mirai)", "value": "9daf7a166655799ad086916b295e36cdec811cdd916ea71281d235108f0f41e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253025, "uuid": "54db545f-affb-450f-beb0-b253927ba758", "comment": "Malware payload (Mirai)", "value": "6083d47c18c6a7f4ee967e1e3f7ba675c67ad283", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253025, "uuid": "f79d6110-cce2-491f-9b3b-dd451b775f92", "comment": "Malware payload (Mirai)", "value": "99f36e25ede0ae91efd8918359a4c43a398a57351897f5c707ab320fba22437457899ea7a0ac9e930ac19d7b216ae100", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253025, "uuid": "b55a532a-1cd8-466d-b365-6c9abe5d8237", "value": "T11F443A45EB404A13C5D627B9F6AF02453333A7A4D3EB73069928AFB4378775E4E63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253025, "uuid": "b35c461f-1429-4e22-8c83-e53fb2380860", "value": "6144:gL760M3By9q66yWJaeJlxJWCcLPgaVjG77/pV/GNw36:gL7zM3BkQyWJaeJlxJWCw4kM/+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776253025, "uuid": "7ed10de9-7b25-4e05-b496-4df93a98ca29", "value": 267082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776253025, "uuid": "bcce73b5-f70a-4882-be32-5131cb1c0269", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253025, "uuid": "786ea596-aca3-44d4-af02-233f177dcb46", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab89c45-38ae-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1776245745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245745, "uuid": "9bc1dec4-1a1f-4936-bf6c-d5cf9df2e646", "comment": "Malware payload (MassLogger)", "value": "28184d3d643aa611dda323b40261306b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245745, "uuid": "8bb9fa29-e39c-418c-bcb6-7e4b6be6cb7f", "comment": "Malware payload (MassLogger)", "value": "9dee1f01f62ac121f05da0afd753e25ff3e832d5c75b516b8d8fef92b675d209", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245745, "uuid": "129affa2-5f76-457c-86c8-15f3f51b946a", "comment": "Malware payload (MassLogger)", "value": "f02559ceb149c72ec1638dc0dacf252c2b936ebd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245745, "uuid": "fb34bf66-d5dd-48ad-a376-ca5c930b904d", "comment": "Malware payload (MassLogger)", "value": "2deefc534b43b0c5aac2593246df99acbbd628beb70fd173f18ad679935f021d271e53c294b527fcfed1a9b5d51fbdda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245745, "uuid": "d93f8a15-7683-4e2a-84db-dbf3127ac1a9", "value": "T1554502522654C2DBD25C5538C0B792781175CEBA27E7CD0AEECE3F675630B4E2E6C828", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245745, "uuid": "dd54ee91-72d0-47e0-9391-e0d0de40ac9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245745, "uuid": "01493d01-0f42-4c93-9824-32cc9dafd04b", "value": "24576:2yYm852b89TTgPR74fTI/9m/eS+6imBBqtqVSic:uN52b8G7UIjSimXqvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776245745, "uuid": "fe675900-4756-4a71-a925-52aa126cd4c3", "value": 1245696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776245745, "uuid": "96b776a0-24f1-4763-828b-dfd52f3f9840", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245745, "uuid": "0c1cc6f6-cdf9-489e-b007-d47367283adc", "value": "SecuriteInfo.com.Trojan.Inject5.25835.22695.12487", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b43826-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776239905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239905, "uuid": "f0d39d20-01a4-4c98-a2a9-98b76f2b0f88", "comment": "Malware payload (PhantomStealer)", "value": "c3f65c6d59b3bab0d7ed33782dfb7a48", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239905, "uuid": "ab4f48dc-9bbb-43db-b541-ff7a4932dc5d", "comment": "Malware payload (PhantomStealer)", "value": "9e4c38ce3c43adc39fd6f9c9ea6d4244916b6d064f337f095e848b3157d18e3a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239905, "uuid": "21430f10-4a7d-4a14-b92e-9e9cfc9932cb", "comment": "Malware payload (PhantomStealer)", "value": "be1d4731fc307c2968e2d1ff48a4328230959f0d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239905, "uuid": "fb060e83-82c5-40b3-875d-3d27afdbf089", "comment": "Malware payload (PhantomStealer)", "value": "12367bf0a256bf43331269cf8ac5a854ddc1629336120b93832c34bf118cbb9d0c9e1f2f2ac70c97c1fa5c2f6d9d428c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239905, "uuid": "e5adec49-ae79-49b6-980f-a307672fb4b7", "value": "T11086C598D0B4A31A5CC2EFFEA563D4B049CE25AB7E0EC872601FA4781D61FD7842159F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239905, "uuid": "e27069ec-28bd-4d3e-8c9f-1a298885a418", "value": "196608:tqOrqx3ktpxQYor87COqe5UhekbQlByrD/kEHnnRhLJ8TDSSb/kn1MOnZpvaYoDy:trE3V87ldiQlYD/3lJ8zbiM4va/f2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239905, "uuid": "e3b5a7c4-e8c7-4766-b13d-58ba67eb9539", "value": 8043068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239905, "uuid": "f92bc8a7-d1f0-462e-82c3-dc7f539794f8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239905, "uuid": "954ac875-644c-451e-a6ae-7b5a834978d0", "value": "ghtafnyp.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c45597-38cd-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776259266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259266, "uuid": "4ae73ad8-0d5d-4d87-9c1c-96a06407600d", "comment": "Malware payload (RemcosRAT)", "value": "12f8e7a04fdd7b6afcda3f8ddbfd2517", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259266, "uuid": "17b266aa-59d2-4930-aeb9-fad9ae311cad", "comment": "Malware payload (RemcosRAT)", "value": "9ed326af6d4654726024516910d0b04f395db2216dc6c998adaa2db2639f0fde", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259266, "uuid": "2c6924c2-4095-4ff9-b98d-bc83b5550258", "comment": "Malware payload (RemcosRAT)", "value": "4224dd77b8178ddcd44d2323ed99f8bc2252a97f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259266, "uuid": "d940a738-68c6-4b62-a4a1-9a96250db9f6", "comment": "Malware payload (RemcosRAT)", "value": "2802f30fec81a1f03b89d69c4374eb56eaf7bbc7cce752367dc79fda819479b55298ea0459056c227cd12c9460488d82", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259266, "uuid": "5a68078e-1661-4b70-a773-f942a41b2923", "value": "T12C02E2D44E83C71BA0418B1765A1F8E46DD2A4FF6064769F40D8BA744EC21BF9F32362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259266, "uuid": "73b8e895-6e02-41e0-8c0f-181aede24f3b", "value": "96:YintV5emk6k+xUrLOioTvtONTpxu6ohnXC:Lrkmk6k+6r6ioTvtONTpxu6o1XC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259266, "uuid": "3249b3e2-cbb6-496e-9180-8ee551eab091", "value": 8279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259266, "uuid": "b6649e06-3734-479f-86dc-81005594577c", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259266, "uuid": "62eacb1e-289f-4daa-a2c8-c869cc8f377c", "value": "yeni.odeme-pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7567db0-38a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Loda)", "timestamp": 1776242411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242411, "uuid": "24e6dc53-fd6d-4f21-b1f6-a596b3b9b189", "comment": "Malware payload (Loda)", "value": "6a0260afff0fea4d35c5872e71250c72", "object_relation": "md5", "Tag": [ { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242411, "uuid": "db1f6d88-f482-4102-9f40-e5f38723182d", "comment": "Malware payload (Loda)", "value": "9f0fe7144eabf6f7c421b594ba15f5f302f8983a73b85598e13af528ee6dcab3", "object_relation": "sha256", "Tag": [ { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242411, "uuid": "251810ec-4e15-4750-a9ff-36efdcfd9eae", "comment": "Malware payload (Loda)", "value": "0a6610ae92af5e4f444d4b41d82efb6acab6e450", "object_relation": "sha1", "Tag": [ { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242411, "uuid": "e33aa3f0-c6fd-43e7-bde2-0c2f7de54026", "comment": "Malware payload (Loda)", "value": "2999a91b6880c51b72200532231b581389e33e47d9aae1505d66966669a811f3eb9354c1ff80f413bf2dd480e9fbb16d", "object_relation": "sha3-384", "Tag": [ { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242411, "uuid": "f3e1a019-02c8-415f-ace7-1e912a815825", "value": "T17AC6339D3E8680EBE8C11474A72B9FD323F36DA516C58D3139C5744A71B3F76302A98A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242411, "uuid": "3a68c3fd-ad1e-4279-85c3-8f1297ec484f", "value": "196608:HL19Tn+tr8gW53n1K5h+ZWNxZsvNkP+7qZ8yW9EaK+vsDAnC+2F64fN:H59Tnod6nA5/NDcNkP+7qmZ9EyvsP5fN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776242411, "uuid": "68da94b9-5479-47e9-8136-0f583b1279ef", "value": 11603968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776242411, "uuid": "1dc400fd-8bbc-4ea0-b890-aecc5617b6e4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242411, "uuid": "b4191071-49ee-4539-81a3-c35edb65321e", "value": "SecuriteInfo.com.Win32.Evo-gen.36158221", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e61850-3912-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776288502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288502, "uuid": "8dcbaa57-21d9-49c8-8de1-8d39be6e224c", "comment": "Malware payload", "value": "b707f4b73d9595a4ac8b484f5560f377", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288502, "uuid": "d3eb547a-0f8c-45ba-83b9-f9e9a28c7f8f", "comment": "Malware payload", "value": "9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288502, "uuid": "f22f4008-b509-485f-afc6-8aa3ef2f2356", "comment": "Malware payload", "value": "6a23cbb7c03d4c0ef08707e25beb6e63e58f0e11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288502, "uuid": "fc018ac1-7aa7-4432-84ee-dc8a3b8335be", "comment": "Malware payload", "value": "368223dbed3f60705b8b33afe07551195b5995668dd4f19b83c843ba07dce1cf18b677de18f14d2979b92bcf7248dbcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288502, "uuid": "2c985a76-17aa-4326-baf7-b0695fbddf49", "value": "T18008338649DFC6A0C9E0CEFF807063F2D6F5BD56F12909984995F268A97E58DC00EDC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288502, "uuid": "25e00793-1531-4a78-a6e7-c936c36443df", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288502, "uuid": "fddde9e9-21ae-4a40-adee-689a85b734fc", "value": "1572864:stLozwYRG9l54/PA5h/sI3z2YVaevJkeGxyGGNyGQ9ZPOjOyyIHjZ7d+T7:sZo8plGA5h0I3z2eaevJqG4ByyIHjZkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776288502, "uuid": "0291f380-e590-41c6-8ccd-3593a5315837", "value": 84521014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776288502, "uuid": "fe46df55-d946-4554-94f1-3c36e54c5458", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288502, "uuid": "cf366874-1c15-46a7-8d62-15da8ca88c03", "value": "Application.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0837a89-38a6-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1776242400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242400, "uuid": "8085c707-6e97-479b-b641-d95fb8f659c2", "comment": "Malware payload (SalatStealer)", "value": "99a6f319c29144cfecf4381cd5a8434d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242400, "uuid": "2cc212df-eb54-4ace-85f0-4d63b821ba88", "comment": "Malware payload (SalatStealer)", "value": "9fa36e7d05d56fe84552e57b82e8bd87f882c10ff9126d154d066a5fddf39583", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242400, "uuid": "f93e8bd3-ac7e-4b2b-a52f-f0e94b7b58f1", "comment": "Malware payload (SalatStealer)", "value": "32e823479f6340681230c3f3869151e4c2c6322e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242400, "uuid": "0aac3362-9b80-4e91-84ca-dabf3781e32a", "comment": "Malware payload (SalatStealer)", "value": "23032b40284e19e894afa6363e5b745ba7cc0108fb99cbe4f20fbedf9082cbaaa0372288fc35639a1745f534e23e9721", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242400, "uuid": "f324d98a-56ae-470e-b49e-59f0d1cbd401", "value": "T1A0F533584E4237E5D40CB6FE969B93BC3E5E6C94BB89C93269AC230EFB5D48C0D0E445", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242400, "uuid": "9096d105-bbcc-44ff-855a-1136c1b2b6b6", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242400, "uuid": "2ab02b5f-625d-40f7-baf7-a48b066bdec0", "value": "49152:zsZr11hyQ+Y0VIfU7PN/rcynNGCCRBSxQFdCGEd7IOaWpmBHKUnowOX1i81MVuob:zgtr+5IfEN/rBNGCVy/NKUowOXcTx+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776242400, "uuid": "ebac6c55-92cc-4114-894d-4da78b5b7d63", "value": 3545600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776242400, "uuid": "59374c85-c631-4e89-bccc-fbd5f18cbdde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242400, "uuid": "24d08760-c65c-48d3-8240-0f05f33b42ab", "value": "SecuriteInfo.com.Trojan.PWS.Salat.389.11339.8821", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f39933-3925-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776296824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776296824, "uuid": "1bc42b2b-9d57-49b0-8b88-d0a7c4c0b1f2", "comment": "Malware payload", "value": "07a28319da3fc7351d5eda9aa471c83a", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776296824, "uuid": "fe1593e0-de5c-47d6-8273-c687c27149c3", "comment": "Malware payload", "value": "9fd97dcca457254031cdab7594dc5fc1015aac2836bcc7714a6c892ee1a2f8a4", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776296824, "uuid": "426d319e-2ced-4516-b4d3-17a53914a2ef", "comment": "Malware payload", "value": "3d33a5c88489337915bb64e06dc43346bde32c79", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776296824, "uuid": "a7a9637c-ab21-4726-9e71-de6ed47fcf71", "comment": "Malware payload", "value": "3d4073a512ebd5ebe7fc13a0d6fe6103c630574538e40008db1ffb133a1461485088c8c4c6ca3e02351a5b434b6b0f46", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776296824, "uuid": "f6365da6-6579-4913-9e1b-a862d327caaa", "value": "T1CCD3EDC8899E8CB48B5F6428051F6E178EDEA123071DC990BEDEEF453F115B471BA8E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776296824, "uuid": "ef52e7e9-ff68-4f6b-b45f-78a5e221ed04", "value": "768:87loOhGRyxbDZ3i4P7IRPVxObHX9wwpj6e6x696G62n0M97ATJFUxtzaWz2dsHv8:sdxmglXrhC3xaCas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776296824, "uuid": "f1001650-1ff9-46fa-aa34-022cb28e43ff", "value": 136844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776296824, "uuid": "921b599a-aff2-47d2-ad7f-2ac05610e851", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776296824, "uuid": "c6211c36-2f8d-497d-89dd-2c333478451e", "value": "Omega_Config_Europe_8934.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "145302ba-38bd-11f1-a769-42010a9c0008", "comment": "Malware payload (MacSync)", "timestamp": 1776252016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252016, "uuid": "451043b6-b9f0-4512-8017-5dceef3ea670", "comment": "Malware payload (MacSync)", "value": "a7397fd869bb33c13fa4bd845cc8cabb", "object_relation": "md5", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252016, "uuid": "70103668-b5cb-4084-a4da-c587a5d336a3", "comment": "Malware payload (MacSync)", "value": "a08f80d89df04f503711b12fbd317dcc1b8c6e93c91d56f1393a495a41d0f818", "object_relation": "sha256", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252016, "uuid": "563af9b0-ca79-4e72-b529-7d919e1bc5c7", "comment": "Malware payload (MacSync)", "value": "10c783a5f031c6b205b9e6173468d29ca7bcc697", "object_relation": "sha1", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252016, "uuid": "d21396c4-94af-49df-aef4-d66c97b1ec95", "comment": "Malware payload (MacSync)", "value": "9711b44e67f003e37cd4f72ff99382e841acf437433f24eface35404ada06362d3b0947a6dd1491e91f66399d7a1a1b6", "object_relation": "sha3-384", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252016, "uuid": "e6046483-3681-46b7-bdb4-d82339abf18c", "value": "T1273139C3B2479C3C14B284F0F005B023282DC8C5B6A8AD4F9A9EFA4C0A39227109F815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252016, "uuid": "a3f7d344-dd2f-4d0f-a105-13ce992633f8", "value": "24:BLitUvTtAsf73/dxjxdSuQ3IOKzRZ9sulLfhUu6uRpjT:9Tt7j3/dNx7Q+LBjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776252016, "uuid": "4f1fb3a3-9dbf-4869-bf98-1e12b322e672", "value": 1446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776252016, "uuid": "c43bf3e9-d3ea-48ca-bdb1-ac3400750d35", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252016, "uuid": "e8a48064-3b5f-4a3d-94cb-ec3a9b2d338b", "value": "a08f80d89df04f503711b12fbd317dcc1b8c6e93c91d56f1393a495a41d0f818.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "552e9efe-38bd-11f1-a769-42010a9c0008", "comment": "Malware payload (MacSync)", "timestamp": 1776252125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252125, "uuid": "e16df42f-1d7a-4867-ada9-796f60568afc", "comment": "Malware payload (MacSync)", "value": "5db52fc2645bd69b3e8b5cdf3f3b7f82", "object_relation": "md5", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252125, "uuid": "a24d58a4-ff37-4874-9ea7-6061d584e637", "comment": "Malware payload (MacSync)", "value": "a0cb3fefdb5c4fcc0ff9ad271be92a8bec06010501a03a808548da527236a972", "object_relation": "sha256", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252125, "uuid": "6bf9cec8-95d0-4650-a0c6-cf56b4232df8", "comment": "Malware payload (MacSync)", "value": "9ea94724f7bf761cd94b719a8a221c793594552d", "object_relation": "sha1", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252125, "uuid": "6f3f2a04-e303-467a-b2e4-4cf1ed54a112", "comment": "Malware payload (MacSync)", "value": "18b853960623f308f20ef8c77aec6471f9feeb43a4971817dd7f1d132f852a7efe16f17c2e6b567a30602c446b8c22ab", "object_relation": "sha3-384", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252125, "uuid": "ad074669-4097-4e08-86fe-cc9665e46a28", "value": "T1E621B9CF8A163A7978C64050DF29B739B587ABCC3622B94896CE85DCB006D7C77FA105", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252125, "uuid": "1490d5ae-3be6-49e5-a7f5-0c0bb314a3a4", "value": "24:NsHitHOUEVAM7xO/Sbzc22lMBR0SLWI9MAB+f0vWS1BijrrYL+bmdDgQY:N1O57xOMccR0SLWI7Bas8c9dvY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776252125, "uuid": "a1a8395b-4b65-48c3-8be4-34ffb3a4488c", "value": 1434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776252125, "uuid": "39646d02-1c83-43d1-96d3-6f159a9dc68c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252125, "uuid": "41277e91-3765-4e32-8597-61704788787e", "value": "a0cb3fefdb5c4fcc0ff9ad271be92a8bec06010501a03a808548da527236a972.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb4276bb-38fa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776278495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278495, "uuid": "b6587dfe-8f19-46cf-90bd-fe654e705ce5", "comment": "Malware payload (Mirai)", "value": "f174934b4bd70f2e963487ced09d7bc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278495, "uuid": "4b6b71e1-c1b0-4acd-ada7-553789007b0f", "comment": "Malware payload (Mirai)", "value": "a14b124762ef7ef8e7733eabbcefbd019b4bd7caffd76571b1c651b38141404f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278495, "uuid": "bb454969-2d97-4c5f-b815-cdb30e755edd", "comment": "Malware payload (Mirai)", "value": "3f785a3ed701bcf9004b4c0a0f64ed78fa6ec918", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278495, "uuid": "0c66ca09-ff9e-492c-9278-ee74b706be70", "comment": "Malware payload (Mirai)", "value": "15ff6c029345ed914c6c5c6dd0105bbccf4726246d20a98835b2f4dd49ee9de9de78a0b23c2ae1eeb52bf19b55635acb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278495, "uuid": "eac0bde3-7860-4f21-8c1c-1ad184d6e4b7", "value": "T1D5E34C46FA414F13C0D61779BAEF424933239B9593DB73069928AFB43F8275E0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278495, "uuid": "afff05c7-0f7d-4b55-9057-cb3ecae5319e", "value": "3072:2XFXMIMN6vwVRaXgfIOG2kJNrfY0uGSII4M/9x37I:2XFXMIMKCRaXgfIOGFDZuGSIjM/9x37I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776278495, "uuid": "f1272aa9-104e-4f10-be60-38a371081f24", "value": 149315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776278495, "uuid": "843eb983-e5ab-47f7-a1f3-96854b4a6661", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278495, "uuid": "1a110b85-83ce-4b58-93d7-08441cf530ea", "value": "FGx8SNCa4txePA.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27fe0b69-387f-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1776225420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225420, "uuid": "7b4ca9c6-41bb-4e63-a1ec-d413c13d60a9", "comment": "Malware payload (Phorpiex)", "value": "5a68000a4d08cb390d48186888ec7a60", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225420, "uuid": "9e09749e-951f-4ec6-b824-479df63f8d77", "comment": "Malware payload (Phorpiex)", "value": "a151bde114c4d1a3f2087d14941ce39be1d2e3f51b79b08c2a55d91a489cc9ce", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225420, "uuid": "77b6bc15-1bdd-4e09-aff4-85ed007b6595", "comment": "Malware payload (Phorpiex)", "value": "b5aff019401f1fa5962594cb6621a97f92cda133", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225420, "uuid": "337222e5-5b08-428a-96a2-05c2c2847960", "comment": "Malware payload (Phorpiex)", "value": "84cd47adc5252012f7649c38db71b3fae7363e19cdf5a94b1f5cd3be44386ce0e19e57c41ee64872a578926c3ba36560", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225420, "uuid": "6e4cf90b-3b13-477c-a3f4-9d57f68a7a49", "value": "T17B823B0FB9424216D0D200B49A76867BD97998B637C814EBF7D08AEE1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225420, "uuid": "68ce6dd9-11ba-48bf-abcc-7383091ec418", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225420, "uuid": "3a31a276-d963-46f5-8300-5810b66e06bb", "value": "384:5I78VGQic1fwvw077u9NHuagBhav8U9cg:iAj0769uha0Ub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776225420, "uuid": "bbc6fd1e-58d0-4b2b-ba74-4bc83cb09ec8", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776225420, "uuid": "a08bf9d3-60fd-40db-888f-c174b5bdb3e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225420, "uuid": "7d1b9f67-df81-49f5-8133-03f91c86cfaf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb04c44-3881-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776226317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776226317, "uuid": "7a51586c-b626-4a1d-bb09-19c90e769359", "comment": "Malware payload (Mirai)", "value": "61bac5e9c81e612406ee2e2068a45950", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776226317, "uuid": "a967dcdf-4d69-4f31-8e11-297cea258f83", "comment": "Malware payload (Mirai)", "value": "a19a7718acaef1a64c08dc90c3e59d5685b81c3e12ac0811dc0af44cae86cd70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776226317, "uuid": "313c35ca-9f4f-4a97-9f84-2c443136378d", "comment": "Malware payload (Mirai)", "value": "f7ac74022538d900d99773ac1172f6aa11d77961", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776226317, "uuid": "2555c705-e304-46a1-96c8-726fbf56cb63", "comment": "Malware payload (Mirai)", "value": "048ff7363ef9c9e9701eda5602f1151d67b6514569fe81ba5dec5ab817745857ebfe21857cef33b85de5a0fc6cbe2ce6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776226317, "uuid": "d97285cf-95d8-4243-aab0-5f90e0b0e4d0", "value": "T1C6F33969BA0F6C41F2C2C3F8DA8C87E13E1735E3C6778DA1790152EDDBA39D95980912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776226317, "uuid": "64451c0b-856c-4e20-a381-268a345b2bbf", "value": "1536:WZp34PkF4G/2r07HYXh5B8yOlz29b1X75J1+l50VyBIRM47En5p5M/LW:i3AB8yAMR7P1+/0Vy+RM47xq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776226317, "uuid": "6eb378d0-68d7-4174-9530-07d79ed99394", "value": 157544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776226317, "uuid": "37ad0932-ef24-4244-869f-a5d3daa97e74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776226317, "uuid": "e0fdd989-a51e-4834-9cb4-e2f87eb29cad", "value": ".Sassy.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a02e1c2-38b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1776250012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776250012, "uuid": "cd3178b4-1b07-4ca1-8d2b-d8fa200c0199", "comment": "Malware payload (Adware.Techsnab)", "value": "af3fda1aa23cbed650d5d4a92ea6bb96", "object_relation": "md5", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776250012, "uuid": "97a9dea8-15af-4db2-b13b-960c68356201", "comment": "Malware payload (Adware.Techsnab)", "value": "a2595f31c0eb387595223d187d0e3cc18e86fd4e130b7bdc6961ddf4b654cc91", "object_relation": "sha256", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776250012, "uuid": "305f1fb1-d65e-4c29-b52a-d495076bb31a", "comment": "Malware payload (Adware.Techsnab)", "value": "06a4030124456fae1d1c997860474f2702628ea0", "object_relation": "sha1", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776250012, "uuid": "804d26f3-4a39-4d85-bee4-204a85444b94", "comment": "Malware payload (Adware.Techsnab)", "value": "e15b33df620e244dca25e3a0365ae58874d249b5496f836c82e144c0075e6c24b4bb5389f2678effd0ad658d70df9325", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776250012, "uuid": "c5bc3678-1772-4719-9d33-a893de97c59f", "value": "T17B4318F29FDE0B2463C763204B46E8D7DD71D6BE7820AC78636580D9F8A9743E969070", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776250012, "uuid": "c31b78e4-3055-4d45-ac76-12101a9c96dc", "value": "768:p7qfOPBUmObuXLjj4ooLeKX604tv3vMReLYrNTkJX/1LVaT2P7i4arhv25qEDpDN:oe9n1FMReLYlk7jFDL4cDH1jyJD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776250012, "uuid": "11ee3973-8b08-4730-930c-2a30e322c525", "value": 55244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776250012, "uuid": "f26b2aee-c61f-424f-8dc8-e3eec5cd0ba1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776250012, "uuid": "ba5b8cfa-6865-41bf-93ba-90ab40f529f3", "value": "a2595f31c0eb387595223d187d0e3cc18e86fd4e130b7bdc6961ddf4b654cc91.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c60a60-38fa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776278600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278600, "uuid": "146bb275-82cf-4fb0-bef0-b8af12a204c0", "comment": "Malware payload (Mirai)", "value": "4085df7962c232a58d9a72edbcd4ad9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278600, "uuid": "4b1049b6-5755-422b-a579-b6f1b5302535", "comment": "Malware payload (Mirai)", "value": "a286413f47780b31160c34a23d86d1cf567b14e48f064319c0b23aa9ecd5192d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278600, "uuid": "ef9e23fd-51c1-4131-b9c9-86e654aab312", "comment": "Malware payload (Mirai)", "value": "4a7725c386d9395fb784104d1ee138b273f0786e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278600, "uuid": "81763c31-d498-41ee-b025-48b3939ae353", "comment": "Malware payload (Mirai)", "value": "5c69c0e1aaf2c1e678d3a89a73a32cafb9fe794e321b83cb263a0b28dae8ab00743bf3bbcd4c6fa4dcf9c3ce9d3d65c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278600, "uuid": "99986f6c-8126-4eda-825c-af9ddece8e9c", "value": "T1C913F791F8815A2BC6D0137AF9AF5A8D3321B3E8E2CB7217CD514B117AD561F0C6AF50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278600, "uuid": "1c5caaf5-aea9-478a-ac2a-fd1ce41367bf", "value": "768:2tyym5M/Bx/dRhFmE+m9phf8ZZQmItrPWxHbMbqN4tQapdPh1mA2EDEy0eYjW9Tt:Wm5GFmPmphUv/IpPNbqNOQafOPLpTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776278600, "uuid": "5a6db219-4f8d-4eca-9ef4-39eea43a9d63", "value": 43272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776278600, "uuid": "6dcaf186-d00e-474a-bba4-3836949244fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278600, "uuid": "e9b31406-5295-4090-a13a-ef029ddf8ce0", "value": "FGx8SNCa4txePA.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3b4711c-390d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776286751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776286751, "uuid": "8c6a310a-cdd5-408a-8090-fff57b911ff5", "comment": "Malware payload", "value": "51b9c44bedb92499da0bc89717ef414a", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776286751, "uuid": "5333c5f4-4db1-4132-8536-e13a60e3a20f", "comment": "Malware payload", "value": "a30571b25e08984710856a7f686a852ebfaf7dcc5e984d9773148615cf286b19", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776286751, "uuid": "32f07090-85fe-4545-ab1a-b46e5e9c9ca0", "comment": "Malware payload", "value": "16528664e8c324dd230d418df92eb9432109272f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776286751, "uuid": "ef9eda4d-b0a2-4961-9382-0ed057ed7e13", "comment": "Malware payload", "value": "1e30dc6ba718397c820b3afd73e03953e451a73e84c1d52a9a78feec770d5fdc301f36d174ed71b5d5444c0fb3f3b781", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776286751, "uuid": "70ddf117-e316-45cf-95fe-5ae04bb28673", "value": "T1645733D9682893DADA239931963D9B85D725BC3CBF5395211821B37926FB3A031F804F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776286751, "uuid": "be215863-da4e-4c36-838f-67e58373df98", "value": "786432:h3FUzUR8pCs925N4JB6Nxg1620pIRuqW5MBIb5cMvjx+V:JFUzkps925+SNSNRJssMvjc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776286751, "uuid": "dbefec73-b148-48b8-9e0f-7760d55b871b", "value": 29372416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776286751, "uuid": "8c358d04-18b9-4e11-acec-ce0aff67de40", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776286751, "uuid": "5059b9d3-e69e-43b5-bb8c-5b84dde754d9", "value": "SNOF.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "836ef706-389d-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1776238459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238459, "uuid": "d0832e25-5b0d-42e7-9999-4ddb32a3cf3a", "comment": "Malware payload (Kimsuky)", "value": "4b44eacbfe8299deb2c952ae5776c8c6", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238459, "uuid": "1fafbf06-28e5-49fc-8060-d64421ad9201", "comment": "Malware payload (Kimsuky)", "value": "a32e2d400bb7feb63d29738d6a31959228530974fe928b9c48787fadaf17d8a0", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238459, "uuid": "0d10118a-d248-4733-a71b-e4a0b8ca8270", "comment": "Malware payload (Kimsuky)", "value": "72638ffd88f29055f279c440b51f7d68419f68f7", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238459, "uuid": "d5c3d1af-de4d-4068-b30f-9e82303c63cc", "comment": "Malware payload (Kimsuky)", "value": "56bedbd732fad21d8924b31971d3b35e9f392d130217a9e00933c57def55844e958693a535378aac4e2145fcaad9e8bf", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238459, "uuid": "ad59fb39-c766-4ab3-87e4-13468ac27acb", "value": "T1D6729E450328851ED11B853AAC8231C962367F913CD952BAD4C2F73E6AB9ECD2CA2D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238459, "uuid": "202ae51a-9962-4540-aca5-9cde1a6c293c", "value": "192:tclOVaIe0a5zdYjNdZO0EHOeTUbMq/Wl3RCnTZentkpuA5Nr:tclOVEJ/kXCXWGkVH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776238459, "uuid": "83ff96e8-1e2e-4de5-bd84-41f0e1546ad1", "value": 16311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776238459, "uuid": "186b466d-5ece-4b1b-8147-f6bcb86af948", "value": "application/vnd.ms-htmlhelp", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238459, "uuid": "28b42eb7-f19b-48bb-94da-99790a9777b5", "value": "Condor_API-1.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02e04cc-3908-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1776284597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776284597, "uuid": "8d012140-741c-4042-a52a-590306161a51", "comment": "Malware payload (njrat)", "value": "daf4f2ef035feb215e3e70ca11d59fa0", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776284597, "uuid": "d1d5be36-a073-4638-8395-f6dfd4910129", "comment": "Malware payload (njrat)", "value": "a3467d8158e14ba6d86f46181da0cfd8143bb117087acf09d62243ecdcc60a82", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776284597, "uuid": "7fe13add-db95-4639-8714-2cfb0d2357bb", "comment": "Malware payload (njrat)", "value": "e02e260480c9e064f9513161ab8d6105429aa9a4", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776284597, "uuid": "d04c8a0d-0237-4a56-9165-f99089f55dbe", "comment": "Malware payload (njrat)", "value": "b2b99cd7a4809d3260b12799245a91ffabca0129faff83bf2ae8afb1a7adb56c453055342447b3ba9ad8fd4fdddc2fd2", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776284597, "uuid": "30cf0142-bf0f-452f-aae5-ce917ee02543", "value": "T14E45339B0600C664D8470B30C28BE2AB793D7E93752B464560AEB7D44DF3B5187AF0FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776284597, "uuid": "4c503197-6025-4789-b1a2-2eb2df62c787", "value": "24576:WYQcO9sadDt4Ip9A5ya0sLoSaVAcmrBLOUb96gMzbFtiAI9cim1xUnkTYURW:lQSadD+RwsLdaCPNj96gGKbBm1mnXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776284597, "uuid": "9a40580b-9713-4b6b-884d-0bc64ba3970c", "value": 1232896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776284597, "uuid": "f3aac2ca-0807-4cb0-80a6-75f359211a14", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776284597, "uuid": "b4879c71-f5bc-4f4d-9ed5-ce621e6c8f50", "value": "MT_setup_v3.22.7145.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff9b526-38b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776249996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776249996, "uuid": "e727afe1-cbde-49a5-9309-144f3353e61b", "comment": "Malware payload", "value": "20646cb5ac8c3d577648baa5c9a1bf5d", "object_relation": "md5", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776249996, "uuid": "fb3eab9e-e5c6-4e2e-9979-a68d7d7cb950", "comment": "Malware payload", "value": "a3ef9ba1b8756289d19cd2a2be3ee6813942c034541fd7eab8ff37a41b3fd5d8", "object_relation": "sha256", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776249996, "uuid": "786a1d42-0dac-4214-b71a-d98301fc6833", "comment": "Malware payload", "value": "5fcc9bca3065915af504b2dba891c935597c9928", "object_relation": "sha1", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776249996, "uuid": "7c6cc14d-46e4-41ab-a92f-f5acb1aaaec4", "comment": "Malware payload", "value": "e54031129d34c3ba88eba8c8625924f75499309faccc9b2231ff4299830a9f98cd60e3d8d7c83e3fb5dc6fdb6c27fcbb", "object_relation": "sha3-384", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776249996, "uuid": "ed34e3ec-0a6a-467e-8661-0e363a3b4b0b", "value": "T16E3354C5A524611B492B2212F83472F85E7FDA73F0C8714631E698FB1AE441E3F8A5F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776249996, "uuid": "bc48967c-5113-434d-9d5e-fc50844afe24", "value": "768:o/PcEfrJLMVJlZASE2wlR+dmyfDfoA+r5ZNRBl+p239C0w:Y1r6tw6fDO5ZNIp231w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776249996, "uuid": "39660760-c4cb-4fc4-a8ad-72c21229c579", "value": 54004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776249996, "uuid": "a8de24ea-7572-4bca-9338-7ea49f518e2c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776249996, "uuid": "b2ae8b96-222e-4631-8f81-7031355c1cf9", "value": "a3ef9ba1b8756289d19cd2a2be3ee6813942c034541fd7eab8ff37a41b3fd5d8.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99c0f2eb-391f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776294331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776294331, "uuid": "b9281da7-9102-43b2-993d-41410dc0cb68", "comment": "Malware payload (Mirai)", "value": "e64634111af637b16e309c583c44353f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776294331, "uuid": "ebdd991e-a7cd-4e91-81d0-ff283a577b0d", "comment": "Malware payload (Mirai)", "value": "a4d3bef4fcc8b86d15ec9ad87d41e7fe58ceb13e6ed4c1e4e304fd27a1597547", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776294331, "uuid": "b5afb414-9f43-4986-8a8f-0bab03d9bbb9", "comment": "Malware payload (Mirai)", "value": "8750f31dd6b57a329a1500d1a21f3b5ffffa0a81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776294331, "uuid": "f905baac-f77b-401d-8b98-18cd32ad8a79", "comment": "Malware payload (Mirai)", "value": "a9385906c256036c99a34ea26b6f14b0f1c50c4fdd5a5cb1b35ea2bd3be91f9dd9aa5a55f7e8212dc71229f24aefb0f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776294331, "uuid": "99b98a0d-a93c-47bf-b65e-351e6aca3259", "value": "T116C32B06B30C0947E2633EF43B3B27E1D3DFDA8121B4E640655FAA8A9172D325586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776294331, "uuid": "f53a133b-34ad-452c-a0a7-538222afb954", "value": "1536:jCJsfwVuxrEjpgMF3faafuL2oWWNvAuD5Th1NN5Setq+RoPTj:jUtUxWgOfaWuEhuyrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776294331, "uuid": "c5bc879d-84d9-4bcd-a807-0051a34218e2", "value": 125604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776294331, "uuid": "09655e48-e9ce-4e75-8c90-a4357d2b0e11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776294331, "uuid": "2e2da548-8b11-427b-ab71-77aacae8a0fd", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "562a3c91-389e-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776238812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238812, "uuid": "7848fda9-80f7-46f9-95c0-1906ed12fb68", "comment": "Malware payload (Vidar)", "value": "b41c8beef70ed87de4b7c657895db8a8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238812, "uuid": "63888ead-d9bb-4280-b2c1-52d8d2c81b92", "comment": "Malware payload (Vidar)", "value": "a4e7073a33e298e515498cb2391dff2219d070aeedd17b9ccb8c9930b85f4f03", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238812, "uuid": "f09abacd-dcde-4b90-a1d7-616b402c4052", "comment": "Malware payload (Vidar)", "value": "96a58231c5d7aefed9af0aa7bbb7d92dda503151", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238812, "uuid": "d5bdb250-50fd-4202-8dca-820f242aa62f", "comment": "Malware payload (Vidar)", "value": "76130a53d03e162ba66cb1ac108b73681da55a7861d59f26e256b7b35f4adfe95b0bdc4c9decc16b141ab515f4dd2195", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238812, "uuid": "839053a7-c32c-49a4-b53a-6e92fdfc434c", "value": "T1E8A5AE1B6DA109FAD4AAA3328CB662957B70F8090B3233D32E507A783F727E41D75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238812, "uuid": "379f88ef-8a02-437a-94a5-fe9af29ff202", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238812, "uuid": "03b0c623-85d4-4f0e-8caf-88b30778e05a", "value": "24576:z4LXe8JqrbSLZ3DeszkQXEHdcl+GenbHn5AACpTo65kREFlr00DdjuBh3cdDelef:z4LOeqrsZdkVXn5ZCpTJSEFxhR0dzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776238812, "uuid": "159f8026-f573-4771-93fe-7742161c07c8", "value": 2243200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776238812, "uuid": "2620aa9c-1728-4aa9-9738-cef80b6d78fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238812, "uuid": "c458d494-ec93-40f5-a8cd-940fdda38078", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c255a07c-389f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776239423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239423, "uuid": "5e87299f-f33f-4be6-bc64-b0de61cd1f42", "comment": "Malware payload (AgentTesla)", "value": "407919e1b40de19c253df70859efc705", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239423, "uuid": "c1ead6e7-8b31-4bd0-a113-7032119b85ae", "comment": "Malware payload (AgentTesla)", "value": "a53596af683dd07d6604688d4e4fa96aecc4b72f1e4fed1e02fec0222ebfffde", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239423, "uuid": "a3ece8a4-9282-49a5-b950-32b0e6156a67", "comment": "Malware payload (AgentTesla)", "value": "bbdfb09c63d8d163a0517637379300ba9997e4ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239423, "uuid": "87c6f963-5584-442e-8d82-918ee0581641", "comment": "Malware payload (AgentTesla)", "value": "0e8db090f2a4a7faefe373399a23d558a100df323eae50990993cb3b204428e8a14f18bf568639388cdf72a96a2ead40", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239423, "uuid": "8e1162a5-771f-4cef-941d-d5162980ffd5", "value": "T103D5FB71B933DF9C5AA6DEF3A64FDB9182D3290F83D6E44624724B0C2A109D40E9357E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239423, "uuid": "c35f0bf0-3d8f-4735-adfc-342a30a28715", "value": "384:4DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDL:YAnM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239423, "uuid": "7f57480a-dd94-444e-ba65-65d175349db5", "value": 2929073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239423, "uuid": "139fdd85-e83d-4481-8c9f-b7601d693df6", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239423, "uuid": "602d05b2-ba50-493c-8b4e-ec89ba8390b8", "value": "N\u00f3mina de ABRIL de 2026 14848483.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f01c87d-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (GoToResolve)", "timestamp": 1776239659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239659, "uuid": "5406016c-74c1-4b5b-bf88-4a49a5426674", "comment": "Malware payload (GoToResolve)", "value": "ac608a926c457868bff0379713cfb58c", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239659, "uuid": "17f4f80c-885a-411b-bbbb-ae26acc6406f", "comment": "Malware payload (GoToResolve)", "value": "a549c8c52d6237564dd94c08fc98f9ced50a20de25da52db8b8518c1604fdf71", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239659, "uuid": "8f31f122-bfd0-496a-802c-976ea81d438b", "comment": "Malware payload (GoToResolve)", "value": "1146adf262fbb0f497630b77edd5e4f88ebeb4fa", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239659, "uuid": "f616cc8c-1424-432f-b602-b6bad9426e34", "comment": "Malware payload (GoToResolve)", "value": "297f6dae6b23d654fbf6a4d37844e565ba64c85d895fc92ecfbec9adca8b384523dd168678891800b39ecc13638d53c3", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239659, "uuid": "2beda4ca-9264-45c4-9284-546377e94acd", "value": "T1E56192CDB203E109CBB3D43580B74C2DB6A56076D6D4E5313EC8CA88CD19324ABED16B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239659, "uuid": "ff4d889e-5e2c-4ee2-90dc-23aec4e89cbd", "value": "48:KNx1dmdMsEvDxTP1tre14ma8OEExu793AVYYlrpRsaA064t4+V2:K3eM9c6ma8hQtLRAYt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239659, "uuid": "838f0b9f-ed80-4ada-b0a1-deee898ef0ce", "value": 3378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239659, "uuid": "db51f7b0-aced-41d6-86e3-f398cedd2e44", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239659, "uuid": "6835ea85-79f0-41dd-b466-0157d3f51644", "value": "Adobe_Reader_Access_Document.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a3c9e82-3912-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776288694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288694, "uuid": "cc9b5d1b-eb3a-43ea-bcdb-981c3438d74c", "comment": "Malware payload (Mirai)", "value": "8b1fcd28e1f19ae9d419a31a74ac7264", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288694, "uuid": "94d2f734-addf-4fbc-b09b-b587ede7b6cb", "comment": "Malware payload (Mirai)", "value": "a54e6668cd82259813246bdab7b9b028eb670c016d991f361caff7aaf98b0e38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288694, "uuid": "506dbd74-7cac-4775-9223-317d52c65273", "comment": "Malware payload (Mirai)", "value": "24b6309f0a451bfcd20ecf268717c7b59abdceff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288694, "uuid": "17447a8b-e682-48e1-a285-c038a720b729", "comment": "Malware payload (Mirai)", "value": "8a1da7e03df257425908f56a3983833ec39419dc7c79c65ca0c6e045fda811636fb6dcbc19075b0f031d22b44bf8a903", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288694, "uuid": "5b35a39a-b5ea-4124-9e96-6b09b67101af", "value": "T1B8D3070ABF711EFBE46FCD3345BA4B49289C450621B93F363674D81CB25A68F1AD3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288694, "uuid": "465a312d-13df-4158-b8ef-74e2f669a2f1", "value": "1536:1AzIjmutuMgen5/yGob1p6i3if0kBq5YCp+bJs81mMHd+Ljd7NfZfqFX39wu7r8L:1Uym1pFdNMsgnyJ/09uF9mAmn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776288694, "uuid": "adddbaf1-484d-4154-8c57-35802323140e", "value": 130140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776288694, "uuid": "d421914f-dc90-4afc-9d11-6c4f340f1135", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288694, "uuid": "db9e30a3-4ca6-4c30-8f84-280e07d60b43", "value": "splmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4b794fb-391e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776294000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776294000, "uuid": "b570db0c-65a4-4f3a-a55a-bbdd6aad0956", "comment": "Malware payload (Mirai)", "value": "429e16051ba60674b99579f626a9de3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776294000, "uuid": "081abe20-3c22-4116-831b-2f15186aee7f", "comment": "Malware payload (Mirai)", "value": "a569b753c6a424e1051c67e4cf1b222b847d3c4930f89dabcb66f8fe971ba92d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776294000, "uuid": "62d2ea20-6513-4f33-9a8f-9145ec19cf8e", "comment": "Malware payload (Mirai)", "value": "615b71a5f6ac4cf697d44a559089a43693257697", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776294000, "uuid": "e51cb747-415b-456f-83f3-04b2baa07f1e", "comment": "Malware payload (Mirai)", "value": "30cdfa034719174c62d4ae4542e1391c539173f5b06fb1ec5bbed7791848041ae95317fdf5a142f5e074e99b0bea567c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776294000, "uuid": "78ed7aa5-0335-4ed1-826e-6472a3a48c96", "value": "T15BF34BA9BA0F6C41F1C2C3F8DA8C87E13E1735E3C67A8D71790252EDDBA39D95990502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776294000, "uuid": "ef713fed-1226-46f6-9137-62e0317a79c6", "value": "1536:znD7shwPTvDNfQSgAHAw6sx196muRu5qKb1q7EMDzb4rWy5HZMTUEn5p5M/LW:zHOgf7vtx19Su5/Q7DDzUrWyZZMTUxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776294000, "uuid": "8810aa51-8b7a-424c-92a5-931e60758746", "value": 165736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776294000, "uuid": "a59f2f24-48a7-49e6-afd6-1e06185ff5f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776294000, "uuid": "1c120b70-df79-48b8-aa1d-fd00b2fea9f1", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbbf9854-38c5-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776255840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776255840, "uuid": "0750c852-daaa-43b8-91f2-898ab4a5025c", "comment": "Malware payload (AgentTesla)", "value": "e9c28ab7d94c9262d869e58dfab9883d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-crescentegramas-com-br", "colour": "#ABA7E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sativagina--crescentegramas-com-br", "colour": "#B9AE42", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776255840, "uuid": "522abb15-3568-471a-9d8f-54c9cc113d75", "comment": "Malware payload (AgentTesla)", "value": "a5bcd997e541d7fbf90266152e2d1a4e8780ec6db17c580723571b74cd6d9ad4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-crescentegramas-com-br", "colour": "#ABA7E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sativagina--crescentegramas-com-br", "colour": "#B9AE42", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776255840, "uuid": "096bd04a-fb67-4ae8-a401-81e1d4d05890", "comment": "Malware payload (AgentTesla)", "value": "3dad184503a39570d332e4204bc075fe575d2a12", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-crescentegramas-com-br", "colour": "#ABA7E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sativagina--crescentegramas-com-br", "colour": "#B9AE42", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776255840, "uuid": "282c3bfd-7eee-40fd-8e35-e314efd505ef", "comment": "Malware payload (AgentTesla)", "value": "409a22f9d2e091f83fd8f56fc8548bd0f20c4a9ee6d3436313ca070a91160abdea2a7751cb6eaea5b9d5259fc6a4aabd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-crescentegramas-com-br", "colour": "#ABA7E7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sativagina--crescentegramas-com-br", "colour": "#B9AE42", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776255840, "uuid": "444897aa-6a8f-4fc9-a0a3-f104a6f43db6", "value": "T19F66D818C0BDB20E99E3D759B83AE5B04C8F68AB1E4DAD8A240F953D2D05F9355601FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776255840, "uuid": "29dbeca7-0f38-472b-894b-ffd44d068462", "value": "98304:3NpVqgI7Ged0phPjRNs71PC70U9LUBuFQjmvaEOQ:dpIvF2rNii0jjTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776255840, "uuid": "e4473161-e34c-4587-81e2-f04b505394b4", "value": 6690054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776255840, "uuid": "645f84eb-403f-4b27-af3c-dac766592256", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776255840, "uuid": "021f1d2e-0962-4034-a101-84ea15cd2177", "value": "Nuovo ordine.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00828a37-38ec-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1776272169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776272169, "uuid": "24c227ea-5076-4f56-8416-00ba806bd926", "comment": "Malware payload (SantaStealer)", "value": "07bb94102a2dcac9185180c7a881d756", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776272169, "uuid": "d0a6c65c-c01a-495c-811f-2a5904c577cf", "comment": "Malware payload (SantaStealer)", "value": "a62c9af4e08d7d752397e14a97885c009e4f53b281f2ccc3a943eb808ea44cc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776272169, "uuid": "1933396d-7644-4b9d-b590-d0823ac82eeb", "comment": "Malware payload (SantaStealer)", "value": "3762ec9968cf07c0d4ea45b5a1024d2ccd5b991b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776272169, "uuid": "14457903-ca69-4e03-b6ab-c637434de2e4", "comment": "Malware payload (SantaStealer)", "value": "170c6ee9c948e4110bc098c89ff841089045822ef14fe2223aaad69895a150013759a9a82bf74fa3784e4cf372714f0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776272169, "uuid": "04ee2431-8f14-41c6-b566-5d506a12d385", "value": "T1096773ACC58834B3F7F6B40FF7956A5E4D8EE9A88E952A09D24CF62536056C01C3394F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776272169, "uuid": "e20ba09c-34bf-4a2c-abb9-821a81f5f4c8", "value": "dbb9126ff9a9589faf6907bae6a7342e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776272169, "uuid": "507101c0-35aa-44b8-b2a7-40997a460317", "value": "393216:RXlBQRoR0EQDneIjT/VLvp5Ol7erXj+01zTb9s+DmVmlyupEJARWGOruteFd9WTF:RsSADD5zpjfC+CMGARWvVb9WV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776272169, "uuid": "5157d62b-e176-4220-b610-f2849c1b455a", "value": 30993875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776272169, "uuid": "754d414c-f3ea-4350-8e35-5671bf44d787", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776272169, "uuid": "6643e236-44ac-4e75-894b-a419694e29e9", "value": "JustLuck.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2611eadc-38bf-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776252905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252905, "uuid": "b2a21873-eef5-4943-aefd-2c1743d93354", "comment": "Malware payload (AsyncRAT)", "value": "b7847dfb1a5704b43c5d9369844898e5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252905, "uuid": "355628e2-4d50-4bba-8ad4-b3307576580f", "comment": "Malware payload (AsyncRAT)", "value": "a65c6f7e36a274402a40b3dd676d50ed00505bc7e7c1ec34faf1c88bee76c990", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252905, "uuid": "b747dbb7-5ebf-4197-ad62-01c8f3057eb6", "comment": "Malware payload (AsyncRAT)", "value": "3f0ebab552b29fdbcfe608d6f4ac89c3475bf27f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252905, "uuid": "9a4bdc13-c15d-4f04-8152-c5f829b257d7", "comment": "Malware payload (AsyncRAT)", "value": "af26080d576198eb3b699907fd14c25a1cfc1c8ef0f5aba4f45104db6ff1938a08d791a9878bb9d07ebab838c91d8d72", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252905, "uuid": "5870111f-e6d4-4b68-903b-639386dc291a", "value": "T13505121D129CDB0AC6AA1BF468B0C2B41B786D4CF860E957EFD37EDBB8367149418316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252905, "uuid": "6766d3e1-48b0-4ddb-80b8-b3b529aa7a0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252905, "uuid": "f2606ebc-7eed-440b-8d10-166d690dced6", "value": "12288:2QwqwhbgzThjUfCoQq9mDX6jAt5GWN/I+PE7PRRLS4gslKeo9XGNM4sXL6mLJMQ:2hXMTJJo196eAt5lN/9PE/Llxo1FtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776252905, "uuid": "88ccaca3-e6b3-42ae-adf8-9e774e2027c7", "value": 857088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776252905, "uuid": "920fb0f4-910b-4491-b463-e5104657ddbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252905, "uuid": "67e7548d-ab9f-4467-b4df-02ca2b977ef8", "value": "purchase order-385032.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a905ef-38b1-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776247188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776247188, "uuid": "68ff588a-a3bc-4163-9946-44a0ee119a73", "comment": "Malware payload (RemcosRAT)", "value": "744107d40af154b8ce0f910c88a547d1", "object_relation": "md5", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776247188, "uuid": "3c93ebc0-699c-4753-97c3-fae901659b21", "comment": "Malware payload (RemcosRAT)", "value": "a7b3f28b7609eac91df3e7d1fb9cebd2cba826a0d8caaa660b17241548cc61f0", "object_relation": "sha256", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776247188, "uuid": "338bfa5d-602e-4c52-8ab5-067ffe51914d", "comment": "Malware payload (RemcosRAT)", "value": "a2c42b1026d7830ca94295edeef7fa728027aba5", "object_relation": "sha1", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776247188, "uuid": "26444304-a131-449f-a36d-5c428e3eacd3", "comment": "Malware payload (RemcosRAT)", "value": "0d08d007c503c8826b79d60a08249e18a8eb684f2d22e8e3d8746d59ca2dfe0b49d94396d804a66c5985e58e557138a9", "object_relation": "sha3-384", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776247188, "uuid": "a2ab6715-aefe-4bc8-ae04-e105dcad399e", "value": "T1FBD45C95A3D441F4D077C234C9C24537E6B2B8056670462F03EB5E6B6F237A29F2EB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776247188, "uuid": "1b13d15c-d361-488e-8d1a-cbd6c0035d6d", "value": "8b3e0763eddbb01367bd21396e110071", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776247188, "uuid": "52d8c108-28a9-4218-91c5-bafbabbcc430", "value": "12288:5aMwmp7scoHvln/+iB9PQoYYUPGmdou5usyW:Y7mScoHvln/+aPQoYDPGmd35o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776247188, "uuid": "5a7de931-3e13-4355-bc1c-9407a49f445a", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776247188, "uuid": "4192dfc7-31f0-471f-bebc-4fa0ddf45fe8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776247188, "uuid": "2bf14170-acb4-415b-98b2-801d013d122d", "value": "a7b3f28b7609eac91df3e7d1fb9cebd2cba826a0d8caaa660b17241548cc61f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f4e841-3880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776225872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225872, "uuid": "31bdcdfc-71b5-4538-bcec-855e87e8fd8e", "comment": "Malware payload (Mirai)", "value": "5ae3e819b506b50f337829c71e4445de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225872, "uuid": "1f4a8731-dbfd-401c-962e-6c0dab1558ce", "comment": "Malware payload (Mirai)", "value": "a8753b7732ece2bb221a7305a86266a20bec95224927d43e7b87f8f1e4ad7a9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225872, "uuid": "71b9cddb-870b-471c-b3aa-08b2dfcfd5df", "comment": "Malware payload (Mirai)", "value": "35f66356700872a4709ac32df57a7b0a4b43262e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225872, "uuid": "b9c1594b-59e7-4b91-bc23-ee30dcb8a623", "comment": "Malware payload (Mirai)", "value": "49d6b5ff0fc35f6bc0c02af77981d1806cd76107c9b5fcb58ea8006f6e0dc9157f68d1bad6850173d363df34fea9ea64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225872, "uuid": "e153d90c-dbf8-41ee-8590-39144a053404", "value": "T124C39CABB24F1050C42647F51BCB5B9C2E2324019E2B9AE77C6E373E2B365DE58063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225872, "uuid": "43dadf06-afcf-49eb-9998-ccfbf9422d2d", "value": "3072:i/oB12LNEBITJPScwKJSIqgI85glCzfQffHXDqz:i/+1FBIxS5b7gVCCzfQfbqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776225872, "uuid": "aac82dd7-da65-4979-9a97-a8e4fd1dc76e", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776225872, "uuid": "c3c3d61c-0910-42d5-abff-58dd9bdeb8e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225872, "uuid": "3c0659ce-9be0-4e34-a9b0-ea9711135670", "value": ".Sassy.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee4dfbcb-38f8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776277722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277722, "uuid": "728b64e3-0da6-472c-97e3-9ca9d4096baf", "comment": "Malware payload (Mirai)", "value": "0ac1adfab156c91f3cfc2f99cdc14185", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277722, "uuid": "2ddee376-64a8-4e53-9eb3-586e50a767f3", "comment": "Malware payload (Mirai)", "value": "a90d8a5e0a902201adb3acb34e7e6efc9df68edcda58a824892ba3ba34406e54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277722, "uuid": "952f5d41-03f1-40e6-b7ad-3a31eaf15d6d", "comment": "Malware payload (Mirai)", "value": "ec32bd93767c73c930b8bb84ae4a36fcdc12d773", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277722, "uuid": "1bccca5a-242e-4be4-9f24-29ca0f6272dc", "comment": "Malware payload (Mirai)", "value": "08d958bea3fce3951526de7cf9e0e6af7d639a5cc98ca590d0558e2dc61b11461f4766061302fcd6c3d3ab4c5433688c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776277722, "uuid": "b225a2a8-02b6-4553-b392-4b73f4a06bb3", "value": "T17ED2E19892D0260BC4E78B3DC32D58FE50B598DC130BDBC262EEE6401D4B15ADF7EA49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776277722, "uuid": "e6fbeac3-9809-4bc4-808f-9817157a44fb", "value": "768:BnZvT1iw5z24QOS9CrBNHghbIXUjR8jaayJWycs4ef3ofb:BZbYuKyLrBpghDjR6cTFfcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776277722, "uuid": "deb327eb-2a6a-4fe5-b140-9e2137242fe6", "value": 28684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776277722, "uuid": "310b90a0-060a-4193-93b0-d17d0320377d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776277722, "uuid": "ff4f5b9c-935e-41cb-ad30-57a24f7529c7", "value": "FGx8SNCa4txePA.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237eb799-38ce-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776259343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259343, "uuid": "4a3c4380-20b1-4c00-8422-8e90d41c8601", "comment": "Malware payload (RemcosRAT)", "value": "de20fbbdd7690a15718caadfb10dd8e9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259343, "uuid": "0761f314-26ff-436e-a571-ad9037c576b4", "comment": "Malware payload (RemcosRAT)", "value": "a9162085e46a67728e0f4a05a1adaeb4221ccffb0954b1ec80e976250307450a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259343, "uuid": "602ced43-2cff-4da8-8b64-02783dc67c3e", "comment": "Malware payload (RemcosRAT)", "value": "0bc6d21de0b2259bbfacc04fa62672989105c0f2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259343, "uuid": "216370ab-738f-40eb-809e-525e1388fff2", "comment": "Malware payload (RemcosRAT)", "value": "2d43deff04a754c581082da847ad9bbe23282a90a7d96f1c791076eb2135193a2e85e3c7fb22bb6ed0e360d917851401", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259343, "uuid": "57f4c1fe-b57a-49b8-bae5-08a099db4952", "value": "T172764F04E1B8B12677D2DF9D993EEA70884F68671BCDCE61305FD22C281CE5356606EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259343, "uuid": "aa9781d7-6429-45e8-9db7-f2f4e728c7f1", "value": "196608:suNC54szV3VeAbdTja3f9TkdYb3lVCcVYyF96Pv9bQ:pW4J3l1icVF+ZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259343, "uuid": "3e1d7e45-d9a1-4504-80ac-af996070fee2", "value": 7443718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259343, "uuid": "a2421e72-4c37-4329-b1fc-bb87114fe0c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259343, "uuid": "5a680026-45d7-4a8a-8237-88ed53b6e584", "value": "Gloves_PRMXTAOO6OO6.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531cbbbd-38c2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776254269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776254269, "uuid": "73364151-c262-45b6-8293-f8b06ffb38c1", "comment": "Malware payload (Mirai)", "value": "da886c15f311be49e757bdf2cedd26e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776254269, "uuid": "3680f484-a7f8-478a-9136-de0baf32f6d2", "comment": "Malware payload (Mirai)", "value": "aa5c63ec39366cb105756b548347f1fb0b546d683aef533abd37e2e90237c8c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776254269, "uuid": "2e919638-39a1-46b0-b609-31e7abfa0ea9", "comment": "Malware payload (Mirai)", "value": "17297bc8bb57be97dc67d129432c2702b18eaa1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776254269, "uuid": "ee94422d-8688-4d65-9827-147ac0f6cb41", "comment": "Malware payload (Mirai)", "value": "329aa0261bc93d93ea235122f6fe73ca8d2957f82ae69f44ae9f59a1c1ccfaca7db95d6d7a6de565ec3a895f03dd90fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776254269, "uuid": "23334550-a8ac-48d4-8d09-03b5d9fe5a3b", "value": "T15B7302BFD91A388FC767CDB8B5DD8016996C338266CDCBFC26974C4109A31E5242E1E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776254269, "uuid": "5e5c5baf-5ec6-48b0-996c-32d45cec1e2a", "value": "1536:zqhafLKcISOMVYuhThqFd+m+yi+87NcSOXaaMhfyVFpOkXJy4ZbdZR:zX1ISPYufadT+yiHmSOKXy3pOB4bd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776254269, "uuid": "fd75fb91-2ab2-43d9-9f63-d912f212ac85", "value": 78868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776254269, "uuid": "1a1a149c-3be6-438f-b043-dfca360f4f86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776254269, "uuid": "ddd56f9f-52a4-45d8-a2c5-18306f7978bd", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b35fbdc-38bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776252242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252242, "uuid": "5491f235-833b-46a8-a3b1-0a6f4d96e72c", "comment": "Malware payload (Mirai)", "value": "f7ff8c11e7c9b2455bbdbdfc337f8e47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252242, "uuid": "0ce7ef3f-7bfe-4c7f-8ed9-a288150df425", "comment": "Malware payload (Mirai)", "value": "aa640ee976ff58f087abcd029c2ca2db1c6a4c56220a093b54f1362460fad53f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252242, "uuid": "47b4f917-ff4b-4bc2-b286-3a6bc5cb3741", "comment": "Malware payload (Mirai)", "value": "f4702e85a45c213cab026a3d83c082c461100559", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252242, "uuid": "28adc2b4-a050-4d2a-9d63-d2dc458c8428", "comment": "Malware payload (Mirai)", "value": "82cac3713bd65b09ffc15261ad6e1c1329f38f282ccc9fe862c128a72434b1bf72f5cb68dadbc68b512ff754c39294aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252242, "uuid": "7d77e5f5-5ca6-4db5-a218-fb8b044c5b47", "value": "T15A1439C7F800DDBDF40FE77A84630915B530B7A210931B3B625BB967AD3619A0963EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252242, "uuid": "612d33f1-a31f-4fec-8cb2-79b250c5977e", "value": "3072:gelSVOIyIAz0+no6UJnnA3nabYbOUkpOjk/8wsqe1b2PjTudRFJ5lgsbVejbiqLX:hlnw4SYbOUdwzWb2PPujjgsgLM2yVHkj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776252242, "uuid": "cd7d93d5-e459-489f-b94d-b00886c14390", "value": 207584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776252242, "uuid": "0597b2b5-9a7b-4c2f-a5a1-cd4d3d6a1179", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252242, "uuid": "43cc64e0-4a22-4dc2-9e89-7b8f010f7131", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc2dd04-38bf-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776253025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253025, "uuid": "50741cf3-1af0-47eb-b71e-d3251ffb40d2", "comment": "Malware payload (Vidar)", "value": "911b811b8f195016ddb425d42140154a", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253025, "uuid": "3ae63ac3-4709-4756-b6bc-ae4991058864", "comment": "Malware payload (Vidar)", "value": "aa85d8c2244084703774d4243e1be0b85c7484eac30b0995e5d2432b43f78b4c", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253025, "uuid": "f75cfb53-3118-49ff-b7e3-5c605df0ce23", "comment": "Malware payload (Vidar)", "value": "9d263709ea277141029152165c557e851147b1a3", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253025, "uuid": "7fb234b4-2b68-4fa0-b49d-5ce5e89165cb", "comment": "Malware payload (Vidar)", "value": "8a234530186ee7a25ae10f996ec634acb642dca16b2bb4aafe24fdbf59129d5446fab58c2cffe698c37828becdebebcb", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253025, "uuid": "64a00a50-7aae-4925-9b6a-6a15f1eb090b", "value": "T1C1A58D2A7CA144F6D09AA736C9B225917B70B8080F3233C72E9176783FB27E45D79758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253025, "uuid": "d4e0da17-84d3-42a2-885a-2a18a895e2db", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253025, "uuid": "3a04eaf0-f890-49e7-8599-a782d9b124c0", "value": "49152:TfM2s5MZW0wusbRBSsak1niU+6f7w25Cd2FYD:TD253t1niU+6f7w25CqYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776253025, "uuid": "741790fe-88c7-4cfa-8086-9bb68abd6328", "value": 2213504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776253025, "uuid": "af345459-1d8e-45b7-8155-93329eae96b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253025, "uuid": "b24db54e-36e7-4da4-ad9a-84483c50113e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df0d320-3925-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776296834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776296834, "uuid": "7a998778-a831-4802-a6c6-d60e9f91c2dd", "comment": "Malware payload (Mirai)", "value": "2e418b491b57c79c6816e058a6138b4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776296834, "uuid": "956441fa-1bf2-4372-a9e2-17ba908ce6d4", "comment": "Malware payload (Mirai)", "value": "ab49bad666a613ef9463a859c84d2784190b679056c7ea8d73708dd63342d4dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776296834, "uuid": "5d9e8326-0698-46d3-b2d1-87aed7ea49f5", "comment": "Malware payload (Mirai)", "value": "7d8cc06506b25f1b712a21f03fcb009b070b9243", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776296834, "uuid": "09ac4d97-8ee1-474c-8418-1c29aa448710", "comment": "Malware payload (Mirai)", "value": "800bd7d5a7854d8ddc92e09672e8ffcbbcb5b894f3fc06690bde32920ea0a18c4849d7c73f578c0df2ddb9d1a7a35ace", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776296834, "uuid": "b3f2050c-d483-490c-8814-ac4c6f2d3654", "value": "T1CCE3C81A9FA10EBBDC6FDD3702A9064235CC954712A43B7A3674D538F64E90F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776296834, "uuid": "02aedd27-a35d-49cb-9c48-db097ba0dc62", "value": "3072:MBE+rwbBgJNrzKk83R5SXa3F0kVBbJnCI:MBxrwGN9832c0WbgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776296834, "uuid": "03613ef8-e9b8-47a4-b906-0085f6ff06b5", "value": 156720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776296834, "uuid": "5ed79cef-7247-49e1-992b-06094625f129", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776296834, "uuid": "7f1f2111-e476-482f-8001-f745cc91ec0d", "value": ".Sassy.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab5dbbb-3922-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776295540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295540, "uuid": "4a4481cd-4599-4882-9b87-7fee641b1445", "comment": "Malware payload (Mirai)", "value": "961936a02610a0169f1658bce4c4bff7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295540, "uuid": "f7b9058e-84c3-419b-bd0f-c4ea3a77f728", "comment": "Malware payload (Mirai)", "value": "aba7bc64fa57c4acb34a72b172b79add710a327b54d3ce3a01d77c2bf3ec31d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295540, "uuid": "239985f7-29e3-4eee-ac38-1245e428fda3", "comment": "Malware payload (Mirai)", "value": "61692643740b3ad4615e85091e4e374747cb9b13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295540, "uuid": "6355bd71-d178-4a75-bbf5-390707564974", "comment": "Malware payload (Mirai)", "value": "d9053a5b7caba0759f7a50743b39f026e9a9944ef224ab26dad3ee43ff048e3aec1421a4c12407b0a80bcd889181a68d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776295540, "uuid": "d1ed98c0-9c03-46a5-bf50-ea8bc86ffc3e", "value": "T13FC30946F8819B15D5C151BAFF0E124E77131B3CE2DE73029E24AB747B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776295540, "uuid": "bb4ff38b-0387-4106-b758-041d86a98e60", "value": "3072:jaUJUwTHv6X6BltjHakuJyqxuWfmscpLdJNY:jaUJPz6Xilt7a8FWfmdLdjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776295540, "uuid": "189492e1-5b1e-40fc-882f-541e9331d840", "value": 129244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776295540, "uuid": "ef42c61b-85a3-4ee5-8a4e-d6b4198d98bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776295540, "uuid": "6db766a7-8add-4003-8fd0-71a30f9a6528", "value": ".Sassy.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf46e12-3869-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776216085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776216085, "uuid": "2b8843d1-ed66-486d-bd70-e77a0753f6e6", "comment": "Malware payload (AgentTesla)", "value": "4164fb6d0f417eafd84709bd193e8af6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776216085, "uuid": "4ce80c32-2fcf-4614-9bb5-4fcd9c86a6b9", "comment": "Malware payload (AgentTesla)", "value": "ace4105ecee76b1e9157c9680b0b7a35c17548f872b1d474bd57e352739756f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776216085, "uuid": "f116cc68-f7e5-4e92-8146-2855376b8cfc", "comment": "Malware payload (AgentTesla)", "value": "f9e28b9e57b404540e10e5f7b8c027dcea02c08e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776216085, "uuid": "eae2b8d7-f6d9-44e7-b21c-eb6f7c22abd7", "comment": "Malware payload (AgentTesla)", "value": "7b4abd59011458b3ccb9e906220e1114ec19a46ee6d253b5259e00b152cb38a637fc9882f23394186f0d7ddda4c2657c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776216085, "uuid": "deb8a6ee-e326-4d1b-80c1-972bda604ce9", "value": "T148E4C05A2C9C958AE6A14A7440E2B33953FF62D23E88DBD79E3C455D6D21CCCDE32E01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776216085, "uuid": "9f094c00-059e-4ae9-bef4-f4b1478eeb6c", "value": "4fecd44dfc94ffab3c4ae3356e71b8f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776216085, "uuid": "8e2b1f46-c96f-46be-91f7-c4b203342995", "value": "12288:mdX9s4H7pg1bdi/VB1GQpMejd+RY0u8Aw4nnnHnnntnnnNnnnunnn:EubdIv1G6jCYB8AXnnnGnnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776216085, "uuid": "1bf1ad8a-eb67-4475-ba44-c144398fa427", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776216085, "uuid": "46213a1a-7577-4d9d-baac-b27f20daec32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776216085, "uuid": "1069a368-aa5e-4e56-9f5a-09242dc0eff3", "value": "BANK_PAYMENT_SWIFT00938456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6b44c8-390e-11f1-a769-42010a9c0008", "comment": "Malware payload (SNOWLIGHT)", "timestamp": 1776286957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776286957, "uuid": "d96a0512-701e-448c-a7d9-dc2550749bb2", "comment": "Malware payload (SNOWLIGHT)", "value": "a0ff0c6183578440b6d39a090a91078c", "object_relation": "md5", "Tag": [ { "name": "38-60-253-35", "colour": "#3E21E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SNOWLIGHT", "colour": "#36607F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776286957, "uuid": "99d5d45c-e4f9-4991-b23b-b4b1f853655f", "comment": "Malware payload (SNOWLIGHT)", "value": "ae26d8e0385f9f1e1a0c213b907e7d7aac915803911fbdb0cc11b95316acfed0", "object_relation": "sha256", "Tag": [ { "name": "38-60-253-35", "colour": "#3E21E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SNOWLIGHT", "colour": "#36607F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776286957, "uuid": "e2c30884-3f7e-4470-90c6-593d31a6a702", "comment": "Malware payload (SNOWLIGHT)", "value": "fbde90868f143f521225cd0a6b7afa0e333f2cc3", "object_relation": "sha1", "Tag": [ { "name": "38-60-253-35", "colour": "#3E21E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SNOWLIGHT", "colour": "#36607F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776286957, "uuid": "5030eecc-b79d-44f9-b986-07468a70959c", "comment": "Malware payload (SNOWLIGHT)", "value": "fe6a874afd2d0c812fd5dd90e64c1d4524de097f7431eb59e5f73766049b621c01a111f52c746650b4434ca6d01f4dbc", "object_relation": "sha3-384", "Tag": [ { "name": "38-60-253-35", "colour": "#3E21E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SNOWLIGHT", "colour": "#36607F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776286957, "uuid": "eedb6e63-00f7-4768-b3b0-8ca2a38b78ed", "value": "T10C922B4DB383A8FDC705C0788CDA9777E6B5F412629627261A7CD2323DA06786F3E149", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776286957, "uuid": "8e50c9a3-b1fd-4f1e-8cde-e87e9bf93fde", "value": "78776e8b2da373b9cd01c0fcdb6c42d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776286957, "uuid": "94a1fbc9-51d0-4f8e-beb1-659c73d4ecab", "value": "384:4/drbF0z0DuKGI8Hu421NX/GpabYqm3A3nhlps:4ltDuKI21wWxm3AR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776286957, "uuid": "e4d5ae3a-a51f-4322-8375-a08bc22ca4be", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776286957, "uuid": "5bf08f18-fabf-4f3a-a18b-f4c4380a3948", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776286957, "uuid": "15c47a21-67c6-40ec-a1d2-8b3e19d62805", "value": "sc_vt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "782fd4ef-3880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776225984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225984, "uuid": "48df2bac-e6a0-44c0-a96d-e70686475532", "comment": "Malware payload (Mirai)", "value": "bc83e2c8594374827db8987c4e97b67b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225984, "uuid": "c5ed6cc1-0273-4d55-9177-fc3485cb184c", "comment": "Malware payload (Mirai)", "value": "ae3a095728eca16d8fdfc2eb1d90a8ac521d82769815331350ca38a0136e56dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225984, "uuid": "72bd2c0e-d17f-4b5b-bff7-148515c339fb", "comment": "Malware payload (Mirai)", "value": "2f5b8395ac9b7f010ce94a09fa6deb41621a8c2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225984, "uuid": "50ba634a-f504-4d19-b24d-3c0caaa6448c", "comment": "Malware payload (Mirai)", "value": "3bb36a8edbd40e4d6ed5643fc906bf6d8e65931493cc01a1bf1d412e5ac7feab4ba8c5a02061b44e17de6b06f07b02aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225984, "uuid": "254c6df6-f053-4b30-8117-d038be86506d", "value": "T187C35B1775C1C0FECCEAC1B88FEAE126DA73B4295134B21E27D46A261F5DE205F6E610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225984, "uuid": "34514ddf-1e0a-42f7-9bb3-9cc04c206ee8", "value": "1536:skYZ7qo81LlymV6fC4axMvB61ce5XjMiE2b2xW50N1MwccxF3a:shZ7HMAJaxM81ce5XjM2b2xW50Mvcja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776225984, "uuid": "f03c5643-2329-4b9f-a29a-d0aff99605c6", "value": 123464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776225984, "uuid": "b19d80a8-8f0b-41c9-b903-18cea32d06f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225984, "uuid": "6b6d105b-fe98-4d38-a3fe-6aa96765060b", "value": ".Sassy.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f725c7f5-38bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776251967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251967, "uuid": "b2ce3622-b1ca-4498-9797-b38240a26ae7", "comment": "Malware payload", "value": "97b573b78097a40094f4429276679e7a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251967, "uuid": "accc49b0-e84d-483f-83ef-0fde8133072e", "comment": "Malware payload", "value": "af69d38d5b8f5e955d711321b40c699b00eea1bee07fa58a4f44816e5b5faadc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251967, "uuid": "82b7cba9-62e8-4188-9e7e-ce8e289f4c5c", "comment": "Malware payload", "value": "2b41fd05dadf7802cd62aecccf78bf4bcfc8337f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251967, "uuid": "a6223b71-572b-404f-a7b8-89bbf63d4d6d", "comment": "Malware payload", "value": "bd731db99ab7d5e24cefad3a975e32b23b8c160cba9bd311d70e15b67f13d769d3d4fafe3d47a341189d2a64f43b7948", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251967, "uuid": "969e6356-cd6d-4986-becf-7bec1b04e9de", "value": "T101433B0CBBAC4A2AD76D4ABDA971130583F1D2A56143E37BDEC060FD94E37D94232A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251967, "uuid": "55c85357-2792-426f-a0d2-208ee88a3c84", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251967, "uuid": "6d44fd42-ba96-42ac-bf44-a9fc2ba54d94", "value": "1536:DH85uBSgpgWoDHkKfTUNYKXnoAHWX3bgFuxTU:BBS+gtDkK7UOK4jrWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776251967, "uuid": "cee79d42-eb88-482c-8c23-3a8758cf1c39", "value": 57856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776251967, "uuid": "7e1c5df3-58b1-4582-8ba5-878faeba3d1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251967, "uuid": "e8d6ee2e-f833-4065-b124-0d1ef5d3911c", "value": "file.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9003cb7e-38ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776259525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259525, "uuid": "4abd281b-13d3-447f-ae91-62a1818d5905", "comment": "Malware payload", "value": "6fb178b17223977cf3a54d910591891f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259525, "uuid": "717d7f23-1d4d-4aae-8889-17b1759633bf", "comment": "Malware payload", "value": "aff927b1ac02a51732bda830ad24ad7b6fee32e7296d7398b1e33855236102d9", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259525, "uuid": "9a4dfc44-8004-4f25-bb99-28bd8a206a37", "comment": "Malware payload", "value": "30047a07ad5d484ab0596ef2abdfe5c52050a45c", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259525, "uuid": "eb41b735-0171-451a-8bb1-c164c3154c0c", "comment": "Malware payload", "value": "71e62a43da570158dc66033675b57eccd2f45996a0ee594e2c0eb9ee0e1a1cbc023806699016541c7524fdb91947a78f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259525, "uuid": "6dd1ee01-4d19-4220-9c47-ebed77a040ed", "value": "T19A3617D8EC709D80791872F0AC7F8D3AEA076C772DDDE39123A548F59364A48D6A3439", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259525, "uuid": "cb97bb36-424d-4bc0-87b4-b51732760cf0", "value": "768:onRb9O21q6YiVLovrq6YiVLovrq6YiVLovMJPP0Gtq1h3IU8H:k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259525, "uuid": "9a41b0e0-9cb4-424b-9ae4-cc5563e963ae", "value": 4963504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259525, "uuid": "91cf49eb-9d5f-43a1-b1d1-fef3a2b20cbc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259525, "uuid": "6d933966-f222-4c27-a9ff-da7cf3010d15", "value": "New doc.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c9d4bb-3917-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776290886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290886, "uuid": "26a691fa-6313-45e0-83f5-4f9428ebb8c4", "comment": "Malware payload", "value": "5921f887ddff7cf8fab6be682c2f7031", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290886, "uuid": "9c4930f6-f373-416f-babf-9b4d5be8f6f5", "comment": "Malware payload", "value": "b01323f9380bbaa609a934138ff5d1f1b7aae5bc548e3150887b87455fe4f01f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290886, "uuid": "ced0511f-71a1-4bfa-a37a-77adf12fa7b2", "comment": "Malware payload", "value": "db2fe139c733afb2de371c3a6a4e616771f0463c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290886, "uuid": "1078bd65-4e1a-414e-ac0d-2f2b9060eff3", "comment": "Malware payload", "value": "2919d1936ee30e956f20ffdfdac674f5f96eab902d26dc2bdea6d3f437875ccfcb6a47eb1b9ab816cd862da1df6d93f7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290886, "uuid": "116fbf5c-c67b-4e9b-b7a9-be3c2e077ec2", "value": "T12DC30247FE08DC3AC65FA879CD25E13ADFB09762D0508A8F261782662571CB00FD354E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290886, "uuid": "f3c08dfa-5e00-46ad-b3b2-66d1386148d6", "value": "1536:ujLOdJgeyUwBx84E4uAXQlcWrZvS00eV688DANSct9eIX5vW3JK:ujLOdJgswBMAghNZV68C69/XQJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776290886, "uuid": "3c32b65d-d490-48dd-a7a4-ed6faaf2b48b", "value": 120402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776290886, "uuid": "088b4619-d80d-4ce7-9ece-426bbf952c1f", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290886, "uuid": "013e7d6d-24c8-48ba-9b58-a9a13a912dfd", "value": "QuestionMark.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b575f62-38ba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776250793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776250793, "uuid": "b54e72e0-465a-4eaa-877b-10e830631e81", "comment": "Malware payload", "value": "b4c8bc6ff7b4494085b7dc182fdf2852", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776250793, "uuid": "1cf380eb-d605-42bf-9118-854494703621", "comment": "Malware payload", "value": "b0d8888f52eb7652d792a3baef6e73445c9ee234359e14ded43054a3c3e425b0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776250793, "uuid": "a1006864-498a-480f-b296-b090e4856ef7", "comment": "Malware payload", "value": "7feaf68d68bfca431e2e840474f431329f4adbab", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776250793, "uuid": "cde37400-0aa0-4be0-b8a6-8b495d5e4f8f", "comment": "Malware payload", "value": "e77a1507c0ba09665d3c4f99943ff0dfcf677079fad05b235fd2ade78581e83633172fb7b76fe7b106e498c816f94793", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776250793, "uuid": "a62822cb-094f-459f-8830-08832dfd7a9b", "value": "T1B3A5C03BF28BA53EE06A1A367A72E110543B7A2165164C1696ECF88CCF751701E3F787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776250793, "uuid": "d5cb6296-eb90-4dfd-986f-569c4cfaac2e", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776250793, "uuid": "df82526e-c7fe-4909-9399-807623702cc6", "value": "49152:RuI2h38zyun/ggS76zvJO5WImt0XDR6KG4VqYq6:R5OqX/gL7kBO5WIw0XDR6Pkth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776250793, "uuid": "483c3675-ef78-42e9-918a-ea5e8c735d5a", "value": 2096123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776250793, "uuid": "b6453ca7-06ae-4299-b3e8-3b5bcf6ec912", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776250793, "uuid": "173e12bb-a7cc-4796-a129-26c12ef3c4a4", "value": "CORTEX_DEMO_Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "177895b5-38a7-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1776242572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242572, "uuid": "30c1883a-5b9a-4f90-b219-b1d056c12d0b", "comment": "Malware payload (SalatStealer)", "value": "015bcbb024139561095389e58f201fe0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242572, "uuid": "85721653-9045-4554-b47b-1e59770c2d53", "comment": "Malware payload (SalatStealer)", "value": "b1219afe9c02ae5c55f7e827af3901358f8e9b0037f9073cbaae358b1b870099", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242572, "uuid": "bb1eadfd-f6fc-45a2-a365-f4337beece14", "comment": "Malware payload (SalatStealer)", "value": "ab2481b225f34ae0d9d447517bc2394f012e2490", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242572, "uuid": "8e6016e0-9122-4466-bbfd-25da57b0ed56", "comment": "Malware payload (SalatStealer)", "value": "1079c10cb9d3ad964ba5ff21a3f31f3eef32dc1f2907b825e1609286af719f0db2d66ea5906024176f92f518d5ae9c3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242572, "uuid": "49c20644-77ef-4473-80ba-8938820830e2", "value": "T151C65B01FACB58F6E9035831555BB23F63306C048B28CBE7EB583E6BF877691197A215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242572, "uuid": "5d810066-7b09-4a2a-8342-d3dc8434e567", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242572, "uuid": "9b203e0f-3cd2-452f-a24b-f5520f0ad096", "value": "98304:IRfo+j9fLZAdoVM5w2OmwgP+qRkzR3mW4R1ZnDrejmaWE2z:r+Cl5wZg7cX+1ZnDrejmaT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776242572, "uuid": "52cefb09-4002-43ca-b9bd-4950c2f64ff3", "value": 12317696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776242572, "uuid": "2c89f282-f6b8-4afe-9857-14cc027af153", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242572, "uuid": "4070f11c-72a3-4783-9ecc-32611ec6033e", "value": "SecuriteInfo.com.Trojan.PWS.Salat.390.9160.32132", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb77bdc-38b2-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776247311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776247311, "uuid": "55c43ded-32fe-44ee-8e31-1ccf6b0a4849", "comment": "Malware payload (RemcosRAT)", "value": "6d5a76f4a5ac69f0532557d38957b3c9", "object_relation": "md5", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776247311, "uuid": "202aa664-aced-4bf0-9f42-eaa0d37119d4", "comment": "Malware payload (RemcosRAT)", "value": "b1565fd6ea44f78467ddc9e30a9456d7579596a375f5609540f5e8529b9a407e", "object_relation": "sha256", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776247311, "uuid": "f372cdeb-59b1-4466-9d66-457d8ccbba72", "comment": "Malware payload (RemcosRAT)", "value": "2b4da2951a88cbff1f89d861630a062ff16289c1", "object_relation": "sha1", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776247311, "uuid": "805f2dfd-3b8e-4751-aaec-632a15793a39", "comment": "Malware payload (RemcosRAT)", "value": "d068e5a66560463cf976a5fac1ff4f0326b2a3f3ff408c8dd635684a78399aef9c3047d928346b51f8cd96dbd2c4f79f", "object_relation": "sha3-384", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776247311, "uuid": "0554ab33-2e9d-4bdf-9a44-738fc3d975ff", "value": "T1D0D45C95A3D441F4D077C234C9C24537E6B2B8056670462F03EB5E6B6F237A29F2EB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776247311, "uuid": "f4b17a30-4d09-4bb2-9ac9-ff8fe042bcb5", "value": "8b3e0763eddbb01367bd21396e110071", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776247311, "uuid": "5f3a34e4-8e15-48f8-bbff-c1c46249bfae", "value": "12288:QaMwmp7scoHvln/+iB9PQoYYUPGmdou5usyWH:j7mScoHvln/+aPQoYDPGmd35oC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776247311, "uuid": "8f9c5d3e-58f5-4184-92e2-a8150dbb0d25", "value": 650688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776247311, "uuid": "d3c6fb57-cb7f-47ed-9c68-ef19522618f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776247311, "uuid": "4e852956-baed-4288-b128-7be8ac3f601b", "value": "b1565fd6ea44f78467ddc9e30a9456d7579596a375f5609540f5e8529b9a407e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d559380-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776239656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239656, "uuid": "45fb0008-805f-4b99-afda-364c9e953753", "comment": "Malware payload", "value": "125fa6a7c5ad1ce06cbd4dbbdef29f1a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239656, "uuid": "dd72952c-26f9-4b67-bf83-87551e8b763c", "comment": "Malware payload", "value": "b1a1bfb8e92f9fbede0ecfb987b1798d35dee41e60a9f04aaaaf7b08fb4f92ef", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239656, "uuid": "cf8ffdc8-9785-41d7-92b4-07dc34425b82", "comment": "Malware payload", "value": "dc6baabd80adf82cade669cbc3faf9ef88842882", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239656, "uuid": "4fe8a020-e4e2-4001-9a1a-0af8e88a6b1c", "comment": "Malware payload", "value": "2f88be2c959f04ea44fe273312798f0dc367fd218c43844228372f4a3c02648181efcc350f2f2ba3183b893e47cc667c", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239656, "uuid": "7896fd1e-8be4-46ec-9520-6157104ca774", "value": "T1FFA44C8F9966F7DFD80D11B9280DE89ACF4B40F387DA855D23282368F55C22D0E52DAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239656, "uuid": "41e0487a-f328-494c-97a3-ff02deff8a8d", "value": "192:JunSz43EDhEJzY2rrtUcgtPRbybybybE0PB1RN8FDbybybyb0jmo0PB1RN8pnSzv:rjopIw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239656, "uuid": "929baefb-a505-4996-bef0-8aad68c3fd72", "value": 483454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239656, "uuid": "542c79c3-7803-4572-91d2-0097366104e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239656, "uuid": "29f8848b-308e-4329-9d62-3b94bb94cb01", "value": "EX770068372396.PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2470c0d1-3880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776225844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225844, "uuid": "d31c2836-383e-4820-9b25-d966055f0a26", "comment": "Malware payload (Mirai)", "value": "7219de430e0c5b78d470ad775fb5ef16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225844, "uuid": "24afe191-f588-48d4-b6df-2ce55bf5e76a", "comment": "Malware payload (Mirai)", "value": "b25bc5608232a02fa5e738daa844a81c0e931ef74f5b1249a24098e3e5da470b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225844, "uuid": "bcf93af5-76d7-4cb1-a15a-694a8652f602", "comment": "Malware payload (Mirai)", "value": "4514df4ba6569458d98054d9a6e0dffd76a62966", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225844, "uuid": "8c831a02-394b-4927-bc10-418add7ba134", "comment": "Malware payload (Mirai)", "value": "509efdf7eabee5f71211c3c38cb3557ecdfeeb85924a8726227076b5fda9c2e785ab3ac923b12af6c9ed5e0a933c1ec1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225844, "uuid": "18457ffb-f4e5-4f30-90be-6ea77309c56d", "value": "T154B3F845FC409B17C6C665B7FB8E438D7B2A1758E3EE720399256F30378B95A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225844, "uuid": "8c468cfe-a303-4c32-b80a-354fd1f1a4dd", "value": "1536:xjWGe2TXA7kQ4VBL2TFwdQHmbOuYLR846YcQlFclWBwywXMrMqoXmH7qCyO:UGpTXM4v2xwdwNR8vYVI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776225844, "uuid": "c0f2093d-e894-49c4-b54f-d744a4404b6b", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776225844, "uuid": "f6e7f044-fc1d-4320-935f-674067431c8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225844, "uuid": "5a050189-c5aa-4fd5-a4bc-8edd7133d8b2", "value": ".Sassy.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd63da05-38cc-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776258742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776258742, "uuid": "7e41df32-1c25-4316-a32a-59d64387335a", "comment": "Malware payload (RemcosRAT)", "value": "fe9d9b051be5594ade212e916d3d012e", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776258742, "uuid": "da9d6b75-0b66-4bf4-83f4-556386ce6064", "comment": "Malware payload (RemcosRAT)", "value": "b4e80f7bb2c6048f0918b039aa8ad5d54d27d0771cf844c30b60e1ca797f2dc0", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776258742, "uuid": "1eb39457-1182-4767-8310-0d0463ebaae9", "comment": "Malware payload (RemcosRAT)", "value": "2e55b41f3af940e5f8676d627b541362f662631a", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776258742, "uuid": "47dfcb31-3685-4b42-a8f4-047f35a6b791", "comment": "Malware payload (RemcosRAT)", "value": "51056707e08f8ccf51b6072a5c54a8a9d856de9efa069695cfed28950fdee3e3f10bba2edb2fa7e78a7ddf34c4d0b00c", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776258742, "uuid": "e58d8479-999d-476c-80fb-676aa516e869", "value": "T119E48709FAEB26414DA166093CDA8463B10335C78CF9EB5303F85D369669FBE7B43A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776258742, "uuid": "8e634ed6-b484-4b5b-8c9c-c2ffc825de0c", "value": "192:WpZ5+JbYrJh8Ss50XKOS/JHN+Ns8kPi8TY7ga6Djt46XXyMD/yi0XKOS/JHN+Nsk:WMI3Nl3hqpeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776258742, "uuid": "05deaeec-0f8a-4964-b0ae-c41c4be8b5c4", "value": 704522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776258742, "uuid": "64d1335c-6f8c-4e2c-bb4e-252228c3e89e", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776258742, "uuid": "3b9ea952-c320-4fca-944b-902acb22dd57", "value": "goodthingswithbestspeakforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03296741-38bb-11f1-a769-42010a9c0008", "comment": "Malware payload (zgRAT)", "timestamp": 1776251128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251128, "uuid": "1aa8ca20-b6e4-494f-8c73-15a9889181b9", "comment": "Malware payload (zgRAT)", "value": "4e2230fda3fb81fd08a6578a06f5af33", "object_relation": "md5", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251128, "uuid": "33f20248-6853-464f-9f61-6108fa4498ed", "comment": "Malware payload (zgRAT)", "value": "b5f172450ea32e87be50bbb17b7a473f6bbc94937c200c8653f9c2c8f500767f", "object_relation": "sha256", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251128, "uuid": "9f1fe0bb-15a4-4555-b223-4cfdc3efb97d", "comment": "Malware payload (zgRAT)", "value": "3f6bca8d59639bbe6628469c0b80154de7cdd5ef", "object_relation": "sha1", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251128, "uuid": "b7610337-cda8-408c-adcb-0940bf0e1e46", "comment": "Malware payload (zgRAT)", "value": "485c36011a7dd101ba87c1bee15ec2609c361b351730cde336f01fc9136bb8773e367aa1716a76c42dd3063d30d10c04", "object_relation": "sha3-384", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251128, "uuid": "102ccf47-0c43-4608-87f1-4c8fc476267e", "value": "T1DFD48D6776528E11C2954733C1DB8A41D3B8AA8276A3F70FB14533A654073EFDE0B2A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251128, "uuid": "5e55ce6c-267c-46e3-a72f-cab9a40191c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251128, "uuid": "17330ba7-ab33-41f7-8d91-43c3b404cb64", "value": "12288:84KqKGRiq2pzSp4OMNS4vy76qI1b/g95:XsxWpBMNhvBqI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776251128, "uuid": "0a3972dd-c38f-4b43-9dda-1ad1580fcdc6", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776251128, "uuid": "d3504502-0965-4ad3-9bee-3cc27f36347c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251128, "uuid": "01d68cb4-85c2-4047-94b0-72f5aab6b79f", "value": "b5f172450ea32e87be50bbb17b7a473f6bbc94937c200c8653f9c2c8f500767f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3284a6e-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1776239854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239854, "uuid": "d8a8d840-4259-43ab-8eef-7549a8b5f598", "comment": "Malware payload (a310Logger)", "value": "1c0b8a1996f7168237eb6f78ccba3894", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239854, "uuid": "6e3eecb5-fb5c-4ea4-9d31-a6e650ce119a", "comment": "Malware payload (a310Logger)", "value": "b5f874ab552bb459e44d4eb8acf8f899f1fc0b815b266ccbf0230dad0ea66222", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239854, "uuid": "b5988457-ce53-40be-aaa4-e9c86cf7a6e4", "comment": "Malware payload (a310Logger)", "value": "7566c3f7d744d00d131b142b2c9ebf9a2c3574a7", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239854, "uuid": "e158782a-d52b-4938-bc43-529698e0fd0f", "comment": "Malware payload (a310Logger)", "value": "2e255161383f0d82ab00ee5d9000486b7757dbc20ed76a89d7dc01b333dfe76bda2001baa037fc668023734113488006", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239854, "uuid": "b1df234b-6ad5-4121-8169-8d4dbced549b", "value": "T191D5021589C42FB9DFAC5A1C90FE161E53F04A8E502A798AEB33BD47BFE790052171D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239854, "uuid": "cb725e16-e2f3-4cad-9905-8e3cf66a47e9", "value": "24576:GzdEGT/BQjO6AAKzA5pqhwMkyIdbNX6v7efh3R1hOAdgFSNnDdSxISRg42xaczNa:GeGTeaL+QStM6nDqRg1xaUmLVdps8n7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239854, "uuid": "dcbb7b1a-1cc2-4eb6-b190-c4abfb556f5c", "value": 2851864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239854, "uuid": "490a11a7-6204-4dda-9615-4edf34e1bcef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239854, "uuid": "37d19859-e097-40d8-b598-85f899d43bcb", "value": "orden de compra.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e4bcb7-3917-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776290895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290895, "uuid": "3a7c32a1-cb9d-4ab4-bcc1-aba1914dc8fa", "comment": "Malware payload", "value": "d8f9d9d56d9e5daa76944a90cadb8346", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290895, "uuid": "9dc7e569-0f42-453f-b4ed-c5f82d2c5d53", "comment": "Malware payload", "value": "b68e96cf67fd740c164dc3b90634b10e1b7a20ca5b741cf66885f5ec3be09d74", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290895, "uuid": "f527c191-2c0d-4825-be80-3dc45be69a51", "comment": "Malware payload", "value": "96239a224b9151e308cd6c5263832dafafda6220", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290895, "uuid": "f5eed29b-22aa-4b11-be02-76ee505b98db", "comment": "Malware payload", "value": "3943eac62764824bbf1b012a1e5c34c05dc2fde352bd84b491d5d8b6a880330ba49269a2aa167fba89f24a3cf04ac4e9", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290895, "uuid": "9b902cb7-3959-4993-b721-b2fc1f3521e7", "value": "T1DCA412DF6B72A1BEF6AB687D36CFB012EA15B59A746081FED834DF001447C921F4A409", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290895, "uuid": "25ac48f4-c52d-4c4c-9e4d-9db1254e0153", "value": "12288:1oK6AS0IYw9WngUg8K3+ff1TrPfLVG2mhN4as1Rt:1oPgIYRIjst3PfhG2G+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776290895, "uuid": "5a8f39d3-0de6-4249-a677-a766f0f7833e", "value": 459661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776290895, "uuid": "91393a47-17e7-44ae-8df7-16cbdfbce6d4", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290895, "uuid": "37312805-a11c-4699-9cc8-7a9c965ca1e0", "value": "Skull666.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4a842e-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776239869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239869, "uuid": "f9d04fc7-3f3d-4e9b-8d11-d551069de472", "comment": "Malware payload (PureHVNC)", "value": "dc79206115e67b3243f9124eabc8daf5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239869, "uuid": "2f69f80d-b534-4067-b9d7-acd126be19e7", "comment": "Malware payload (PureHVNC)", "value": "b6fa39da6c5bd8abd69ce2927457155eda12b99a70875092bbca2dad6d43bdfa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239869, "uuid": "27194e98-d629-4017-8f5f-ad816cdb9c59", "comment": "Malware payload (PureHVNC)", "value": "529c7a2969505830ec0e88106860ea7293e90527", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239869, "uuid": "d0eab373-2c2a-455a-98e2-6d17e464fec5", "comment": "Malware payload (PureHVNC)", "value": "6a5fdd8330de52440c942738fbd220d00b3a8a98293749362ffa922f61eefbf173a5856317cdd58685a49ec51a890266", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239869, "uuid": "69b5d632-7eab-441b-9258-324c9464b3dc", "value": "T172642038AAFA4019B0B3EF55AEE47493E96FBB33370E589D1081034A4723945EDD563E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239869, "uuid": "eabcfbd1-30a3-4545-ba5c-4464910e9d3b", "value": "6144:HLMN1fgkwofDHjzyV6UqPlCdKXmXjhNncPeLifO:HLKfgkDfDHjzyOdOKXmXj7caifO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239869, "uuid": "f9612d21-28d7-4e51-bcf2-ae96935e28e6", "value": 315890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239869, "uuid": "cf26035e-e650-4a94-94ac-52d25152f8f1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239869, "uuid": "8ef6a9db-1138-4f51-aeb8-5fb25d33117c", "value": "SCANDOC833.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382df096-38ce-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776259378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259378, "uuid": "49cfbb20-81e0-4c39-9ed5-b478b137a35b", "comment": "Malware payload (PhantomStealer)", "value": "07a0cd804f631ce26acc691be6f25e01", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259378, "uuid": "20cc801b-ddce-4646-abb9-1ded06ad29c6", "comment": "Malware payload (PhantomStealer)", "value": "b8353325921b8fa9dc719252c25fd2e9e460cc5de76f4ba0849641e150b545e9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259378, "uuid": "6f43e3f7-0ef5-4eeb-8f9c-8022d7afe672", "comment": "Malware payload (PhantomStealer)", "value": "b6ff2f937fb5d3dd51afd5592448a31fd8b26a9b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259378, "uuid": "1d946c88-7d0f-4456-bf58-e59d3d4f27e8", "comment": "Malware payload (PhantomStealer)", "value": "f24e25c18c1227f3a0b3f0f8a7cfff186450dd54a95909e09839a29371e0da5479b71240a379a64156d0a4a61a1097ab", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259378, "uuid": "1b87a290-ae14-4447-93a7-7a36eb6f6d8f", "value": "T1BC26021189C42FB9CFAC561D80FE160D63F04A8B5416798AFB33BD4BBFA7A0452172D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259378, "uuid": "51c0e414-9b6d-4b19-aa83-d0a41805a988", "value": "49152:S6KMQuodaEs413MRvnvP/B+qkoJw8zkpZqUg83u5vEtC:x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259378, "uuid": "560452fa-81ae-4ea4-b321-06fc5b0e385b", "value": 4662087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259378, "uuid": "34b153d3-dd76-44b9-8a2c-860c05544084", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259378, "uuid": "dd2dca9f-b8d3-4393-8a03-2b2f96e8a546", "value": "Quote QU-0424.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9123ab5a-3897-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776235905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776235905, "uuid": "d0c57462-9a6a-4c48-a541-d6dfe9e4a7c3", "comment": "Malware payload (Formbook)", "value": "f3ae3dd7f41bc2de921373c496eb00cf", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776235905, "uuid": "74be1b36-c789-426e-9e1f-77fa37a5d61e", "comment": "Malware payload (Formbook)", "value": "b9d35cbd9ed8b072b78e3fdf4af2c572b09a6be8b18839c6664abaf29f44b94b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776235905, "uuid": "97a41768-cec9-492d-ad2e-0e201928f965", "comment": "Malware payload (Formbook)", "value": "f6d83b6a4cc61f84bca1f0a7a78c5a447647aea9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776235905, "uuid": "bda64bfd-5b1a-4207-b2c2-3b4c15ee9554", "comment": "Malware payload (Formbook)", "value": "e2b08a3b2e1e0826606f3001d3e98363ab4585b0ed751c23e24e55006795343e7c7d2a001a9424970b08cf10996ecea0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776235905, "uuid": "dfb2ea37-99ac-40c8-a30a-55f7ee16f904", "value": "T1FF36679DDC27A82019187774867FCEBDCC8B64733B9EA66313DE68F98346E781610871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776235905, "uuid": "bd5c9ef5-f7c3-4cd2-b589-0a3568dbcb49", "value": "768:8nRb9O21q6YiVLovrq6YiVLovrq6YiVLovMJPP0/eBAvWdcuA9:/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776235905, "uuid": "6c8f0230-1600-4f0d-8561-f15089a27570", "value": 4963688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776235905, "uuid": "0e27ffd7-04d6-4dfa-9a07-c75ef5ed9b7a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776235905, "uuid": "080e729e-262d-435a-950e-2b6d29ed085e", "value": "Specifications.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689e502c-38e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776268049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776268049, "uuid": "30bf9fca-26c8-4acb-8412-125c3b6b7b34", "comment": "Malware payload", "value": "39b84f83922698edb34794b79bf26646", "object_relation": "md5", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776268049, "uuid": "0022b784-53e9-48ae-bd92-874ea77fd680", "comment": "Malware payload", "value": "b9d98a300db857626fa88eec9b97ccb57ec0a047a511f76d413585ca1a6c2ec7", "object_relation": "sha256", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776268049, "uuid": "9f674b7c-044c-4245-b0a4-505150018fb5", "comment": "Malware payload", "value": "6d05443bdfa2eaaab955a41f6ffa354c2585ac89", "object_relation": "sha1", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776268049, "uuid": "8fafebb7-990b-406f-975a-d380b86cfa62", "comment": "Malware payload", "value": "57f28413b2a3ceea836c502121e6ad8cbd3a606ed81d655d55aea8703cb4e82ec83185a5e1785d25e78f3a89c4619ef7", "object_relation": "sha3-384", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776268049, "uuid": "3d6fcb51-69eb-46f5-a639-e81d662e8471", "value": "T143B6337B2045FCCBE054423ABC33456C8899F764AB0926B6F56F3BC9519910DCBF2BA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776268049, "uuid": "5a58e155-6d0b-4bac-8c5c-f469dedc6bfe", "value": "73fd795305ba2cea7522dfea1b76c92e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776268049, "uuid": "1c5a63fa-a8e7-4ccf-96cf-1c484fc4a23f", "value": "196608:9hJob9EJWvj8UHKMCpIvR6JU5n89g/3f4RVi/d4zAOzseEV+ioJiL5hm6:9Po58WAUHkIvR4U5Ag/3f4Ti/AbzseEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776268049, "uuid": "496d6712-52e5-44b5-abc1-aa4b301f4d2a", "value": 10891792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776268049, "uuid": "03e59c36-4e8b-4f92-a67d-43fd2c0318d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776268049, "uuid": "b6be5a67-a3ff-4389-949f-7135685a92e0", "value": "webview.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41bad05b-391e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776293753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293753, "uuid": "b48380ff-2943-48fe-b217-1e69584db4f1", "comment": "Malware payload (Mirai)", "value": "b482d655c4c6686d23a7052e7ca63c28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293753, "uuid": "c01b94a8-b175-4f07-a4b5-a33ff0d3fa55", "comment": "Malware payload (Mirai)", "value": "b9eaab4cdf85f5d3df65d5d767791db091d67ec47071e100f91854cd6cde6c66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293753, "uuid": "5352a45c-c417-4f23-9129-afb523c00497", "comment": "Malware payload (Mirai)", "value": "03c652b1012f80def8297ec8f105aa2b6be9c4ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293753, "uuid": "6f8b6b1a-5d47-4f08-848f-7670dfaefc3d", "comment": "Malware payload (Mirai)", "value": "1b78fc37bcba643d48a3d0d776215cfbe9e839a31fcccec4b6048e1a6c7fadae39dbd69ab0449c195167a27ac121e689", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293753, "uuid": "055161f5-a8d5-4d02-a1bd-1103957ca83a", "value": "T166E317C7F900DAFAF81AE3374853040AB130FBA548925A377257356FED7A1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293753, "uuid": "d98dbd55-2715-4194-9f5e-c64afdf16e86", "value": "3072:Eq9wYdsbWUcy32iG/oD1gH6HVATealV3jbiRL+MX3To5:EpZcy3HG/c1vGeaKL+Ss5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776293753, "uuid": "22c85a47-c17f-44cc-9581-eaa9c3acde65", "value": 146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776293753, "uuid": "68d6d82f-5404-4568-92ea-6b79356fd355", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293753, "uuid": "e1d0d6fc-d32d-497b-9e56-36fd3274462b", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b4c22a-38e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776268212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776268212, "uuid": "c3a2afe7-cf5c-42fe-ae39-12b18d9fa67b", "comment": "Malware payload", "value": "466f2f86c981414e66ab571049ba5b60", "object_relation": "md5", "Tag": [ { "name": "RemoteAdmin.MSIL.ConnectWise", "colour": "#1C761A", "exportable": true, "hide_tag": false }, { "name": "Suschil", "colour": "#7405F7", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Suschil!rfn", "colour": "#3CC01D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776268212, "uuid": "b720cab8-b459-4e7a-8d91-5863106e36b5", "comment": "Malware payload", "value": "bc34200fe1f15f8acfd3cf5a192a500e5fb5ec159951a4b8342f4d6d3aa19015", "object_relation": "sha256", "Tag": [ { "name": "RemoteAdmin.MSIL.ConnectWise", "colour": "#1C761A", "exportable": true, "hide_tag": false }, { "name": "Suschil", "colour": "#7405F7", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Suschil!rfn", "colour": "#3CC01D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776268212, "uuid": "d5298e4e-3008-4abd-82ca-942fa9f8bb79", "comment": "Malware payload", "value": "4a5a145a6df35f83c9848c74a6f65e3a738021f5", "object_relation": "sha1", "Tag": [ { "name": "RemoteAdmin.MSIL.ConnectWise", "colour": "#1C761A", "exportable": true, "hide_tag": false }, { "name": "Suschil", "colour": "#7405F7", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Suschil!rfn", "colour": "#3CC01D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776268212, "uuid": "b2435384-d17c-4db6-8476-d0a4e3e1fa8c", "comment": "Malware payload", "value": "b98848aca6c7852df04132fa97b93cdaef826e51b914933fafda6c20b2b499deef9ef60f2d573f2a71d54349c88cdc2b", "object_relation": "sha3-384", "Tag": [ { "name": "RemoteAdmin.MSIL.ConnectWise", "colour": "#1C761A", "exportable": true, "hide_tag": false }, { "name": "Suschil", "colour": "#7405F7", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Suschil!rfn", "colour": "#3CC01D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776268212, "uuid": "85bf2955-e919-49bc-ad70-14257920542f", "value": "T123573335D979EE08D0B1E170E82DF1E3DAE460995F004ECB7A42B8E33C9EB44568B65D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776268212, "uuid": "67c4892d-23e7-40a4-9471-df66f1e67d64", "value": "393216:NmM58AUQaC28nl78Kg6zCWCdFEL2+etwlqXY49dblZncufH7yNn6frXLII3TQN:NMAUQaC28Z8f6kFQlqIwZvigPbDa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776268212, "uuid": "d20c0520-19c0-41dd-a9cd-2ae850ac0a87", "value": 28066807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776268212, "uuid": "2f207901-e6e0-4079-8d28-7ded30bf523f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776268212, "uuid": "1d1610c0-79f6-4af7-91a7-030973f83141", "value": "Hibit Uninstaller 4.0.10.100 Multilingual.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec54f9d-38ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776259389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259389, "uuid": "ef885d70-5d94-4905-903c-adccfdac8357", "comment": "Malware payload (Formbook)", "value": "4c4173b7bffdb12e2ec642f3637caefb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259389, "uuid": "6ef2a6a4-7422-4282-9252-82359bc557b7", "comment": "Malware payload (Formbook)", "value": "bc3ac9ee4158d4ab67adcf4dc4c4134ad68335438b7e5afdcddbb24c2e832a91", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259389, "uuid": "066f7022-5151-470f-a303-977e5b358bbd", "comment": "Malware payload (Formbook)", "value": "888cf62358e924b162f3b77c61750f7e13777a72", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259389, "uuid": "11ab29eb-8b2c-4a18-8194-57d37f83c442", "comment": "Malware payload (Formbook)", "value": "0d32bf603cdbcf4d2a6353aae95c17e011a2ee6e8009626c08b040fe2c3bc4b03876fe70014cac01851147168e8ae447", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259389, "uuid": "49fe43d7-4cef-4f20-b351-b14a73a633e7", "value": "T19495021189C42FB4CFAC561980FD260E93F04A9A541AB98DFB73BE4BFFA7604520719D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259389, "uuid": "04f2633b-372f-4f82-9dae-e71bbb322764", "value": "24576:SB8O6sVnvGdMk2mIHMI5BFBPTG4QWCv4jJI68V6MSbtQPGaNv2gFiu/mOk:SBP62GioITG9z0xYKQlw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259389, "uuid": "0ac3a6cc-6fd1-49e3-aa8c-31b879f61e61", "value": 2013519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259389, "uuid": "a6ebf7e0-437f-426c-8abb-45a4288fea3b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259389, "uuid": "840e12c0-67b3-4934-affa-f968c0127280", "value": "RFQ PACKAGE Banco Group S.R.L ITALY_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301e3ae7-38df-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776266666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776266666, "uuid": "64b5fbe5-f91d-4204-b39f-5ccabc350b7f", "comment": "Malware payload (NetSupport)", "value": "98479543a0dcd8f85348fd44a7324536", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776266666, "uuid": "0682f573-3a52-4ecd-b98f-3db808f562a9", "comment": "Malware payload (NetSupport)", "value": "bd03b89a90c9a144dff3ea4baf5f1d96744f6c39634a59a7fea05462edd8f6ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776266666, "uuid": "83b59b03-225a-47e5-85c0-886375ad757a", "comment": "Malware payload (NetSupport)", "value": "7a3f763b7ddf9e18d7dbff60fe6556198890f6d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776266666, "uuid": "b5fff9d7-9204-40a7-910f-302af67670e4", "comment": "Malware payload (NetSupport)", "value": "dbb5d44e011ec170d11638896e0bf2d679bfa21d5cd933f4a9b4766247ca8aab72341693d2c42a846b80f5d3be4b87b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776266666, "uuid": "932e9bd6-1b7b-498e-8e50-3e21dec0fe07", "value": "T11D064B0BFCB98CADC09AA23484336157BE65BC401B7163D72AD1B6682F737F0A875B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776266666, "uuid": "cb0476e7-dc14-42ad-9f0e-74a20713199b", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776266666, "uuid": "d92e1c79-f988-4ea7-8d0f-7b47af2cac55", "value": "49152:jNkYEstPSHZ1iaONSM1DNV5NGugTks4O93jIQch25284:jNrQZpksJ1T5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776266666, "uuid": "b04d7a6c-e7f1-481b-8b69-6069d0da5e31", "value": 3890696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776266666, "uuid": "ea5e3844-a01a-4882-8a6a-654254f93ae2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776266666, "uuid": "adeb04d3-b869-4f5a-ada3-5f34746a0b0b", "value": "SecuriteInfo.com.Variant.Ulise.596178.25212.14029", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39b320d-38bc-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776251961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251961, "uuid": "8858b404-5952-4463-bf71-e5d69ade2b3e", "comment": "Malware payload (RemcosRAT)", "value": "3e5edf5325e6df41c011b5ed537d5c24", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251961, "uuid": "6dcbc027-a1d9-4d1b-b7bb-cb85c53c9b36", "comment": "Malware payload (RemcosRAT)", "value": "bda7416cdceea1a0fedd3ad8f9f96d6a91e60bd5217869fc8f06d8533a6752fd", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251961, "uuid": "403ba2d8-4d2f-4e1c-9cf3-d9f635598589", "comment": "Malware payload (RemcosRAT)", "value": "1c592014dd2396833dbcdce89ce31f884e31ed04", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251961, "uuid": "e07e508c-802c-45ff-90c6-5d2748c149c5", "comment": "Malware payload (RemcosRAT)", "value": "74f68ec77f7ed81c45f2690c2fe18261ffb26ebfb49fa9d177af9f53db699f0ed908fc1a139072686a11b6597fcab796", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251961, "uuid": "33f44a18-2c1e-48fb-a892-513ff5625b2c", "value": "T12825CF66F2D9C95DD032C03A883BACC103ADACB4D6787EC3655BB277EC7770641A6192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251961, "uuid": "78de3769-e70b-42a0-ad79-d8e8bee18ddf", "value": "24576:UVkeCnGd4LJ7DVDeCnGd4LJ7eC7Uy+jKlIZ:W9CGd4LjSCGd4LgC71O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776251961, "uuid": "00538320-0802-4934-95f3-3e403a28fd5a", "value": 992256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776251961, "uuid": "1507fb34-ad15-4a5a-8985-2cf47fa9b3b2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251961, "uuid": "4602dacb-02f9-4e81-8962-168ba77107fe", "value": "Copia clientului Doc RO2674.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "864b08ea-3912-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776288715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288715, "uuid": "ca59ab60-cf97-4b83-873a-3e23f1bce4c0", "comment": "Malware payload (Mirai)", "value": "429c6ae77946ff983b3a31389089b37d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288715, "uuid": "4a70a883-6766-4fab-a781-1a582445850f", "comment": "Malware payload (Mirai)", "value": "bdf829d6547f18c50fd48ad9a5f8776632c30107da4a0143d77248538466535b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288715, "uuid": "bb0b1e3c-cbac-43f6-ad75-40a99c785bf8", "comment": "Malware payload (Mirai)", "value": "bbc03ab915d924d2c72a8965613f43219e192038", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288715, "uuid": "c93922c1-5d4d-4ba7-90bb-4ff888d33824", "comment": "Malware payload (Mirai)", "value": "163e03457ad0bce78471197988b9bd8ef07b034c9f6e3049b83b691b2e2364cffecd871e5560a9c3d99f86e88d482834", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288715, "uuid": "0858f733-c761-4db6-a2f2-3ec2acb8718d", "value": "T176A3390273594147F3A74DB11C3F6BF197AFD5A122A0A286694EEB0F8135E322586FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288715, "uuid": "fba08488-9ab9-408f-9b05-b9e67942d2f6", "value": "1536:jq+m/HoO03WIbb0QkrLYIHiv2IuHRHvU7nafEHkTDOXqZfJ0xQ8PDHBD2RnL8+Rr:WqO0mIEBHRHvoapNJ0uITCnLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776288715, "uuid": "3058c749-f20a-4672-baef-b4e375830dff", "value": 101364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776288715, "uuid": "0f342f82-5b01-4cdd-b1f3-3eac04235b51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288715, "uuid": "61adeaca-9832-45a9-87ca-006dd4356da3", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60360e8f-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776239688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239688, "uuid": "2f46bfe2-bf9b-4ab8-aa54-7046b2c45c33", "comment": "Malware payload", "value": "92c417f9f5e4b8b3feabf5da19b63ae6", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239688, "uuid": "678c40c6-9063-49bb-a855-cff7a53762fd", "comment": "Malware payload", "value": "bdfdbe655e0f5e2b9af3904325183aa17574c03e79a2ef9e041263f9926e026d", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239688, "uuid": "f8b89738-94a0-4844-afde-54a4626c7a57", "comment": "Malware payload", "value": "ec9d1d014e4db442754d5cd5a38f03e63e19cfaf", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239688, "uuid": "3b39613f-90d3-4acd-a8fe-6d1c093651a4", "comment": "Malware payload", "value": "03b7b97ca19ef7882aebee85c8987c2d37fabb2f4de06bd01cf4825f08e07387e943e453f4df4dee437218133b114579", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239688, "uuid": "2061c2f1-3b00-42e0-a0f0-72594070ea62", "value": "T1D3B2203EC985DFF00B6B31E1A56F7A1598540323B4386E8DBCCE81993B396508BB51ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239688, "uuid": "9b3c30c6-070a-4296-9276-9e083dc95c71", "value": "384:K98ZiLLxeRBaZjIJoacXNEloRy03hHOJYUfCcZoh4PQi0b4yD2Sv0Q03I6SdmUh3:K98ZiRfcJ2lh8HvZoWlU1hRBiE5So", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239688, "uuid": "7f07b473-a14b-45e8-9f93-2ddb63ac84ad", "value": 24084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239688, "uuid": "2950ed09-3b5e-4bc2-8bb6-fb4eabe5250d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239688, "uuid": "e3c31a8a-1a95-4953-8c4f-37d0f5df9b65", "value": "PO#26020038.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d99837c8-38cd-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776259219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259219, "uuid": "680e26d2-c6fd-4bf6-8bf2-adeec5f63f02", "comment": "Malware payload (AgentTesla)", "value": "f282057410bac9c3c96e5686dc4ce877", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259219, "uuid": "333ee8da-3c53-4d5c-a265-d133a30359f8", "comment": "Malware payload (AgentTesla)", "value": "bf70216afcd00c6f444061bbf8674f7e87166e7e78864621442f178903cca262", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259219, "uuid": "273acf7b-8f1a-4623-af59-898562123587", "comment": "Malware payload (AgentTesla)", "value": "29ce8e01efebdc9da9023a0640c71d2672e0987d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259219, "uuid": "5da8bd65-1eb5-4d48-bbf7-202849516232", "comment": "Malware payload (AgentTesla)", "value": "dacd2f13e005ab485bbe63ae48eaa41490f92e7c11a3abd4173cd6721018967475a867d7beb40791d4a3a2f5380ddaab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259219, "uuid": "d2490583-0aa7-47fc-b43e-caedae00ab7a", "value": "T1BD3622A2D8DC3CE4D46B54B52CBAF740321DEB2D98695E45BE7BB42984224973033E4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259219, "uuid": "6cd1919a-246e-4056-8e62-e5e730045090", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259219, "uuid": "3a7bd446-3681-4785-98c7-ce1c9cde7d9f", "value": "98304:ZAZtchLjRzhlvUv1dOPpFSmyKv81iHm8F8JulEorW/:UtchRVyv1GXqKvtHTWJuCor6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259219, "uuid": "67b53483-1cbe-48ac-b3b0-5ffd15daf537", "value": 5222912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259219, "uuid": "26dc2a63-f8b2-4a8b-838c-8842d92bc1ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259219, "uuid": "559eb9a1-eaa3-4a0a-9a4d-4915c8b0a153", "value": "\u6587\u686382524.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4de4a4a-38de-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776266432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776266432, "uuid": "df41657e-fb5e-4c17-b073-d97d881a78fb", "comment": "Malware payload", "value": "b2c85e12c003bfa1e6a725071dbe1a72", "object_relation": "md5", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "hostingshared99-com", "colour": "#52E029", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776266432, "uuid": "301c5f3f-87d6-416c-9f7c-867b61d783ee", "comment": "Malware payload", "value": "c03eed16fc03200c480b0c86a170a1f77a32fab582ff8571b7efbb63df8d9611", "object_relation": "sha256", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "hostingshared99-com", "colour": "#52E029", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776266432, "uuid": "4eb343a0-3c9a-4d1e-a9b3-c0f9bb0ab288", "comment": "Malware payload", "value": "4214696a2c7657296d72c3ecf430b741152df52e", "object_relation": "sha1", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "hostingshared99-com", "colour": "#52E029", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776266432, "uuid": "e955e3cf-7b99-4ca8-aa31-fd277789af68", "comment": "Malware payload", "value": "0b59aebe516227ae11e06d6b9e5db56f23f721c14a1de12102835053ea003b741e725f4b1b18f196b10d201c6c777dc4", "object_relation": "sha3-384", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "hostingshared99-com", "colour": "#52E029", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776266432, "uuid": "aa1e27d1-790a-425f-bb40-62fca99c8e5e", "value": "T194F0E109BA70F25001319A25DEF2E89DFC9F40AB542373042374CB159F3512E8B15146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776266432, "uuid": "83ecde1f-7e6c-42d6-b2dd-7c39961f0801", "value": "12:IaDIB9RE9AEyPq25f0dap9omFAHgQe76gvLs:DDIpEuEyd0d1mF+jQ6gw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776266432, "uuid": "9a5013b1-807d-4728-9125-73a549aed642", "value": 575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776266432, "uuid": "c8ebfae5-facb-41ab-a9c1-d6fff206083f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776266432, "uuid": "6f238b7a-35d0-4e30-b6af-979e513dbf49", "value": "c03eed16fc03200c480b0c86a170a1f77a32fab582ff8571b7efbb63df8d9611.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e785b046-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1776239915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239915, "uuid": "b1564852-4984-415f-a04f-24cf02d4a4aa", "comment": "Malware payload (DonutLoader)", "value": "666af115858562488846b5b120a15b09", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239915, "uuid": "b197696d-0220-4399-8749-51c447a6801f", "comment": "Malware payload (DonutLoader)", "value": "c07c04628ad2d8b5183c2664a6bda73dcc0fb0f911412784c3fcb00a92ba6ed1", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239915, "uuid": "608cbdf0-4b83-4eaf-b348-3596cb1a2f74", "comment": "Malware payload (DonutLoader)", "value": "4405f29430ff5d12a1c324a22a8c4b4b7f6e0962", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239915, "uuid": "f7565ce7-0c82-4596-be3a-b491507bc64f", "comment": "Malware payload (DonutLoader)", "value": "29c7caf405ff3c0467ac08f893145f2ca454fc48b22638290253be73e459788c12edbaab987741c0c4bc6c014af3aa4a", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239915, "uuid": "edb30cee-2cd4-476d-935e-4cd08128a988", "value": "T189B6E835C0B3B94B69E3DB899426C5E04C4F3C2B3A4DC945F88FA43C5CA6F5398615AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239915, "uuid": "36c3383e-6ff4-4f47-97bd-e60220838775", "value": "98304:kXlBCJMR78UWrrtBQ8LHk1Lnh65o7IJHmRCKczYrpuy2Bb4AcpTwSR:u0bUWVWMHk1zyo7IJGRC1zYrpuhb4h/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239915, "uuid": "60c9d111-245f-490c-aba2-0e5cdc60fee3", "value": 10537867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239915, "uuid": "4cacee12-d603-4982-b0f1-ee6ad88fb8d4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239915, "uuid": "2cc9dfa0-6e29-418d-8f09-b9bbd653b9e6", "value": "84747493492302348.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c3da81f-3924-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776296268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776296268, "uuid": "ee1dad88-54db-4947-bfd4-9667b74b65e9", "comment": "Malware payload", "value": "54eb8ca13ec9c0e128791fbfe8a0ae64", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776296268, "uuid": "f97a6dad-4a50-49d0-ba01-1aacf384bf27", "comment": "Malware payload", "value": "c0fff75ba77ae0fcaf69de7b96913ff1fcb829b4eee79deacff71a83814c0061", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776296268, "uuid": "958549ef-19cf-4749-a08d-6b343f6dab8c", "comment": "Malware payload", "value": "831f21df56bd992e2cae594ce89f1aacd0ce583c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776296268, "uuid": "d534ea82-aefa-4205-b012-3faa55bd9ea2", "comment": "Malware payload", "value": "8214c53ad0fabc7b7ff490baf38f197167ecb53d28dfe1c7a88c2b25f84e33140766a9f9fc0aa567465c382148f51968", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776296268, "uuid": "fcb9d9d3-b457-45da-819b-f4b2c0ce1d8e", "value": "T118137D6966857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49B9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776296268, "uuid": "19e57b50-e04f-4506-88aa-d4230fa8c49a", "value": "768:by+S9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:by+3co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776296268, "uuid": "a44ff069-8ba4-4aa0-bffd-b2f03219a723", "value": 45522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776296268, "uuid": "c998782b-d9e3-4ef0-99ea-f336b8c7eacf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776296268, "uuid": "518d60a1-e697-4be4-a539-4f7e18c83ab8", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e500a5d-38ce-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776259442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259442, "uuid": "f6efd499-3d1d-4267-941c-345535376943", "comment": "Malware payload (AgentTesla)", "value": "a010a0672b91a18a3eef8d9d41698137", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259442, "uuid": "5d34eac2-a745-427b-8890-0478ff85787a", "comment": "Malware payload (AgentTesla)", "value": "c16b9549139f0b8f9957cf939fd37eaa1793af61e303af88cffee376e32cd9e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259442, "uuid": "84a9ad23-0987-429e-b072-b6959e769078", "comment": "Malware payload (AgentTesla)", "value": "532426ceb51ef25bcff0597f0ff05362bdb9ba81", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259442, "uuid": "8706de82-1844-413e-be76-6998d7dd2044", "comment": "Malware payload (AgentTesla)", "value": "4ddd29541525ca51075ac57030185b5185704ec84899f74b912f76d971aa6466d18db94e9f75dddb663e90ba43dc9f6b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259442, "uuid": "3bf508db-9e8d-4b87-96fa-bd3c3b0ae1ed", "value": "T1E3569604C0A5B90D58E2DF9F9476D4B04C8F356E9E8F8B62742FA4BC2D96F93496048F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259442, "uuid": "0a7d50d3-36ec-4cc1-bf90-35e45cbbf03f", "value": "98304:Ue8mSiQS912BnCboFnzpSpyPr+TGqh2u07E6CAKjl7Y43gtFYNOLKbQ1faN+Sf6F:L8m5VCMYPaSq8r7E6CAO+4wtFiOLKKAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259442, "uuid": "92698b41-fed0-4327-a190-43aef8f54ee4", "value": 6193830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259442, "uuid": "2e29d7e5-4dab-4174-b0cb-d00afdd3afa5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259442, "uuid": "93bb2b16-a022-471a-8714-5ea5466507f5", "value": "Inquiry.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e45707d7-38b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776250647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776250647, "uuid": "a73fec63-5964-4e4b-ac7c-3f2db0a76aca", "comment": "Malware payload (Mirai)", "value": "72ae1cd00729769751abef2ca22ee15f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776250647, "uuid": "d86a4699-85e0-43af-a6e0-45ea6c7418b1", "comment": "Malware payload (Mirai)", "value": "c18a2e92cbf0a6fbe88d305f78a689c44f705fe474d9ea1166fd6c16f45d9aa3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776250647, "uuid": "f77fb22c-96da-4e79-9d80-187cf496eb6b", "comment": "Malware payload (Mirai)", "value": "440310cf443c793ebe9b4237de3e07ee33100624", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776250647, "uuid": "49741f86-d255-4b5e-9640-5b59c996a4c6", "comment": "Malware payload (Mirai)", "value": "24d9f99c838da3bc083398ff2e86b587a54f4dc02f26a91a4e91096964721e15660f8463422af5de202cfbae89671407", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776250647, "uuid": "ca59dc6c-78df-420a-8a3e-c60853c0953a", "value": "T1EB049E32D8786FD8C2748171F1B0DA791B53B5A042571FBF9AEAC1790087E84F90A7B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776250647, "uuid": "3bdf322a-3f72-41a2-9c90-f6e96f2f72b9", "value": "3072:PpBvRdVQjsdI5P3/tSGjVixY0/GJvu6SWKon+/BGZA:PpBKsi1VixYrffD4G6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776250647, "uuid": "d1f7eeae-1165-4176-af0f-1f3b9eea0106", "value": 175972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776250647, "uuid": "43f5769f-1403-456b-931b-a2a21b19df00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776250647, "uuid": "c8f7b068-611f-4e65-827e-25dce9e30a8b", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a7a6b5-389d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776238352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238352, "uuid": "5d27fd95-ec92-4641-ba20-559ad5dd0fdb", "comment": "Malware payload", "value": "d97be5e3c0bf09fd1b7e97b8df5b556a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238352, "uuid": "56a37bb9-b4bb-4a8a-bc16-851a66e6e21c", "comment": "Malware payload", "value": "c1bc4d0889a21ee2999e32f68ee95c1a54ecde6cbebce2c8f169aea32766bdf5", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238352, "uuid": "42b69cc3-d27a-4163-94c0-c2d9a991f189", "comment": "Malware payload", "value": "d74e423013f79a14573c339ecc7497c91e445b69", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238352, "uuid": "f7a17efe-ff30-482a-a0d3-d17ca985fe62", "comment": "Malware payload", "value": "df945c6cc993f516082c7f6632db799f7f606602a301ea504a37215a8d70323e7eac14e01d6cead45cb0ef686570e377", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238352, "uuid": "60f4bf5e-4de6-4683-8fc1-33e82bf5fd59", "value": "T172B24F3EC9849FF00B6A31A5A96F3A15A5140363B5382A4DBDCFC09D3B39650CFB51E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238352, "uuid": "928e28cc-902a-4735-8e35-2b01eb5b894c", "value": "384:K+8ZiJU+NONVWdjzPLlu9bSbJEG2gc9ThKuoXwM7XLWI6+cjl4PIPtZKh/x8aIie:K+8ZivtPlXwhJhXJM79z+HNUUmu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776238352, "uuid": "52f3f060-c5b7-4a70-8604-3fe6573ca959", "value": 24168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776238352, "uuid": "54af7fa9-ba8d-4b3f-8dad-45c8d09d6a1c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238352, "uuid": "e0bae722-a39c-476b-857e-a4c66e9ff0f0", "value": "SOSTENER.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68971794-38e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776267619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776267619, "uuid": "05bbdca0-cde1-4298-8c32-e795b5beea91", "comment": "Malware payload", "value": "cfe37559eab936666a6159d476b735a3", "object_relation": "md5", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "hostingshared99-com", "colour": "#52E029", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776267619, "uuid": "69da4e27-46ac-4ed9-b520-402402874b57", "comment": "Malware payload", "value": "c288428684bf7ad78ef334011d5aa68b19a4aa73eb61122c126262acb9ad80ea", "object_relation": "sha256", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "hostingshared99-com", "colour": "#52E029", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776267619, "uuid": "f08c6f56-9eff-4890-badf-6cb315e31214", "comment": "Malware payload", "value": "6f05171c2d56e173d5f1488d103e7fc09d538f13", "object_relation": "sha1", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "hostingshared99-com", "colour": "#52E029", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776267619, "uuid": "366191c4-ce87-4dba-b571-b286b621a939", "comment": "Malware payload", "value": "e166b5db4124428ad6d6deeb9bdb46bb5596d0cc4ffc14888135bf7adc705e36f25d8db95b8387a69cb6954dc1e2dfdb", "object_relation": "sha3-384", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "hostingshared99-com", "colour": "#52E029", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776267619, "uuid": "f5a0a3be-d9cc-4d9a-9b67-fe07c1f49e47", "value": "T18AA0110A0A203A0EA20B88A8008A8802B82A008A8300C8EA2223082A38A200C8228028", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776267619, "uuid": "ac85afab-e23c-4497-9b5d-526ea34e34cf", "value": "3:mKDDGKSSJJFHGmlidL7xuIFmG:hSGamc1x0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776267619, "uuid": "20371146-390f-4e8f-9ae5-2df409f011e9", "value": 69, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776267619, "uuid": "cd89069c-abf1-4c44-a2de-28264829181a", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776267619, "uuid": "f8ce80ce-b572-4fd3-af80-53ea1b1dcb9e", "value": "c288428684bf7ad78ef334011d5aa68b19a4aa73eb61122c126262acb9ad80ea.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23bd910f-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776239587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239587, "uuid": "b7d4bd5a-c061-41a8-9d80-c45c07d65d89", "comment": "Malware payload (PhantomStealer)", "value": "df25fce167a8d44e7e100153b0f1b698", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239587, "uuid": "4d6ed186-a69b-48ef-894e-d9af0203ff3c", "comment": "Malware payload (PhantomStealer)", "value": "c32a318cdec4326f129631c2d74377b4531e4e9cc28123666942653f3443cbc9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239587, "uuid": "d57ffd6a-5ee0-4ea2-96f3-876f2c85f18e", "comment": "Malware payload (PhantomStealer)", "value": "5a840a2ea1a4c3132cba8dc0e02946bf818a6ef2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239587, "uuid": "82771db1-9c33-4407-b28b-2aff42d7e7a2", "comment": "Malware payload (PhantomStealer)", "value": "3b1a17f8ee5d8cfc6eac2fbb04c12d7aa5aeda175d52546574a6037bbfd84e5ce68c9dac5b9e3c0c19d8c137e0e5c688", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239587, "uuid": "757d1d0d-70c8-49ed-801e-624a620786b9", "value": "T1C90366749439CF541E3B27199DE96C82FE7D481FBE3A34B9A96F488CF29008E14914E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239587, "uuid": "c8b86114-9710-4a19-986f-f5d449c2dbb2", "value": "768:2+fZaYAISyR9M7NWD0KDG79CDPDLGpbnoxJOY5ttBritsxfynrfZH8qwVHoVH6:2+fZaYAISq9M7NWDTDG79CDPDLGpbnop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239587, "uuid": "9e59f695-014d-470a-b514-0af9904c4b6f", "value": 37955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239587, "uuid": "b4737fd3-5354-4bbc-9b50-04767591eb23", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239587, "uuid": "23ef04db-fb08-41c8-8d82-a73214b7dcf2", "value": "vessels particulars.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f7f800e-3893-11f1-a769-42010a9c0008", "comment": "Malware payload (SkuldStealer)", "timestamp": 1776234077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234077, "uuid": "f4735f49-b7ae-4954-95f3-1e366fcf9457", "comment": "Malware payload (SkuldStealer)", "value": "9f8a0662f1cdc875208363c072470f86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SkuldStealer", "colour": "#CCA511", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234077, "uuid": "cc9a272c-9cbd-4582-a6e9-a804f1675a48", "comment": "Malware payload (SkuldStealer)", "value": "c33789b025204662b5843a0235f437ac4126da9fa5dcf9ec97fcb9a6c2d9b018", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SkuldStealer", "colour": "#CCA511", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234077, "uuid": "90696085-1928-4dcf-a290-a20a804934a0", "comment": "Malware payload (SkuldStealer)", "value": "abea96136659f2b5c244a237061035353f68112d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SkuldStealer", "colour": "#CCA511", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234077, "uuid": "3bf00ab9-9600-4fd9-90c5-c95571d3fc3f", "comment": "Malware payload (SkuldStealer)", "value": "f11b584a1c6f3e3f98d960cee648782adbecec1da0e66de3cf430605b6a1bab6bcca3f1e7360522f4140a0ec8a0e091a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SkuldStealer", "colour": "#CCA511", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776234077, "uuid": "73d1195e-f9b4-4658-866d-363c4061f0cd", "value": "T1FE573C47F8E21D98C4EA8270D13A811BB9617C281B7D23DB1691F7201F3A7F06EB6B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776234077, "uuid": "ef692f81-5c03-42cb-8803-d456707cc5c5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776234077, "uuid": "27dd25b0-7cd6-46d1-a60b-398cb505c7de", "value": "196608:9nE55tE8VFyF+NXsQIB3uXVjaPeiimAAl4nICMUbl/2j:9C3VFyzZVuEBJAAl4xf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776234077, "uuid": "4c5151f3-4dd1-4143-925c-e4fea577b4e1", "value": 27307008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776234077, "uuid": "ec3de25c-b01d-4c77-bde4-be848b78b319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776234077, "uuid": "5826e50f-e457-494a-92ea-d4234c9031e0", "value": "soe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f1581c-38ce-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776259448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259448, "uuid": "374de33f-e39c-4c40-b376-71c5a4d100d6", "comment": "Malware payload (AgentTesla)", "value": "e104213949c1fb19467c6d59d0c9fc14", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259448, "uuid": "920b31d5-0486-48af-853e-50733b52318e", "comment": "Malware payload (AgentTesla)", "value": "c34d450925e87b99990ceaa3e7d6f1f02c846dd981f4d7fb8b9331ec89fa4fdd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259448, "uuid": "73c5d22b-1541-4f61-809e-886bdc51f6d8", "comment": "Malware payload (AgentTesla)", "value": "e4c6e344647a038e6686e99b36d9282f292d0ecd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259448, "uuid": "379cce50-bc6f-4402-8421-86a1ae3cd9bc", "comment": "Malware payload (AgentTesla)", "value": "3c5375710619cb3fdd3ba765e6811e0dfa2ea82423869a70b1549250be1f42ef198e2ebf71162958ef3f6770ca415a89", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259448, "uuid": "5f3d43b2-dc7f-4322-a6b9-f5ef870787d4", "value": "T19265021589C43FB4CFDC162D40FE251EE3A05E8A541AB989EB73FD4AFFA7204521B189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259448, "uuid": "8103070e-da4f-4227-8c50-75f984355919", "value": "24576:C7+/yCfO7Jw2xPrJ6GyqXKMHSx65DBVwNvPof0T4zJq:4Vz9hHHCNnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259448, "uuid": "b7d50bdb-d331-4682-a051-dba8d168f3ad", "value": 1422867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259448, "uuid": "b764a351-56cd-4783-9a66-8ecb7b2280dc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259448, "uuid": "79a8602e-1c78-4aea-9a31-f9c4e2504af6", "value": "HT02528_8w77.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be5951ef-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776239846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239846, "uuid": "f148e51f-fe08-4ff2-9289-26cd14926f14", "comment": "Malware payload", "value": "4b9288e85f4b83e2ef32a429f0dce30f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239846, "uuid": "0901f323-1da7-4ac2-96df-11e3e556c193", "comment": "Malware payload", "value": "c3c850033dd2bf2b3604110e29c7fceed7f8e9743d19dcb0125d9a94ce07fcb2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239846, "uuid": "5de2b105-b4d2-4551-ac13-6968986fef22", "comment": "Malware payload", "value": "4ed3f4b1753b1fac8f880b1287084062fd38756f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239846, "uuid": "162703a0-76e2-4036-abcd-137b71036e84", "comment": "Malware payload", "value": "b1ff5fef52bb25f0ca090f0e95c01c85bac82ceca825b99429d64abcbb009800252cdf2d63f8e85baa77ee02cc1dd017", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239846, "uuid": "bcd2cd53-cf8b-4ac3-b18a-2665aa0739a6", "value": "T1682131540E01E3E6567227E6CA11679AEBE7582B25039915314CE2452F3492CD274EFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239846, "uuid": "2a157197-53d7-4acf-a64b-3a4ee529a5f4", "value": "24:stivwqdnE0aXqRxXIg1luDAaU2bKk51o+RjzSSF6qJWu0amXWOPKYFc/W0:YivwIjaXqRxXMDb1j110qJWJammOPKYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239846, "uuid": "eed3f899-2034-4f8c-a813-2c6137a97e63", "value": 1375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239846, "uuid": "bc06d637-3f17-4a23-b67e-1103278fe5c6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239846, "uuid": "d1e642a5-ec61-46d0-9c2c-da1925283a82", "value": "Connect.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d46a8c-38a6-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1776242521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242521, "uuid": "fae40568-ccc1-4b00-bdb2-fa61979da2ca", "comment": "Malware payload (SalatStealer)", "value": "0d734c60d72dfd292ece89b256011aa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242521, "uuid": "5c127fed-e03f-443d-8a58-2ac0487cbf5e", "comment": "Malware payload (SalatStealer)", "value": "c41c09c3e267f931503ecc6776911bb515a1d2231fb771df88ad2b75af195f4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242521, "uuid": "5808e771-ad29-4d69-9f31-b947e65df5b1", "comment": "Malware payload (SalatStealer)", "value": "512d4a54d1cfd43d5791cbb4d5bfa046087e44ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242521, "uuid": "0c0fc187-8001-4615-8700-b5d9a73a6e94", "comment": "Malware payload (SalatStealer)", "value": "5f3bec20efa9add36524cf9232f146a752eab5697d54c750d8dcc628d24ca080fc0a1eadedce12348a0e426a9c4d6f2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242521, "uuid": "fccca1ae-fa89-4e32-98c8-cf3a42ff41a9", "value": "T14BC64A01FA8B58F2E9035831555BB23F63306C048B28CBE7EB587E2BFD77691197A215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242521, "uuid": "1d34f961-83b1-454d-8450-93dc07a129f8", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242521, "uuid": "a5509979-78a3-404d-a4fc-33f624715557", "value": "98304:JsnXBlhIj84yLVOxS+Fb8PaUlC1XrR4tl5+UYhPsNL5Eu:EBVMxSb1lA9k5+UYVsNLau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776242521, "uuid": "58602125-18e7-444e-aff4-24b11d4c70d7", "value": 12317184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776242521, "uuid": "7c45a82a-abcc-467b-98a6-24d38bdc7577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242521, "uuid": "5942b893-46d3-43de-b9c0-06b43af500c3", "value": "SecuriteInfo.com.Trojan.PWS.Salat.390.31478.20438", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2da37a08-38b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776250341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776250341, "uuid": "412cb691-77d0-4362-94d9-3bca601cfa55", "comment": "Malware payload (Mirai)", "value": "86861e41f198731f082935cbcd54aa48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776250341, "uuid": "0851bc57-ebd4-4de7-9847-63922488cc2c", "comment": "Malware payload (Mirai)", "value": "c44a67d273a2469dd4a2e3bd425fd6fb96182d16f9fca3c429c6407293d48db9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776250341, "uuid": "2022d1bb-5800-44c9-a5f9-d7ec1315ea7f", "comment": "Malware payload (Mirai)", "value": "dc176c28d8be618cc205cc81978cfe6e00ce780b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776250341, "uuid": "acd3b1af-6ee5-488e-892d-aa3503ab7c88", "comment": "Malware payload (Mirai)", "value": "1d12192361cfee83b1c00ba07d517a85b9853bd0062793bb91d7ee8bd1773d49be2e425d00948921da69c2307ea6ac4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776250341, "uuid": "8afd5761-3a0a-43e0-8580-f55ca405520e", "value": "T13673025CBF6A78E286954A33ECFC4D852F8A527BD4FC261A01F11150903E5927FE6783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776250341, "uuid": "4a92f269-23db-4b0b-bd29-1853ae150bd4", "value": "1536:66OXZxyowPaU5yzfRuCn4Zn8mQcTHqEhu2MotvxxpxZ7z3LI:9OXZjwPejRuY4qmPFMGTpxZ7DLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776250341, "uuid": "2a78a1a7-bee6-466c-a929-2805d3d4a4ea", "value": 74684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776250341, "uuid": "e217b277-ba04-440f-8dfe-d96741fb030c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776250341, "uuid": "41dd9a22-ee8b-4e7f-9e0d-a75ba2ab3491", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f4db49-3893-11f1-a769-42010a9c0008", "comment": "Malware payload (DiscordTokenStealer)", "timestamp": 1776233977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776233977, "uuid": "6d6b438d-099e-406c-a4ff-28effddcf178", "comment": "Malware payload (DiscordTokenStealer)", "value": "11493bfd85d4bb0cd7fa58b432d39f7d", "object_relation": "md5", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776233977, "uuid": "d613ff34-5ceb-474d-9f5c-f4b4e27380a4", "comment": "Malware payload (DiscordTokenStealer)", "value": "c4fb6e20b97c0ee80a9d4a506a76ad623130077ee271f87958bc6ea9ce46e655", "object_relation": "sha256", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776233977, "uuid": "01d3155b-4e4a-420a-bf3b-d03501e6ba15", "comment": "Malware payload (DiscordTokenStealer)", "value": "453567cd98a68691d9505e41a4e6e84564a9201c", "object_relation": "sha1", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776233977, "uuid": "c40ef226-10f0-4428-bfdd-81d9323b36ce", "comment": "Malware payload (DiscordTokenStealer)", "value": "7e0f972146478774847e88c8a00eae864380fba8f2c310b3765170226d23b95c03536f38be3e26b1c82962e60206e373", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776233977, "uuid": "6ee94880-9fd7-4345-bbb9-1adcd44d6348", "value": "T194174CC3E8925AD4C4EE8374D16A819BB5A27C091B3823DB1A90F7342F367D09E7B751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776233977, "uuid": "be65deec-dae5-4799-9904-a75ae64f86b1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776233977, "uuid": "fd2a05ed-7e02-43b7-9d5c-e1ed6eb4e010", "value": "98304:Qgfqn9+T6ICtwolSYQjsUdCjNsKmZfLHfFGmcP155NLeRQi:QsAHFllQjmspZjHNGms1ZeRQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776233977, "uuid": "d0e963b3-7232-4795-b546-9f1300cce04c", "value": 19354624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776233977, "uuid": "360f0d98-8dc3-4ffa-b290-61b061db2809", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776233977, "uuid": "99e57390-ea6b-4a98-a20e-f55359401762", "value": "11493bfd85d4bb0cd7fa58b432d39f7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d360aad-3922-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776295544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295544, "uuid": "390503be-c6cf-4eee-a34b-9bad06109ff1", "comment": "Malware payload (Mirai)", "value": "172041461db5c165b7fcfe45daa1989d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295544, "uuid": "8f0f5ee7-51a7-4803-bc38-fc4976c55626", "comment": "Malware payload (Mirai)", "value": "c5a47bd9655599c1575c4398ee52dd5c756e6bf036afcc3df06e500322164763", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295544, "uuid": "ad95dc3e-99da-4e5e-953b-7d6c833a60cb", "comment": "Malware payload (Mirai)", "value": "ff387ec346773259cae279038abc9bb233fa2481", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295544, "uuid": "782256c7-58a8-4798-bd4b-136ddbc4223e", "comment": "Malware payload (Mirai)", "value": "27590b4c43590cae9fa4e4a6ad0780822f3865c51ca05df442e4d6a0ef0e0870611f17489e87af125f8b2ba214f04314", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776295544, "uuid": "1ee86e06-f878-4b0e-b8d0-ae1817725d13", "value": "T136534C49FB83F1F0DD4B0671505BB77E56349F024128DE6AEB98BE73AD32A02A11761C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776295544, "uuid": "16d8fd51-ce22-4c61-8ec0-21bac0fb6508", "value": "1536:0r7LfZhoEK5vy+0G/rUA31AFAUlixnsr:0r7rYH13KbanE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776295544, "uuid": "3a1da18f-3b4d-45a0-933f-a98cfb14bb41", "value": 62204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776295544, "uuid": "67cb778b-4826-4abb-96dd-378c9b40821c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776295544, "uuid": "86ecadd9-0ed8-46f1-b8d8-06812b826ca4", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b3afb3-3880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776225876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225876, "uuid": "95bcb380-0d09-41d2-a40c-b5b41c6300c5", "comment": "Malware payload (Mirai)", "value": "31c260fb7af348627cf67c5c7454decf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225876, "uuid": "e34e6fc0-f48c-474a-8b72-b9c4a25039b5", "comment": "Malware payload (Mirai)", "value": "c5ad3240e99a6e1f61c2938353dc46cecf742a5fb78f4ff685cd5eca75941178", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225876, "uuid": "40b5cf7e-4c1f-4002-bcd7-64c3122af3ba", "comment": "Malware payload (Mirai)", "value": "5ccc29a979a871c74936e183db31597ae01aa46d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225876, "uuid": "f88bd1a8-e173-4c67-8382-bb2a36ba859e", "comment": "Malware payload (Mirai)", "value": "e810f52869434ed9cb67cfec8c3fed85fc6731a8ae35c2d57b46d3aa606515a0c166959528f715ae735c41bf37669134", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225876, "uuid": "c3b36e28-5b24-40c0-8f52-bde8830afd86", "value": "T14DE3C81A9FA10EBBDC6FDD3702A9064235CC954712A43B7A3674D538F64E90F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225876, "uuid": "9765755f-3cad-45d3-b6d0-330c2ec58ddd", "value": "3072:WBE+rwbBgJNrzKk83R5SXa3F0kVBbJnC7:WBxrwGN9832c0Wbg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776225876, "uuid": "2b44b46a-3df6-48d6-b2dc-87e6874bcedb", "value": 156720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776225876, "uuid": "9efecee9-d3e5-495e-968e-3d7ad3230fc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225876, "uuid": "b375cc96-96d1-472f-a393-a7c5d55c7e05", "value": ".Sassy.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f31425de-38f8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776277730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277730, "uuid": "9bcd300b-f06a-4208-9499-2c7547ac007e", "comment": "Malware payload (Mirai)", "value": "719f96717465ac74338231d160a95269", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277730, "uuid": "b451cd86-1775-4861-ad0b-94e423634192", "comment": "Malware payload (Mirai)", "value": "c873b2f9e4bb18a5d9577628001097aa69516525dd3fdcfdf5a62c19cef00a6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277730, "uuid": "ba4436b5-565e-4912-8524-cdbb48ec542c", "comment": "Malware payload (Mirai)", "value": "9017ccd294c5c85c4b5ea37872fc3dbd6a8208c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277730, "uuid": "1eb28d9d-4d7d-4b64-b1da-c102d2e78c71", "comment": "Malware payload (Mirai)", "value": "fd0d24a591c8709a5ec518939c31d7ed221a5ac18bbf1e5411dc79f229fc1984afc4ddd3f9fafa91d1d3aa6b309d171c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776277730, "uuid": "6bd28e78-07de-459b-a2c8-85c8ed388db5", "value": "T12883D81E7E218FBDFAE9863447B78E16A65833CA37E1D585D16CD6002E6024E341FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776277730, "uuid": "af8bc233-c1bb-4251-9af5-36fe2a1fbf9e", "value": "1536:lv1ZlKmxtBidTspK83i2HSOUWiaVeAxrHQ:5Jxthp1i2yOUWiazrHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776277730, "uuid": "48501b2c-bea4-4578-8aa0-64381ced1336", "value": 84812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776277730, "uuid": "c2c35bd8-1213-4267-a73e-92988cc06a06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776277730, "uuid": "2d20039c-73c7-41b6-aa6f-7bcd5d38bafb", "value": "FGx8SNCa4txePA.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11612897-3924-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776296249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776296249, "uuid": "661d7f95-df20-4132-a522-343959f1ae03", "comment": "Malware payload", "value": "b18f2fe730f4dd3725aee3c51d987e1d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776296249, "uuid": "e8789f06-bf54-4bca-a1b8-b2064f426721", "comment": "Malware payload", "value": "c8e7f2646ce55f8b8846e2950aaf5f248bb764dff2e1e231a7f0b97f4836b039", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776296249, "uuid": "144ce74f-bf25-4564-8576-005a3f54b087", "comment": "Malware payload", "value": "8b01a329e5e0ef122218c58548b63dc556033dc2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776296249, "uuid": "45b15966-64bc-4dc5-89dc-4d0731246b77", "comment": "Malware payload", "value": "72b09bbbb84dd463dbf7ad97246d934b994d17e5d96e84bd7e6b503808f7bd7f653f2e3edcbc4d21c2d6ae436870bedf", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776296249, "uuid": "19943777-6e81-4e30-b1ed-14b406b28dfe", "value": "T121823A0FB9424216D0D200B49676867BD97998B637C814EBF7D08AEE1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776296249, "uuid": "30627b16-1819-4565-aead-da139a2a06fc", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776296249, "uuid": "db5e3a53-2c57-4de3-8757-f47b623e843d", "value": "384:RI78VGQic16wzw077u9NHuagBhav8U9cP:aA40769uha0Ug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776296249, "uuid": "513cc0a0-b725-4326-8613-9714bb96ef10", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776296249, "uuid": "cd3976c0-fc2b-47d9-bf8f-8447930bf8e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776296249, "uuid": "5ebab833-588e-4fe6-aee7-f86d2cb6366b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e0db86-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776239531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239531, "uuid": "18e81a9e-c4c1-437b-bf16-397f70423b6d", "comment": "Malware payload (RemcosRAT)", "value": "0179da15286e9c3fe1323ac2761c9c87", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239531, "uuid": "bb2ec3bd-8a3d-47ed-ad36-9a2403f56fed", "comment": "Malware payload (RemcosRAT)", "value": "c948d21b800bee0f1793b843d03607b5dc297dce916b004dc6b9862cd3c62fa8", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239531, "uuid": "65fd0991-7d4d-4ad8-bd1e-6fa478ef6d11", "comment": "Malware payload (RemcosRAT)", "value": "f036506e2ddf3e6d9cca059d6a5a92e2a43356c6", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239531, "uuid": "3beb601a-3da0-4287-a0fe-49060cdd04c1", "comment": "Malware payload (RemcosRAT)", "value": "af82ec6ba31a38b151e5deca07b03bc8740dadbebf669055ded287985a8deac87e5da6de38d0ec9101ea6fd8595effb6", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239531, "uuid": "39ff1e01-87b6-438b-a18b-389a9b850e9e", "value": "T143126CBCDB42CB3BA909FC0D53DEAD449D86717F37E3186D7D9A2C190AA27C85109938", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239531, "uuid": "be811cc7-5c72-4100-ac33-89da22b2126c", "value": "96:MaemToBukayJ0IzL474hjDgiB9pru3YhtDAlwEJVduiKSP5b37NuhtLlZjoa:MakBfFhZ9/8ZFw9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239531, "uuid": "b89b9f5b-57fc-43c1-877e-ab53082dce4d", "value": 9563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239531, "uuid": "a59385b2-e5a3-4ea2-b244-7c1941fdc203", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239531, "uuid": "3f0e6308-4f61-4c4d-8af9-f6c24a6cc0dc", "value": "OCBC Bank_Payent Advice_Ref236563.pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1debc127-38bd-11f1-a769-42010a9c0008", "comment": "Malware payload (MacSync)", "timestamp": 1776252032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252032, "uuid": "9c94f181-74c6-43a6-a0a3-0ed06c9bd1e9", "comment": "Malware payload (MacSync)", "value": "66459a3577da51fd5d36252be37121d2", "object_relation": "md5", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252032, "uuid": "4e838998-e3d7-4248-9ec9-38ef8dc0b079", "comment": "Malware payload (MacSync)", "value": "c99e428528208565a51e34518b90e835e39d150fce729846a46e2f657c4b093b", "object_relation": "sha256", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252032, "uuid": "361539df-cf03-4702-9f53-12a85661b27e", "comment": "Malware payload (MacSync)", "value": "2b3bf40a7e255c2684a4587ef8086f430f7b2767", "object_relation": "sha1", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252032, "uuid": "8fc6ee36-9800-428b-b84d-920a1f9ee728", "comment": "Malware payload (MacSync)", "value": "7abf15310cc07a14fdf319e3bf7cfdd57a6c8dda259cb1edeeef216b222b9be99471096f32e8583efac82d4ba3c04e8d", "object_relation": "sha3-384", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252032, "uuid": "dab31cdc-7e86-4f04-a33f-c1695e1bff3f", "value": "T1CD31E90355284B0AE9DA44F8FFF0405A6901B2A63F75E20E4F651004C7AE37F1D9B822", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252032, "uuid": "cf06d10f-4a13-4fca-b406-f50514ab8ace", "value": "24:ESatxP4jeJrzVPoENc6YdkaS9Y2Q6w/HH2nsejpoDszNo9rm3Sn:ESOQiJKJSO2QF/n2sOGIJoN0Sn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776252032, "uuid": "29fc43d4-2abf-48fa-ab48-f2a208027c9a", "value": 1450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776252032, "uuid": "5f504018-ecad-41f1-a653-db75d0940142", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252032, "uuid": "94f08768-77ec-4f13-be74-0c86f20362a7", "value": "c99e428528208565a51e34518b90e835e39d150fce729846a46e2f657c4b093b.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e4b7c8-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776239785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239785, "uuid": "05baafea-e2bc-4906-945e-4727f4117d1e", "comment": "Malware payload", "value": "d02d32f9ab5f9bf942d36052b6e0cecf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239785, "uuid": "2d779a55-2382-46a1-b81f-13186074699b", "comment": "Malware payload", "value": "caf45b96c567641e4f7d3aa609d429f52ba195dafbaf3db1eecb20e845f8dc5f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239785, "uuid": "1ebea055-33f9-43b1-ad31-693d58986692", "comment": "Malware payload", "value": "073b0718839dd1caeb59130d60f12c93a6207e58", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239785, "uuid": "33e2f6c2-5330-42b3-8163-fbed5e924d3e", "comment": "Malware payload", "value": "29fb2051c34b0c81f27480f44802b77ca36c85a3e0d32a1218c5f6dfb54b2af0bb469ced2343595039d7b11a5cf10f33", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239785, "uuid": "26ac2feb-4efd-43bf-8e2c-9029f0b3773c", "value": "T157640B38ADEA002A7173EF55AED47497E96FB733370E585810C1038A4723949EED963E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239785, "uuid": "cb88538d-ec7b-49b6-ab21-8b2b99cd03b0", "value": "6144:5ONyqrsggomOUXVYgorEI+F+o2L3BX/y5QBr6iZqLpp41G9xHEfMTS5:YEqrQoBWSn8+o2dX/y5QBr6iZq74uqI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239785, "uuid": "4fa9538a-5c24-4e4c-9846-75f3d97665f8", "value": 310060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239785, "uuid": "e8d7bef2-bf54-4528-911c-e09282d1d3b4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239785, "uuid": "2560e171-fd2f-4238-bf1e-aab4da43ff4c", "value": "PURCHASE INQUIRY.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f388f2b-3912-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776288730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288730, "uuid": "3e13ce65-4ac8-4f39-a660-f7e98b3a2f18", "comment": "Malware payload (Mirai)", "value": "02e94e35ec2312ef44e3ccca3f68731e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288730, "uuid": "e5f0cefb-a2f3-45f6-a235-b79ef5851088", "comment": "Malware payload (Mirai)", "value": "cb8d90fad2651742d19e49bf137ac8f08b2b27a86bd21423b9581a9029a3200e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288730, "uuid": "5be10e22-58db-44e2-badb-42b454baa8ba", "comment": "Malware payload (Mirai)", "value": "1a3d92e89dfa0cb53b60804315284d82b278a2ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288730, "uuid": "f6566f15-68f8-4649-8f96-df9be6e85822", "comment": "Malware payload (Mirai)", "value": "309c983b10450d19f8a6680b4eb43e089ab545dbf1d0bbc36ddbef2d6fe351abadab68d74c16638cc6da5f3b8c5bdcdf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288730, "uuid": "7863d551-3e36-4a11-afd0-4732c9d62137", "value": "T152C3D80F6E62DF7DF32C82358BB78B36A659239533E0C585E26CE9415D6024D182FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288730, "uuid": "a3e3e243-0afc-4baa-aa2d-2e6679a23f9d", "value": "1536:e9lPZQROayOawzaNNNNeRCIZ0OtKLSBxYV7O3uyqhZsnL8+R+b:evZ1NsCg1BOVzZsnLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776288730, "uuid": "5f900761-42b9-4d75-956e-e097b68910f4", "value": 126044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776288730, "uuid": "43163160-488c-449f-8d45-f6e5ff21d4c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288730, "uuid": "9e24e031-ecf4-4f3b-9e4c-c27818902ef7", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6600a299-3922-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776295532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295532, "uuid": "a465f619-f3bb-43c4-bcc0-06e8f6c74373", "comment": "Malware payload", "value": "5553f99225f8ff9fff1c37aba662ff2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295532, "uuid": "75cd9ae5-968f-4966-9f75-08098e0df9e8", "comment": "Malware payload", "value": "cbad2d84ad74e4a952f8a76dc0393c4957789b0b57ba928851c6958a44a832e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295532, "uuid": "518d1225-268c-4dc1-8fdc-cfd51fabed7e", "comment": "Malware payload", "value": "19a8fe52c1b79b233375b69f5b2d6483d636a0e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295532, "uuid": "cbcf57ad-35c2-4091-a04b-93ab94f41395", "comment": "Malware payload", "value": "4eba257ad03a4d08859a80933f946e9d97e96e90da5e2b8c0785610c24d09a187e85f5f09d717cf95397ed565a628fa9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776295532, "uuid": "8f7d2db8-9c64-48dd-87bf-ff8d361ef23f", "value": "T1ADC39CABB24F1450C42647F51BCB5B9C2E3324019E2B9AE77C6E373E2A365DE58063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776295532, "uuid": "5e4ababa-efbd-4740-ba2e-96bd91f28a6c", "value": "3072:i/ZB12LNEBITJPScwKJSIqgI85glCzfQffHXsqz:i/T1FBIxS5b7gVCCzfQfEqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776295532, "uuid": "aa7deadf-a72a-4e37-b4be-3dad5c2bd3c8", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776295532, "uuid": "f36320ae-4213-47ed-afc2-1b65fc67f4de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776295532, "uuid": "5f7f65b2-9aab-48ca-b474-4c7b2caae19f", "value": ".Sassy.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bec07d4-38f9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776277799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277799, "uuid": "620db22a-c451-4025-a12d-64bd5322c1da", "comment": "Malware payload (Mirai)", "value": "0c2d02e85af7075adb5c3bac160086d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277799, "uuid": "f1f9e7f0-6497-4afa-b674-77950d03040e", "comment": "Malware payload (Mirai)", "value": "cbbd99934fc676313b6dd6f7a4e7e406daa7747ac09f80d4f59a7a165d265de7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277799, "uuid": "b7e06fdb-6cb3-492f-b967-a2f3ec57ce00", "comment": "Malware payload (Mirai)", "value": "13d5c0fe0f2e98470bdb61b8cf029923ef310bc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277799, "uuid": "2a3152ef-b18e-4e7c-9f42-88aa5279df0d", "comment": "Malware payload (Mirai)", "value": "b934321a5d0c78cc2befc82d3c13d48fc2e7afb7d421e3da745165f0bef7f555c3a337064800b307d3e4e21964db364d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776277799, "uuid": "cdde1098-0f41-460e-a946-7bda241f31dd", "value": "T1C9532982F48B80F2D84B493050A7F63FDF30D9EA5170DA5EEFA99F75EA275428111A4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776277799, "uuid": "39c83bda-7423-4764-ad83-ebf8e679f9a3", "value": "1536:Ur09IO9eOLTUl/Mh9+L2WXyQsaHXYzwHTUdcpes:k0iO9eOLTUl/w9+ziFcXYzYTIwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776277799, "uuid": "bf82915c-8f4a-43c2-b814-a32bed5ae7fc", "value": 62544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776277799, "uuid": "4ef3d9df-6a0d-4e60-8e43-2f4210066761", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776277799, "uuid": "e86fc357-3e94-4518-ac60-2c76f8bcce6e", "value": "FGx8SNCa4txePA.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fcc77a4-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776239553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239553, "uuid": "6d8fb613-e898-46dc-aa73-f2cabcb70641", "comment": "Malware payload", "value": "942654b3072c6711a964abd99af89015", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239553, "uuid": "d7ea79f3-776e-437f-8e4e-ff4ab31d776b", "comment": "Malware payload", "value": "cc6731c27c054cc7008bf9000d455bdd4a52f0d83b031a492b3622561a923024", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239553, "uuid": "b61f6c7c-b738-4ba0-b6a7-b0930486022f", "comment": "Malware payload", "value": "f6a133b61b75ca7f4b6f16e0c1f74e2e6df16b24", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239553, "uuid": "ab70c110-0a5b-4164-9864-799eb6bd5401", "comment": "Malware payload", "value": "37f0d8b3b5a98e98573332f93529c77ea3676c0bca81a87a061deced14d38de2314d29c030ac36831da534e767c07a87", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239553, "uuid": "14f3a31c-6358-45fe-9c54-2e24b59fe251", "value": "T163A502119AC83FB8CFEC561980FE161EA3E0498A5015B98DEB73BD47BFE7A04511B1D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239553, "uuid": "75a9d561-976e-4db7-b63b-a0b52b33b180", "value": "24576:NiIIW1O0iB1e27YgmOTtL7yFAMFuZ1pTtQci/GBm6mtZSYW5xoslrTgikRnvhYe1:NiCUBQQd0G1TniuBVwvslQbJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239553, "uuid": "ecbc0438-3efe-438d-a694-27fc72664d42", "value": 2129180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239553, "uuid": "6738976e-cab7-4039-8061-d2b1ec02572e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239553, "uuid": "0f0776ea-8365-48f1-8013-a8ecc6e084f3", "value": "shd.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6056a8e-38f8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776277708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277708, "uuid": "2206ab78-be80-4464-a574-e5cd16d7fd1f", "comment": "Malware payload (Mirai)", "value": "11f70e88de06f1e198c2a98119fd16af", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277708, "uuid": "098f9719-d286-4900-87a0-4b2a5744193d", "comment": "Malware payload (Mirai)", "value": "cc7403766bac8f5b480e377ad786f2bdaf182cca8450626a014b43857e4dbbe9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277708, "uuid": "2fdf5713-6e85-4e0b-9ac7-87f0679b047f", "comment": "Malware payload (Mirai)", "value": "2d60b1f965e11029c2c8d2f05f7f02143bb4d6eb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776277708, "uuid": "c4985680-c91e-4741-b192-1739d908ad65", "comment": "Malware payload (Mirai)", "value": "470f4bc80217298bc9847ce90c3764dce7eacc6c0760bdc947b58c48239b232de7f1ce721d23142e671abc873d8663ce", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776277708, "uuid": "864287f2-594f-4fbc-bda4-011b4a659cca", "value": "T1278192D939A24179D8BA149F31BA7448B0969BC173C57F5C59CC39F2828CE072F61A2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776277708, "uuid": "e588f3bf-bf58-4ea8-9c31-31ddc2b70756", "value": "24:ItxCGbxBH2ikx8csyxpPQxH56xvBixJKibtxOi3xH56xnKujxVrcxI0IUIhxAdA9:inEJ0SSfHPKR0Od9hRTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776277708, "uuid": "3652d6e7-8220-424b-8cd5-82757b88bc7e", "value": 3982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776277708, "uuid": "a05a029d-fbec-4a38-8678-6834c3f50ed4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776277708, "uuid": "f4eb93af-7e04-48fd-829f-807a9eb18d14", "value": "XKcNhY4G8rcYpb.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb6530d-38c0-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1776253483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253483, "uuid": "591c5642-67bb-4eab-8553-ba0eec94e243", "comment": "Malware payload (njrat)", "value": "1146d3978a908b51d20b323fd260495a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253483, "uuid": "b85ec41d-e1f7-4586-b439-e12d747619c7", "comment": "Malware payload (njrat)", "value": "ce0d08be516376f5decc3bf6d8970fa493c925bc013a088c2a4eb8ed9f9fc3f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253483, "uuid": "9b7912e9-4aa0-4a62-b733-0e2e9babc1da", "comment": "Malware payload (njrat)", "value": "901a7e8d56814d032e2e83d6e61d5d899e221e48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253483, "uuid": "b42e60a8-5a5a-46f4-8b0f-19c041181548", "comment": "Malware payload (njrat)", "value": "d751a86ce5d658a3b009d16a63d7608d4f6bd9f0d3e518c1b01ca69bcbfb8fa1b22b34e36d948bc4f86c2fa97208836f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253483, "uuid": "db4bc31d-4c35-4afc-8f1b-c9ca176fc9bf", "value": "T127D5121C33FACB18F2AF4BB4A87185664771FD178D62D76C589139AE04B6F48BA10B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253483, "uuid": "94efd3fd-ed7b-4618-ae5f-cc1083ed9769", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253483, "uuid": "dee9d671-19ec-4654-b3a0-545d4667f2d4", "value": "49152:TgVUlsHjkmiGWU5FLGpMZ7iKPJ5W1tsclR0BxMzaRw4k6WY:TgVUuHjkDGjzqpgmwQ1GuRxzew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776253483, "uuid": "c1f7e447-7adf-404d-8a9d-18f2c5dfe65d", "value": 2945024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776253483, "uuid": "cd738d83-f0c7-4e5f-96c9-54ce5cbb64ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253483, "uuid": "d4e5e9dc-83da-466d-8e84-a811adc4e308", "value": "Bootstrapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f8a853-3920-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776294693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776294693, "uuid": "14e82bd4-e390-40ad-a175-aa85297cba49", "comment": "Malware payload (Mirai)", "value": "43cdd749f1cddc7dc84cfa44f8b0bf20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776294693, "uuid": "82e44c78-82ff-4cb4-a956-99be6fbb1d04", "comment": "Malware payload (Mirai)", "value": "ce9a05f2f5ce82cd3a4345423047209e347fb64d7c7cb2c34510e4a4186e3d58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776294693, "uuid": "100d1824-cbf9-4708-9d4a-50f5c46749ff", "comment": "Malware payload (Mirai)", "value": "15d00778ba2d9e800e6dc608be042609f14d2ecb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776294693, "uuid": "31e42f29-8cab-4e8a-914e-3159e85fa4de", "comment": "Malware payload (Mirai)", "value": "a7487508581fd742ca000ed35a49a3111097f151621d3e5e476a6fbaf39aa614d555d62c72e21d3118c36d263e691c57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776294693, "uuid": "c021deb5-534d-44ab-9019-cad5210782ab", "value": "T19AD3F7C7F900D9FAF80AE3374853080AB230B7A649525A377257357FED7A1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776294693, "uuid": "f16a67af-b95b-482b-a0be-3dbe0b14be9e", "value": "3072:ICW4mq3PjAEEyxFvTVayw2F9hooE7o7V1jbi/LJQREqv:AVyx9Bad2GD7o0LJQlv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776294693, "uuid": "53b9c73c-09b9-4c52-889f-68df95b3d914", "value": 140064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776294693, "uuid": "733bddc8-7279-4e6d-b6e8-68f3fe816d0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776294693, "uuid": "8528a41c-7f6d-4a34-8a64-19e102cd0cbb", "value": ".Sassy.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6861419e-38a9-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1776243567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776243567, "uuid": "2d0259ef-0859-448b-9936-f6566b87bae4", "comment": "Malware payload (StrelaStealer)", "value": "c4be77493e9dbd5921e5ba372eda2f17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776243567, "uuid": "4d7b45e1-ee9f-41b8-9ebb-e9ff79643132", "comment": "Malware payload (StrelaStealer)", "value": "cfd0c55ad575f071d84864fe0ab927a532838ed012974924ce6eb6394d8536fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776243567, "uuid": "ec6fe2f2-92bc-44b9-b048-e46b0c5226c1", "comment": "Malware payload (StrelaStealer)", "value": "5b6a68f1d1e1ed4d2375652e1859718fb01c0f51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776243567, "uuid": "b8310541-3618-495d-a763-00927a3a5cbb", "comment": "Malware payload (StrelaStealer)", "value": "b77c9a8f07889a7aa856f89022f958236012d1a721d3d63f876517c1c465ce473b6f3fb13ab139c9b88a6188eb161294", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776243567, "uuid": "f78c60e3-8acf-4ecd-853e-4f2a28ab576c", "value": "T147B2A57CD6E5EDC4C79B22F078AFF7D401AAAB17B9260B5CF8C814461E20354BB74698", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776243567, "uuid": "ed0412c0-08c1-4f38-abfc-a73158529c24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776243567, "uuid": "31f66a32-0abb-4ee6-ba2a-85945d48798c", "value": "768:hz57Ngy0RcHbFEkdNCwWpspab9p+b2ye16+4:5Hb6kdNCnpspE9p+b2ye16+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776243567, "uuid": "5d76d019-b2ef-46c6-857a-1ec70fcc7323", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776243567, "uuid": "bea60e40-d295-4899-91d7-37a36414ea4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776243567, "uuid": "2cfeb9ae-06aa-4456-a389-ed2b6e1875c8", "value": "Teklif i\u00e7in IMG Talebi RBT MFG.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f169bdfa-38a6-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776242509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242509, "uuid": "6bc49c47-dc56-4b5c-99f3-2868e0121ccc", "comment": "Malware payload (ValleyRAT)", "value": "8b4f9b29a2d11acaada34fb5afb1fef1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242509, "uuid": "93070c0c-a7f4-4753-9520-cff9bd65c3e7", "comment": "Malware payload (ValleyRAT)", "value": "d0c5ff295ee23ff33b42061bf533375fc78d7bfbbb0c962454020ed98b258838", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242509, "uuid": "41c6cf3e-eef1-4e05-9c6b-a8e4723bc8ed", "comment": "Malware payload (ValleyRAT)", "value": "c0cfe5b30d84212c28bda84d7556056a4bae6091", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242509, "uuid": "cb92db0d-c11f-4487-8f79-31ac0ef4ab8e", "comment": "Malware payload (ValleyRAT)", "value": "4eb773bd7652ce96268bb9955119832c34195e216240baefaec4e0ea20c00a8d0c436b13cb000e58a98db6fdf324f60e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242509, "uuid": "eab06b73-2fc1-45ef-9ad7-c3a690a1c463", "value": "T1F133BFC3C7A48443EA93A970216AD753AE3F9FEB1C60A8571BD5D5090DA37C1EF1812E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242509, "uuid": "ce4e2647-36c5-4337-a15f-acacb50af46e", "value": "f5650bcf9c98a489f514ea99d9ef802e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242509, "uuid": "23474608-fbd1-47f0-aae5-df67419602d0", "value": "1536:wBIsVkW7f7q3z+4VZmk98Pqz77+4VZmk98Pqz7+:mIQGS898yi898yG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776242509, "uuid": "fccf0710-89ec-4e0e-93f9-f3bcd9bb3a06", "value": 51920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776242509, "uuid": "516a9f06-45f8-4732-a442-e21c8b74b9e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242509, "uuid": "4029ff05-a902-44fa-a1cd-8a91926ae620", "value": "d0c5ff295ee23ff33b42061bf533375fc78d7bfbbb0c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03dfa6ed-387f-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1776225360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225360, "uuid": "e64e2c25-8902-4ea6-942e-fb095cef25d3", "comment": "Malware payload (Phorpiex)", "value": "6058d3539ebcea72db9c7e1d86c2b80f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225360, "uuid": "4ad002de-f192-4285-a0fa-df45eb60eba3", "comment": "Malware payload (Phorpiex)", "value": "d15a3c2a2bb2a73bc3d92af0f8342fb12e77ee489e38d76ab37670029ba2f87a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225360, "uuid": "03d62452-d160-499d-aec0-6d109754a29c", "comment": "Malware payload (Phorpiex)", "value": "8a2c79fb7b537b85307c2c6d53b91b27a8763dfc", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225360, "uuid": "77a74b2d-8571-426c-ab2d-658121389922", "comment": "Malware payload (Phorpiex)", "value": "cc56e3e2b138207f27a4ece75030b6b6b6cc94462de1a36c65748a245b84c8d784244f0271c0238353cee144d4bb286d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225360, "uuid": "03ef4429-baaf-44e6-845f-93c5abe692d8", "value": "T1BB823A0FB9424216D0D200B49A76867BD97998B6378814EBF7D08AEE1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225360, "uuid": "264c20de-4bbb-4823-9f3a-ae71f461b516", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225360, "uuid": "d0bbc466-73f2-41ec-a0f7-941002bf53d7", "value": "384:LmI78VGQic1Kwvw077u9NHuagBhav8U9cd:vAE0769uha0Uu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776225360, "uuid": "e702a2d3-52c3-4cdf-950b-bd229a993136", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776225360, "uuid": "a89c40c4-5ebe-47e8-91f1-1c2e49f0a014", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225360, "uuid": "852721fa-4369-4841-8d59-99a544cc5f28", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d886fe9a-38cc-11f1-a769-42010a9c0008", "comment": "Malware payload (MeshAgent)", "timestamp": 1776258788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776258788, "uuid": "c2c26f20-7892-467a-b46d-ef0d41f6259a", "comment": "Malware payload (MeshAgent)", "value": "d55c29190fc88872c096a3dad1a12a47", "object_relation": "md5", "Tag": [ { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776258788, "uuid": "709f1c02-0b5f-4fd0-91d4-ee2c21cb4981", "comment": "Malware payload (MeshAgent)", "value": "d18f44233eedff915615c7d618a50c3fefbd571d0b70e83b4e01339097d208ea", "object_relation": "sha256", "Tag": [ { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776258788, "uuid": "1035c54e-69bf-408b-9fc9-f338374c404a", "comment": "Malware payload (MeshAgent)", "value": "add984abbad7beaa20f8246b6a8ee45867054cbd", "object_relation": "sha1", "Tag": [ { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776258788, "uuid": "d97a1359-fc27-468f-abd4-9ab990a7be56", "comment": "Malware payload (MeshAgent)", "value": "b054604b432e56000314ffa665f7ee63c5978ceb018fabe4e5c388ef401c89d1b64f458fdf9458e8b2d92655188bdf35", "object_relation": "sha3-384", "Tag": [ { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776258788, "uuid": "9b44fd7c-08b4-4b0a-8343-082a56a5faa6", "value": "T1E322A64162A004F9C6522F23DCCB77963AED48BF412F130072E8CA297ED256E877B1D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776258788, "uuid": "f4349028-9ab1-46d6-a6b5-f17b6065ab6b", "value": "192:zRXuJelAEjRUyqAojLS+DvUCcjeD0SwmvR02wJWsQuu9ze30Gp3e:Z8URUyxoPjDMF9mvR02X7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776258788, "uuid": "c49cbc40-0ebb-4071-981b-1a7d9e3fa7f4", "value": 10662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776258788, "uuid": "fb48155a-51a9-4587-b620-a260330fb487", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776258788, "uuid": "0b7a4355-ed74-49dc-8db4-20ee663203bd", "value": "setup.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f48f5903-38c5-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776255828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776255828, "uuid": "56ec4340-ac11-46dc-b515-21e55da0e756", "comment": "Malware payload (AgentTesla)", "value": "72adb4edbe3d9186fdfac014034fb709", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-crescentegramas-com-br", "colour": "#ABA7E7", "exportable": true, "hide_tag": false }, { "name": "sativagina--crescentegramas-com-br", "colour": "#B9AE42", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776255828, "uuid": "9b27d8d5-18d4-45d2-8816-0eb2b5dbb53a", "comment": "Malware payload (AgentTesla)", "value": "d210faa70538372cef9aa35db27b9e6fefe9b66e65ba7d1eb948cc07f746129e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-crescentegramas-com-br", "colour": "#ABA7E7", "exportable": true, "hide_tag": false }, { "name": "sativagina--crescentegramas-com-br", "colour": "#B9AE42", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776255828, "uuid": "a2cc422c-305c-4618-b162-124c2cfe4b5f", "comment": "Malware payload (AgentTesla)", "value": "522fcd3a8f670b1cbaf206b9283f3a8d9b0d8d43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-crescentegramas-com-br", "colour": "#ABA7E7", "exportable": true, "hide_tag": false }, { "name": "sativagina--crescentegramas-com-br", "colour": "#B9AE42", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776255828, "uuid": "cfd6b221-255c-4f88-b164-5fb1a1aea95a", "comment": "Malware payload (AgentTesla)", "value": "c58d0fc512cdcceaf93cbc718511f45da8b56b58731c2ebcc5574ba3f4fdf1ba6e1cdbb6b5a9a7b6dbe117a2fb8e7750", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-crescentegramas-com-br", "colour": "#ABA7E7", "exportable": true, "hide_tag": false }, { "name": "sativagina--crescentegramas-com-br", "colour": "#B9AE42", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776255828, "uuid": "ac9efa87-4e6b-464b-8a0e-97871314343d", "value": "T1ECA5335F7C20633C992EE382D6921F075E92A3C4B0E11577C05A74CBF2FA491CB8A59B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776255828, "uuid": "591f3d83-bd91-4b8c-a6ec-977657ce3b18", "value": "49152:0J475c6eYg02G9pAvlzsFXseW1U8CiwOWICKaT:W4+6lV9pANsEfCnICKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776255828, "uuid": "ff3ace51-073e-4cff-9b35-b8ac28e973fc", "value": 2160011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776255828, "uuid": "057740ff-4eeb-438b-89fd-bd2cbc4ecd74", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776255828, "uuid": "3b8bf712-63fd-4a87-b235-02190e8c5a0d", "value": "Nuovo ordine.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "934008ec-38c6-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776256095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776256095, "uuid": "95d277c7-17c5-427e-90c3-9907690148a7", "comment": "Malware payload (AgentTesla)", "value": "69ee99f226b3d9dfc9bc28f73143a487", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776256095, "uuid": "626af262-16b4-4420-bb1e-a68e05a0e52c", "comment": "Malware payload (AgentTesla)", "value": "d2905e367942c6409ddde8fd54c857d68e34e61927f2c617fa1693713dbd4ca4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776256095, "uuid": "c74f7b3e-c933-4ba8-ab35-4c55e77525bf", "comment": "Malware payload (AgentTesla)", "value": "c97d507addff24a4c9e2ca37d3518eb6b96a90f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776256095, "uuid": "f9195ed8-1650-4d69-a895-e270061693f0", "comment": "Malware payload (AgentTesla)", "value": "2ec962da318304f43a0d03fc08b00cd25f52675459fa2266b99747f49c47f99542a5be52e9b32671832ff6006bb58802", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776256095, "uuid": "e38b3a5c-5c54-4a72-ace0-5fabfc6ea3f1", "value": "T11835BF1363DE8360C3B15177BA25B7036E7B7C250AB1F45B2F980A7DB960262521EE73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776256095, "uuid": "067a9a76-0a90-4d02-a7b7-b3e4f0dd0bbc", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776256095, "uuid": "3cb3f3fe-fc86-4913-ac3e-bb13032c6c85", "value": "24576:vtb20pkaCqT5TBWgNQ7a2O7FFEpIXEePcjisI6A:sVg5tQ7aj7fEpOT/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776256095, "uuid": "bb243aea-e7f1-40fe-9de4-33d225baf873", "value": 1119232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776256095, "uuid": "e80bf223-faaa-47b8-87db-4741a625e803", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776256095, "uuid": "f7ba1712-5e2f-42b4-8a03-d82c0c1f3a50", "value": "quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c84b97c-389d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776238313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238313, "uuid": "51e9550b-f74c-48cf-9f28-ebc29f015c40", "comment": "Malware payload", "value": "b6286a185d72d83e48e573058aea1bbd", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "ZIPLINE", "colour": "#23165C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238313, "uuid": "21e683e8-08be-4b23-8a6f-dcbcc921774e", "comment": "Malware payload", "value": "d39e177261ce9a354b4712f820ada3ee8cd84a277f173ecfbd1bf6b100ddb713", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "ZIPLINE", "colour": "#23165C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238313, "uuid": "2f37fa90-6604-4049-b03c-95f43c9a6f34", "comment": "Malware payload", "value": "5a29887de0fbc6847d41093d288240fc8cea197e", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "ZIPLINE", "colour": "#23165C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238313, "uuid": "0cd38c33-803b-4065-89b1-eefc1ac68244", "comment": "Malware payload", "value": "9337f208eff31c7280b84f8348343844c3264828619ec8088e7570e8b4fe21fb2d518e5515b68df98f0b56a3b957477b", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "ZIPLINE", "colour": "#23165C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238313, "uuid": "1507dc99-9c96-4c58-8590-954c8e75aabb", "value": "T10671104037E90204F7B36A75B87E1160483E796E9F7BCA8D0569E08D0AF1A14D977F36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238313, "uuid": "064a2427-1256-46f5-b921-3507a9d3501e", "value": "96:8a0EFazD1bLHOQYMKOi1qKuwf6acwfauwfueHTAb0WMrM0ZBvE1Ti:8a0EFGJHzKvhf6YfahfuYTMMrM0ZBvEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776238313, "uuid": "8d5134da-07f6-497d-a795-21b54a46acd4", "value": 3487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776238313, "uuid": "7fe0b7a9-bf6a-48ed-9181-3b52874f95d0", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238313, "uuid": "0c0bef8b-6afe-4c78-9846-566ffdd999e8", "value": "d39e177261ce9a354b4712f820ada3ee8cd84a277f173ecfbd1bf6b100ddb713", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6284e64-38c7-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1776256663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776256663, "uuid": "c91cdb70-c443-4209-a769-9b7bbf546e66", "comment": "Malware payload (Stealc)", "value": "2a72111dd3af89f084651e0e05de3b60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776256663, "uuid": "c33fc7e2-7e96-4ea8-a90c-6d4c6264a274", "comment": "Malware payload (Stealc)", "value": "d4d1f46ee0dcac7bb04ac3689a85c3e9afa4d21f0b96a1ba9ca1383476703ed3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776256663, "uuid": "e783e4ee-581e-473a-b5b8-830bd166fbd1", "comment": "Malware payload (Stealc)", "value": "f1e2dcbb4db650f85a75ad5788c065a16991a9c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776256663, "uuid": "b18346ac-86c3-4d86-acfb-34ff6eb52f57", "comment": "Malware payload (Stealc)", "value": "526aed3b3fc9d272b51fef1bc54298cdecb881aa776d27cd8ccb7f2818c12941c9ce413fe1cffc526ef56b896d19e016", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776256663, "uuid": "6d376d81-447e-4e15-be93-7eb8bf0b6c8a", "value": "T19665B0B8B5042DE6E96F463FCA97ADE9137236628B97D4CF406467C309633B1DF22805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776256663, "uuid": "2b80f89e-cd67-44c8-9f8a-b9bebeb18007", "value": "248f0bf5e1606ed05edfc57eab89251b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776256663, "uuid": "2cf2a94d-f07f-4a33-8cf8-4f528f216591", "value": "24576:GcVZYKJZ6toiXm1HpbVcDyLXXGNRFBbVJdGik32KTXz1IfZaAP48zenjFxVjv+e1:GcVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776256663, "uuid": "287611fb-9ce6-4cc5-b649-8b2c3c8019e2", "value": 1537536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776256663, "uuid": "9c170136-99ef-4127-8eba-1264fdbd71d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776256663, "uuid": "1fc0aa3e-8ea7-42a3-aff7-837335033dc3", "value": "crypted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9bf16f-3899-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776236565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236565, "uuid": "e66254b3-e5ad-4e8d-b067-8d7ab30ed9ab", "comment": "Malware payload", "value": "1918963c94b0e84069d59c440444228d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236565, "uuid": "e5237ca8-7024-4d8a-b851-27485f87417a", "comment": "Malware payload", "value": "d50e00eafd8dd077070bdb948933a788a715e96408245c66daaefff0ccc9f8bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236565, "uuid": "2cccb557-45dd-4fb9-b624-5f375cc29186", "comment": "Malware payload", "value": "46eaff4e8266b6ccf2aad75b7758fc6ed9c748e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776236565, "uuid": "405a481c-dbc6-42cf-a1b6-9d8d5de295f9", "comment": "Malware payload", "value": "cf2cafdaa67ac6906ff9a3ca3e4faba1e9773c25a0416463761db8c5e79b44805202ee655f8fa46cdc23162f0dfa6526", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236565, "uuid": "733e8e11-ffc4-415c-a7ed-9c5261b885a4", "value": "T1A2C42116EA61A02FF49389B1797899467C292D321680EC5BF7801F993074ABBF1F471F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236565, "uuid": "13b26cfa-4e88-405b-8957-1b28cd33f12c", "value": "73daffb403b0b155b5ee12dcecb0b7c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236565, "uuid": "dc540154-9672-4460-b586-056853a7de46", "value": "12288:XtJVTzlqxwZlVB1dZZXF6/LXBHieckvHOT1bJMNwiQ7Xn89j1j:XnVlqIB1dZZXF6/Lme5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776236565, "uuid": "d866992f-1b75-44a9-92bf-930edb0fe622", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776236565, "uuid": "98e77e45-d72f-47c7-a52b-63119ce8f716", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776236565, "uuid": "faaada7d-30bc-45fb-bfd8-cbc86ea10afc", "value": "NOTA DE LA FACTURA 19469.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ae475d-3910-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776287985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776287985, "uuid": "01612613-a3a1-46d6-b22a-5a18fb9fc389", "comment": "Malware payload (Mirai)", "value": "1ec56c8b529117baf0123fa40f31abcc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776287985, "uuid": "bef9ec43-c2bc-4f32-b1f3-2f4605792bfb", "comment": "Malware payload (Mirai)", "value": "d5c1325a239a977e3c58c7921df627664da7c03b5780fdafb2832bf5c5fa5694", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776287985, "uuid": "914f01f9-7b58-43c8-b91e-d3b2e7f0400d", "comment": "Malware payload (Mirai)", "value": "0dd71db8019aaf03bbb1da530dcce325d2234a48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776287985, "uuid": "4a72f6f3-6160-4e53-adf1-ec2b68288ab7", "comment": "Malware payload (Mirai)", "value": "6b82d2a3e69091fcb02e94911211635f92d5781e8619459c7cfb748b3f06c83032b107bd002ef71224086a9c93305456", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776287985, "uuid": "3c3837ed-6a0e-4511-b7ac-d31b4fbf218f", "value": "T147A3F749FD416B11D9DA35FAFE4F024973934B6CE3FE7201AA245B2123CAA6B0F36505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776287985, "uuid": "eac0bda9-5f01-499c-bb41-486b7a58e2c3", "value": "3072:CGbanKkhUcW/orAS3hYaz3hQvqtakCIBIg05H:D+1hfCorfRYaz3hQvfGIX5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776287985, "uuid": "894d0cc1-7866-4af3-b72b-feca814c5ae8", "value": 104036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776287985, "uuid": "f9d5aca9-839e-4432-ab38-b4c29ea8c676", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776287985, "uuid": "aadf3511-043b-4dbc-a801-3c9027dab9a0", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96113a06-391b-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1776292606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776292606, "uuid": "3e3cb685-250b-4b64-83ae-bf6ec46da743", "comment": "Malware payload (SantaStealer)", "value": "c5de32c7dc35349491dfd4757f25536c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776292606, "uuid": "5e0e6dfc-b6f1-4b1f-a791-8fcb5a09de87", "comment": "Malware payload (SantaStealer)", "value": "d5e2f0f451d01a94fcea7bd95d87495ce1867394812f7b707e7c2a2d086339a2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776292606, "uuid": "03c5d9d4-b59d-43eb-9dd8-ef47972fb16b", "comment": "Malware payload (SantaStealer)", "value": "96b3bb8484ebd47cffe1d9bc7f2751a5109e9063", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776292606, "uuid": "93ab266c-da29-4f5d-af64-b9b803452113", "comment": "Malware payload (SantaStealer)", "value": "7e1f2261eabc2ded9709f48ae091e967f23cf6ad549cabc6cd070bf720a00a612af0826679744d91935cedcd6a3d8d12", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776292606, "uuid": "e97a51a9-a469-4576-9cc3-b7634a1235ef", "value": "T1B7564816B19E1CA8C156B370925292F0E734774B8723793B0694C6E0FA70E9E46BD6FC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776292606, "uuid": "34f50da3-4863-45de-a39d-42afa32aabb5", "value": "ed79eb7e367399dbd52e60e4b57eeb03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776292606, "uuid": "2472146d-8c6c-497b-be51-bb4f5ba88e99", "value": "98304:RTGcKWgo7iZniAsXDxV29GhmaawcdJNxMUB:R69dzEmTXrN9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776292606, "uuid": "00f385e0-e775-4b5d-85d2-8864e6d3a536", "value": 5905408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776292606, "uuid": "51200218-bbf8-4d8b-bd5c-01960f5923df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776292606, "uuid": "954fbe4f-bc05-4769-bbf1-f591f6eccddd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a51948de-38fa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776278458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278458, "uuid": "75005d7a-3158-453e-a009-490290482251", "comment": "Malware payload (Mirai)", "value": "3eaba6380b78d529ca5009837abeb816", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278458, "uuid": "31e561d0-1ee2-459c-872d-fcd196fd9b85", "comment": "Malware payload (Mirai)", "value": "d7cc3955a69e3b15acf8198c4b02e12d1394bd7cb41ffa7da30137c64efa56dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278458, "uuid": "5090905c-d8d8-4545-a0d7-fa791760051a", "comment": "Malware payload (Mirai)", "value": "1df39a04c5f23cf2bc3346bcd7428c141d42d8fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278458, "uuid": "637f6233-2a36-4d37-b4d2-6bdcca27a1b6", "comment": "Malware payload (Mirai)", "value": "9971bc0d8d98ca5b246240de3fdb3ef8f6d795d2c8851406ae1a7915bdf459767ff4c547b115491b3870d480ee10127b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278458, "uuid": "0e4f8624-c7fc-44e8-99dd-2d87d53e64a5", "value": "T158438D3AD4296D54C0964574B4AC8F351F23E0C883536EFB2AA983B96453DADFA01FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278458, "uuid": "a245c29f-e3c3-4a07-8e01-917afcd017f0", "value": "768:QakzqAuHqHXSt7qQLrTfpXkb99Z7XdsCs07PK8OHIavoWlknSTC6blJIfmNhSwuI:QaC2yCF/9W7XdsF0K8OHTAW5TC6hNJu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776278458, "uuid": "ea1e6d87-8573-4b86-b0cf-ea7e0ed4b894", "value": 58676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776278458, "uuid": "482ca9a9-157e-4267-a108-f41e8e32158a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278458, "uuid": "1955d474-8c58-44b8-9fc3-c7e742541d19", "value": "FGx8SNCa4txePA.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec924da7-38fa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776278578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278578, "uuid": "78d6986b-6f75-48b3-af3d-0dc6d8c45747", "comment": "Malware payload (Mirai)", "value": "9d9587364f024aa404e896bee32a6c91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278578, "uuid": "d2d0a820-47b3-4433-b0ff-77be62772081", "comment": "Malware payload (Mirai)", "value": "d7d6de59461b7f7bbf5cd16f405200702570a1d802c318419da2c9a6eaaf5984", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278578, "uuid": "35a2278c-90d6-4ab3-bf74-2584bcb077b5", "comment": "Malware payload (Mirai)", "value": "9765b719b66c85a490715f9c1576fe33cac93c98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278578, "uuid": "7f385e50-6b56-406f-95a1-099d10b1a280", "comment": "Malware payload (Mirai)", "value": "575aa846e2ee2a9f6c0f6f2a5686df4cc8d6deb0030d2346c99a4df4ca655ab43061dcd39e324137bb75bdfd7f958252", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278578, "uuid": "59d323b2-06e6-4617-a387-baa81de1ce94", "value": "T1E393B509BF904FB7DCABCC370AA91B0129CC555722A97F36B534D828B55B20B6AD3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278578, "uuid": "0f5c5e6c-8f25-43ae-a10f-907b89964bd1", "value": "1536:Mp4/FL9VOjR6fmMhuCQ9Jqq5DLE+2CZYssIa13tT:Mp4/F5VOjRIuCGDLE5CYBtT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776278578, "uuid": "6dc81a3b-1d3d-4982-820e-5b2973af2dd4", "value": 88908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776278578, "uuid": "0de0b187-d79a-4633-bd98-f91082c4b9b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278578, "uuid": "e3ec3ca9-b3f0-4922-8de0-3349e599de19", "value": "FGx8SNCa4txePA.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "421560c5-3880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776225894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225894, "uuid": "47c1a987-efae-401f-8062-3c20fb0fade3", "comment": "Malware payload (Mirai)", "value": "34dbfeb0b6a8d0ba430644d4b5da63e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225894, "uuid": "cf86532d-940f-4eff-9eb9-c8c3ef2647f4", "comment": "Malware payload (Mirai)", "value": "d7f5d644f1ec37156bfcbc04491ec09eb895a190f8253b3fcf98edf16edff6c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225894, "uuid": "37cf51ec-2ab6-4373-bbd5-0273a35b856b", "comment": "Malware payload (Mirai)", "value": "e62d6d5478994931718de5807e1d85e098079d9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225894, "uuid": "bcdb4dac-75af-4ba1-8a24-f8e2e20e9f4a", "comment": "Malware payload (Mirai)", "value": "7dbdf4672af6c01581f4723d70a2c159fffddf602236b820c5169d3ee100eabfddca26e7c8fefbfa1888b8af83010856", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225894, "uuid": "e32bf880-d3c8-43d2-930a-fa79ebed6a66", "value": "T135E3881A6E328FAEF67C833147B74A24A75D23D623E1D684D2ADC1145F2028E545FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225894, "uuid": "ef143832-16a4-44e1-b141-836994ad8434", "value": "1536:fFff+Q5rzEwvJ2sjaj9ffNlOyOGLVew355cgNFQuYTNDg3+RxdoWflS:fFvEY2sjaj9fFlOyOGLL5c6SgORxdblS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776225894, "uuid": "b759a676-d7ad-47c4-bafc-c3b53bfc53ac", "value": 156720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776225894, "uuid": "3dabe303-af4a-45a9-8944-85f697f85862", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225894, "uuid": "0e1a0156-112c-40af-9632-7be7f6c50b91", "value": ".Sassy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c8ba65-38ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776259372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259372, "uuid": "dffe9028-4a45-4d6c-873c-9d896e8989a2", "comment": "Malware payload", "value": "b7f8b9c9042a843de9faf4e9620bbdfd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259372, "uuid": "692571c1-e069-4184-95b8-61a42555337f", "comment": "Malware payload", "value": "d80842f77500421e2d35c01253e7bfa85b8d154bc4a1eeccb46f83d923186f6a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259372, "uuid": "b14c2b59-9bef-4e4d-8575-412c02a1fc03", "comment": "Malware payload", "value": "566437fee8fac4a5c781570baf32462b00dbf9bf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259372, "uuid": "4451c8cc-6db8-4803-af75-4f8e61e9ac7c", "comment": "Malware payload", "value": "53d554eec88c3693c4d9110489aec25e5fb4a0443f84faff53dec344927d5237b058e0dc5dceb1b88d687c5f50f03051", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259372, "uuid": "d37ee351-8e53-4a1b-a3ea-258c0fdbf066", "value": "T10A7203ADC9C45BEAA52D07544DD02A7841FDBEF449D3DCD4A208AED93BDB61C728C0B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259372, "uuid": "843d0c56-bb33-4ecc-b611-33ce5d4da6d8", "value": "384:CgHGXFiGHVkvxaQcaSU8fsAZfOw+bdFmZa+0m/c3LjhyV5+aXuznUUYYTZCuxivD:nKB5Zh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259372, "uuid": "a4dad606-3f16-4d44-8bcd-68bee0817e60", "value": 17117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259372, "uuid": "cfbff53d-d7b0-4795-93b5-ea2ed23eb622", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259372, "uuid": "41530ba5-8c31-40ed-9c71-bf311b287bac", "value": "Orden-Orkla_04015026-001_PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed4afd01-38f3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776275573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776275573, "uuid": "93cb41cf-fb6b-482c-8b36-f15db3277436", "comment": "Malware payload", "value": "b6f028a2a4387ee1b01491c036092c09", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776275573, "uuid": "e3868ca0-77e8-43b0-bed9-483594a05d8d", "comment": "Malware payload", "value": "d8df9621a3be6a29c9d3d6e6d30c09c0b375d05597d69d56b6503885b3abe050", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776275573, "uuid": "5121b46f-3052-4dcc-8cc0-1d43f017e87c", "comment": "Malware payload", "value": "5c20c40ed2d69335977e737c6a13db330e25b6d1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776275573, "uuid": "21616d60-a276-4fd3-9b3d-4c6212ffc178", "comment": "Malware payload", "value": "da54bbb6987472e8a7ee6360c8ab83091e366458561db9f9b9c6d7c829bea47a6fefdae538743f4a05903ebb97bbcf61", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776275573, "uuid": "02c816b8-b028-4dc9-aa31-48ead535ff06", "value": "T1D4137D6526953C25AE99883B5D7F2F0CB9A983E1304491DDBFCA3CF18C15A9CE318B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776275573, "uuid": "d5af105a-7aea-4026-86cf-d5757c44a4f8", "value": "768:b0s9NyXsZztCc9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bhHusZYco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776275573, "uuid": "a04ced11-df21-4db7-b79e-a9a570925677", "value": 45510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776275573, "uuid": "fe4a5661-78e2-4da1-843b-5e08c4438a02", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776275573, "uuid": "f513c4fc-d651-4a94-b5a1-57ecb89e517d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb7e529-38b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776249564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776249564, "uuid": "94c3db35-1596-4fd1-827f-7c02ebce1f75", "comment": "Malware payload (Mirai)", "value": "0eadc76fff44df277dcbb302d6271fe5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776249564, "uuid": "c7a58633-576f-4705-acd8-79b82c873f12", "comment": "Malware payload (Mirai)", "value": "d9e3cfe175d2d8f0debb67a203d5f7d231983e75cf95f5a4862bf105b0d45040", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776249564, "uuid": "e4b1c0a5-e263-4d1a-b50a-4325721e4e96", "comment": "Malware payload (Mirai)", "value": "51407aeaf16eeb318923b5d2349f192d456a4eab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776249564, "uuid": "6e931b8e-cfa1-4a96-b831-c1981083328a", "comment": "Malware payload (Mirai)", "value": "8e78d8ab8b859f12c0f5256f7527aa3d1f966c054d2977b1aa4cd9c9c0b31a2a7dc9ce5ab2e379d2f5cd9afc5ef23193", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776249564, "uuid": "2eefbb15-6da1-4841-a183-7522a6e14762", "value": "T1F7F2F17C0FC6D479DAB09E3194A9C8A1939376BD3AF871692618468CE64310F4FFC087", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776249564, "uuid": "2c658732-de8b-44c8-bdfc-e799268872e9", "value": "768:HzmgwrN8VG7jy5J5WwNrP5CtpjjIyrFG4WcL1s3Uoz+:H7U8G/QJ5frhCzXlrFG4WcL4z+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776249564, "uuid": "d08215f4-df25-4bb6-b7f7-72a795b1450d", "value": 36292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776249564, "uuid": "b680ead6-d031-4838-a434-d69d7df2ab0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776249564, "uuid": "81dde7b4-e148-4eca-a6d7-80186c36d02e", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d919aa-38a6-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1776242405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242405, "uuid": "2aabc786-098c-4dce-af58-fcc9a0436a99", "comment": "Malware payload (SalatStealer)", "value": "6209ed6ec107470063ffe875118d58ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242405, "uuid": "8e3e1d45-a722-491d-8f91-78e1168a457e", "comment": "Malware payload (SalatStealer)", "value": "daa3cb621436511323bc6c7e8a0d5d3b06244874d0dc6876285560dd17ba94f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242405, "uuid": "bbcbf671-2db2-451c-b4b3-ccc7e1c29ed8", "comment": "Malware payload (SalatStealer)", "value": "8b99887d6f187e1aa50f5d9de6c4971034a90531", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242405, "uuid": "255b2aa2-b60c-4371-9626-9a7573395d0b", "comment": "Malware payload (SalatStealer)", "value": "22bc51bb1a86296ce2a2b5e6e3f1a32b2bcb428502dff4d02bcf1ada3bd67e2359ce9e95e3626601ea06d475b5f33d7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242405, "uuid": "6406181c-e081-45b8-a1df-2c8bb3feac3a", "value": "T1F9F53373CEA5B182F5D171FDFF6BB102BC63E1C589228D81C5B4160A86FC14DE96288E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242405, "uuid": "236bdb74-5b72-4fa2-b10e-775d51104221", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242405, "uuid": "9d9adb3f-9d6c-4692-9a8e-95c2077ab655", "value": "49152:QM+J7/4PVYoySkRn60moZfjDjl8bJxZsftEbFbBObGS2kLMaoupzKhXnD/41Np:L+JEN3V0/fTilxOfCZgSBkLPonhXn81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776242405, "uuid": "d2147314-c8ea-42a4-ac5e-c9504979237f", "value": 3545600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776242405, "uuid": "a6c9680b-b342-4605-8f9c-396b67b18265", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242405, "uuid": "8343769e-7005-402a-9b6a-4d3fc174df10", "value": "SecuriteInfo.com.Trojan.PWS.Salat.390.9160.32132", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73afd383-38b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776249599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776249599, "uuid": "563064de-1cbf-4cc0-9c1b-5a53a9f197c9", "comment": "Malware payload (Mirai)", "value": "6e5c8ce8150526d96560190ae6de4151", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776249599, "uuid": "f5e89c22-2bd3-4347-9cfe-14f41c248671", "comment": "Malware payload (Mirai)", "value": "dc28a018bfbabd210abcfba61a81080700f64b4393e58b47e81eeece3e641f4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776249599, "uuid": "9d9e5538-3f2f-4890-8e0d-414c64379b4a", "comment": "Malware payload (Mirai)", "value": "6987a9dc0a78777bfa9bc2c2928c6d8a15a57be7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776249599, "uuid": "509ba308-f8be-4a5c-900a-c36867f5ac10", "comment": "Malware payload (Mirai)", "value": "b685dd341b4dd2ee21625c41f58abb5f6e26f511b5207559304aba8d4088f27de609a1a806fa9bcf7cafa4d96f0beb5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776249599, "uuid": "a1bcfc4f-d628-4edc-b467-17cc2e9c4692", "value": "T18B930892BC92962BC1E023BAB67E518C336667F4C2DF721BC8254F11778951F0E67B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776249599, "uuid": "7d3128fd-7d97-4b3a-afdd-6a02edd42a4d", "value": "1536:ekcv1/6fBf2co1EL+tWtdNFchfKAWXc057Jd6gaKLSfUoQ8qRKC66922Xyd2kK:Pcv1yfB41ILnntUUoMVyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776249599, "uuid": "dbd7899f-d79f-4104-9658-d03d1de270d8", "value": 96572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776249599, "uuid": "1f6b93de-db88-493a-afcf-f15e2a83db5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776249599, "uuid": "14047068-50d2-4fc6-a1cc-084394e189d7", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec825a81-38ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776259680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259680, "uuid": "76d09387-d86e-4151-b2ab-b27b4ba3066f", "comment": "Malware payload", "value": "94e1294b7a6a0cad593cfd46e7f8edb0", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259680, "uuid": "62e348a2-f85a-486d-9ee4-ac01ce980fe0", "comment": "Malware payload", "value": "dda1e993f2856e782bf30ea6c414d72f988247711a9ecd85c7516a5b3a5413f7", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259680, "uuid": "dcad6d4d-3f79-446d-84a3-8b4223dd5f08", "comment": "Malware payload", "value": "2d7ae95e250af22e7e393a4dac1ac22206607a82", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259680, "uuid": "0a59db7c-ce73-4f13-ac78-45dc7e362107", "comment": "Malware payload", "value": "061b4cdcba1682f555d454f49688a256e0de8af1b60709b5b69ec7a5b349840be656f72dfb2b181d7104f2a1bbf71f6f", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259680, "uuid": "2fef7bb0-aef7-486e-9e8d-a9f169ad2f8e", "value": "T11601D3F1893B8B9C5D77557D51DBF258C59314175249CF813640960A7F31007C30A3DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259680, "uuid": "41ab7b49-b18e-4ef8-a206-c62ac643cb5f", "value": "12:T4O6Nu3pH5zihOTvWWPvrxQ6jAEqrTOuGqbneIYAHpcPn1j2krYYMCgm6XPGb:cOfH5mkTvWWXlc3fBDQ+YMC8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259680, "uuid": "3bfcbb42-a86a-4848-92f4-d0cb0dfa97fe", "value": 660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259680, "uuid": "dbb54675-4671-4550-a579-00d4ee95f033", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259680, "uuid": "d7a8195b-9340-4200-baf9-2f1498c0b18d", "value": "1v.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54683334-3894-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776234514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234514, "uuid": "f58873ab-56a3-48e9-a778-0dbb95ce9363", "comment": "Malware payload", "value": "56053f64c99749fd898f7674b2d2e330", "object_relation": "md5", "Tag": [ { "name": "Dienstangebot-Klement", "colour": "#522A09", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234514, "uuid": "00cf349b-e754-4436-bc4f-ff3c41930e6a", "comment": "Malware payload", "value": "de0a2de2fc2b87468c7d7e8193adbc59549af459c982815c81a135aee08c4838", "object_relation": "sha256", "Tag": [ { "name": "Dienstangebot-Klement", "colour": "#522A09", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234514, "uuid": "5e4e17bd-93f3-4d7b-ad97-f07b728ba975", "comment": "Malware payload", "value": "aef74f5f432fb3d52c493da4f3ebeca2cb7fbc3b", "object_relation": "sha1", "Tag": [ { "name": "Dienstangebot-Klement", "colour": "#522A09", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234514, "uuid": "e99d7211-dd0d-4361-9be0-6ddc1a3ada8d", "comment": "Malware payload", "value": "899acc7457b3e23e5930280ff8684711b93863dc2eb4fe1254ed97cbaf0e8e70ce8eacae99dd76e07e601a870645889d", "object_relation": "sha3-384", "Tag": [ { "name": "Dienstangebot-Klement", "colour": "#522A09", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776234514, "uuid": "6d4a48a0-e1b6-45b6-867a-812bef6cfb5c", "value": "T1ACF2E195ACC80499D00883B2B8F26EA04D0576CBC6D13E0663C8B6E87E455D4D7FAFED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776234514, "uuid": "d2176d8c-b987-4b6f-bb5c-d78ba97edd9d", "value": "768:CZwOJ1GXMuhbTb+6lBVI9u8xGyfy6cuP1mALgkV52oL+VT7Oc:CZj1EMmbTGPGqp9mA8k6VT7Oc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776234514, "uuid": "dd760612-87d0-451f-8eff-885855b5ec66", "value": 37269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776234514, "uuid": "37c0143e-af8d-4cd7-b0d2-7834f8371c83", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776234514, "uuid": "0039ae70-72e2-45f1-acff-dc9d7c2049ad", "value": "Dienstangebot_Klement_A_18-03-26.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44756345-389f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776239212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239212, "uuid": "86bd8698-74c4-4c21-87cd-3a1d78a7b9bf", "comment": "Malware payload", "value": "64628e9f8461636f5151645f550d1b62", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239212, "uuid": "d07b7b2d-1cdb-4838-907e-ced1306e3b17", "comment": "Malware payload", "value": "de2139eb1d9d56193ee2d866613c9d2b967d9e6fc093c5dfec526817105b1cdb", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239212, "uuid": "9b14e6a2-d1b5-4116-b455-a8d225608e2c", "comment": "Malware payload", "value": "7975537697386191a66d7b176504ed933418e5e1", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239212, "uuid": "e3621c9a-726e-4ca2-b849-184c28664008", "comment": "Malware payload", "value": "c8380ef2f32f4e2bea781cb25aa63045c1b90110bf7a3de721f2ac670d90aee43060bee124c5d0207a10d290dbc97f01", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239212, "uuid": "871a0542-d06b-42b3-929a-df0988d1e8ba", "value": "T19A369EE0FA71ECC0BD48B5B819BB4E32D0671ABB36ACCB9453E254B5C772C891993435", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239212, "uuid": "9773995c-4b2c-471a-bf96-ff4f592f17be", "value": "768:8nRb9O21q6YiVLovrq6YiVLovrq6YiVLovMJPP0jQjuiOgAshfmk:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239212, "uuid": "ac7e13c2-07a3-477f-a2ef-dc79d7d3c438", "value": 4964024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239212, "uuid": "e831bd93-8f7b-4548-8e52-28ac7abef36c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239212, "uuid": "56bb1e55-3179-42c3-9dd8-c10c93e69d6c", "value": "Specifications.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f711f5c9-38eb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776272153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776272153, "uuid": "27861015-2d74-4ed6-8d85-b7964bb78514", "comment": "Malware payload (Mirai)", "value": "1eb7ea8e4d6d01ad6b5ec392d3b9b1c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776272153, "uuid": "2fa61484-6a5b-46cd-a576-781fd23cf75c", "comment": "Malware payload (Mirai)", "value": "deda565034825a571345fe2dbc46e5ecf4d1efb36a569c7b6f08b5c2be2b46f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776272153, "uuid": "d86c160b-39d5-4bf2-9152-81c1a869442c", "comment": "Malware payload (Mirai)", "value": "91d373c7078375cef0f7ae842a5fb5f9530e9c31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776272153, "uuid": "cd5d9c6e-8d0a-4a3b-adac-279334847d7e", "comment": "Malware payload (Mirai)", "value": "c619575fb2e4e24db4723a773616dec71a114a4e797d1073da9d24384805c7790762dad87f33dd1e75792923e53327d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776272153, "uuid": "b8ca86cd-98be-408c-a69b-a42f199aa892", "value": "T1D1A3F749FD416B00D9D636FAFA4F024973934B6CE3FE7201AA245B3127CAA5B0F36516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776272153, "uuid": "1a335b1b-7048-413b-8b1b-ea1a9abbbfe0", "value": "1536:WInhK3HUaED7mt55b5X1l71S/abM7h6bVji8lsTtIwiceQm+RXGZYqYny:Us7aTVll71IabM7h6bqSOeQdRXG+qM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776272153, "uuid": "c03dc373-562d-465d-836b-cd8badaac499", "value": 98580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776272153, "uuid": "d7453e12-9308-4dce-955d-99199798e208", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776272153, "uuid": "c90cbab9-5246-422e-b9a2-341ff289e0ba", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d100b6c4-3894-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776234723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234723, "uuid": "df7289e7-d732-4139-8676-84dfb10e4de5", "comment": "Malware payload", "value": "4c88879532d7e19a2365c0465159d36a", "object_relation": "md5", "Tag": [ { "name": "45-92-1-242-8000", "colour": "#D264AF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234723, "uuid": "eada48a8-406a-41f3-bf56-65459488fa4e", "comment": "Malware payload", "value": "df3f5405a77d350299f898c56841e82a5237aa09d15925e7355469b01f2bae19", "object_relation": "sha256", "Tag": [ { "name": "45-92-1-242-8000", "colour": "#D264AF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234723, "uuid": "696c97fa-ff73-41d3-b3c0-e6d2b158e2a6", "comment": "Malware payload", "value": "1e1f45c6e0a2f52efa8e95a58703ebe49bc35e54", "object_relation": "sha1", "Tag": [ { "name": "45-92-1-242-8000", "colour": "#D264AF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234723, "uuid": "f53eb65a-3b2f-4590-bd86-b9a227e8e68a", "comment": "Malware payload", "value": "f18fcb36639466ea3fbabe0df6b97ddb7b5863a0e6998e4a6981f1cc2bdbaf28313006337b4e453f7aaef795ade306f1", "object_relation": "sha3-384", "Tag": [ { "name": "45-92-1-242-8000", "colour": "#D264AF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776234723, "uuid": "4adb75e4-a339-468e-a981-3302c06157a9", "value": "T16B41EF163995A58E072E1F73321DB885D043BD2EBB76485BE210FC819864A34F2E737A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776234723, "uuid": "e3c16d04-605c-4dea-994e-a8f333bee8d2", "value": "48:x2Nm+zMOlq/YYJrwFo29KLJStT4Gjj5F9:wg+gOlsYo29ZtT4G5F9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776234723, "uuid": "7c6db162-9321-4f53-b4ab-c75ad3fd6733", "value": 2421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776234723, "uuid": "bc60fae9-8d09-447c-98e6-a53bffeb0d61", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776234723, "uuid": "0006a2aa-a591-4a45-af2a-3cba54fcab00", "value": "adobe.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab85e4fa-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776239814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239814, "uuid": "f8415503-c3c8-425c-b240-eb0c8c7d4cac", "comment": "Malware payload (RemcosRAT)", "value": "ee518ca859a00f1f061cbc9a75326f8e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239814, "uuid": "1eb002c1-0018-453d-a540-7452b47ac8d0", "comment": "Malware payload (RemcosRAT)", "value": "df4c77e19109b83fff25175d0cffcaee8ce74306df86df5cdbe58e4cd8b95b3c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239814, "uuid": "7982f8d4-c1bb-4d52-9bbf-010910d0784d", "comment": "Malware payload (RemcosRAT)", "value": "bada5b55c9c2529fea7fa707464599b990b1944d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239814, "uuid": "a31d8f44-b2bb-4168-b9ce-d2c3e447dd17", "comment": "Malware payload (RemcosRAT)", "value": "519aba50410f1322f52a5d9288be8d3f8e082aecfb24ff7c1f9ac5b53bff9b7cccaaa39c63deb828d5c692552e2058ad", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239814, "uuid": "b4963882-9ce2-4683-a723-8acea2f984aa", "value": "T1AB7258AFCC040A6E2D6C612786FB447BA67B71E2F0A36A41704C5477FA95D83F448B6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239814, "uuid": "34b212d7-fb91-4896-aac3-a9e0d73a4615", "value": "192:p1ihqcev3No43G5AoGZ8rWoiDIej0saQHtlWsAB8vfBQ3fi5Egp2g:pKfi5Egp2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239814, "uuid": "010bfdfd-c349-42a7-8f8c-64f9c0086240", "value": 16580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239814, "uuid": "cd5b3cb2-7d12-49b8-8c06-f5b988869295", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239814, "uuid": "b321525d-ddc0-4764-a43d-ac3cb8e3c2d0", "value": "LABOSERV_NB-0010214026_PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e229dccd-38e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776268253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776268253, "uuid": "2e38c0b2-8aec-4212-8f95-2fc279cbcf2e", "comment": "Malware payload", "value": "b4a6ee701797625f08081c9dec1dcc14", "object_relation": "md5", "Tag": [ { "name": "Trojan.Multi.Config", "colour": "#DAC4D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776268253, "uuid": "9ea7b154-70d0-4775-86aa-38ff5c39b1a5", "comment": "Malware payload", "value": "df813fcca500ea8f4bf1d4374abbd6b6aa61899e1bffcee17e4e6e2e55c3a795", "object_relation": "sha256", "Tag": [ { "name": "Trojan.Multi.Config", "colour": "#DAC4D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776268253, "uuid": "7e8332df-bdca-4068-8f4c-2c5483b5d68d", "comment": "Malware payload", "value": "8f00eec0d9f04e4bb26958f9216722a651fb95f6", "object_relation": "sha1", "Tag": [ { "name": "Trojan.Multi.Config", "colour": "#DAC4D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776268253, "uuid": "b1c3ca34-3256-4367-b173-98c06411e6b7", "comment": "Malware payload", "value": "13887e586c41fb97cdc22d9dcca4420c41f78447b7cd4ef4764de0f87dc3befe949b1bf9c06f28d2c262e407ef974075", "object_relation": "sha3-384", "Tag": [ { "name": "Trojan.Multi.Config", "colour": "#DAC4D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776268253, "uuid": "be64273d-eb73-4867-88c7-a8f2eef8425d", "value": "T155873384820B0FCCFB5BB27D20ED17C6E8669A7B2194B1CA97E025947DB3573DE12607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776268253, "uuid": "5ad79b20-3ca4-4363-8dec-ecd0ff4f5989", "value": "786432:zx4yayEp4bEd14PgBlgRKCt0mOVhsrsQ1fRlY7Y:VROZK4TC3sgW7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776268253, "uuid": "00927c76-f792-4b7d-8185-4bf11ffdeef1", "value": 38506618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776268253, "uuid": "3e311636-a9cf-41aa-b503-d601c4976d46", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776268253, "uuid": "dea2ef61-1e2f-4b69-9af0-1631ea3eadf4", "value": "lnstaler.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ced8748-38f2-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776274821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274821, "uuid": "8a2f75fd-1f1b-4033-85c8-12ad3ff35b32", "comment": "Malware payload (ConnectWise)", "value": "5294bdca7b38aed31f4848f0267f1ff6", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274821, "uuid": "775c617d-f56d-43ed-bf28-6a3d6d84fb81", "comment": "Malware payload (ConnectWise)", "value": "dfcba98a3df6e87fd86ae697254d0ad96ac5c79907cd2aa5c9f6690a2f20fd88", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274821, "uuid": "e3251d4e-0f8b-4c51-a70a-deb849db54d3", "comment": "Malware payload (ConnectWise)", "value": "ebbfec9b1420867660d696906039d80884d2c964", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274821, "uuid": "af71a0af-c749-4107-b639-540450940731", "comment": "Malware payload (ConnectWise)", "value": "1db692cffd21c5dda3201edd2dde73c5d7172686be9ca4a8f739322a1bc08f622a017ce49093b022241ca0289734733a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274821, "uuid": "bf2498a0-e30e-470f-9a8c-f40f53d740a8", "value": "T1D8A623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274821, "uuid": "617dc2cf-abb7-437b-bb26-0d20d8f13d73", "value": "196608:qnCtVYqI5MvbWEpKkq+IJqKknCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkqOnCtO:WCXvI5MvHxiJ+CXvI5MvHx6CXvI5MvHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776274821, "uuid": "e7e37ac8-544d-4013-a1a8-244541091454", "value": 10190848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776274821, "uuid": "979681d9-9970-4f95-9c26-d8d8de2ef9c1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274821, "uuid": "67e278a2-1c18-4ce8-804b-799efb73b877", "value": "ScreenConnect.ClientSetup3.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8975edd6-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776239757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239757, "uuid": "171e01e6-0cef-4e86-8336-7b244b9984fb", "comment": "Malware payload (Formbook)", "value": "031b4e2e26a3ac8a616084d279cb23a1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239757, "uuid": "4f064291-d772-433c-9015-b6c8c4241f1c", "comment": "Malware payload (Formbook)", "value": "e01ecfb4715d951f1f9a63a88cbecfee8690df2ef98491b76a795e602796c230", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239757, "uuid": "33dd7ca6-b9ee-45c1-a5c8-98e570fbb362", "comment": "Malware payload (Formbook)", "value": "a90feb3182a26f726cb3a90fc41e9aa4d0f4f916", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239757, "uuid": "280594ac-2aef-4107-a14d-2c88dd3fe5e5", "comment": "Malware payload (Formbook)", "value": "74ac3b0e8a61068303a7a6909c6249d7a192b4504dec7b47710d94e3ea53dca2b52452ab869752061c56b8c6fc9813b9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239757, "uuid": "fed49e44-e770-4e58-b3d9-cd118a4ef0f4", "value": "T14695F2118AC43FB8CFEC161980FE250EA3B04A8E541A758AEF73BD5AEFB7644511719C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239757, "uuid": "5f54ebc2-83fe-4e86-879c-9fffb51c85ab", "value": "24576:v0oKyngVx6qyxdqCRSeofWWiTAfLvA+nQsJX54m1fzHjBXf+pH7W9pnCpO7+4YG4:W6VceofWRW3eKP9iopCk+pGk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239757, "uuid": "6365a320-b82d-408c-869f-a6485d7436b1", "value": 2050838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239757, "uuid": "ec2142f5-6ef2-478b-ae7f-3c0d1f599ff0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239757, "uuid": "c8304108-ce6f-48c1-8615-4f026fda73b4", "value": "payment 14.04.2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e3a870-38c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776253794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253794, "uuid": "05a2fc14-a0d2-4761-86dc-af6907c4f4d0", "comment": "Malware payload", "value": "02c877f678f8ee5fb11a9fd309139610", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253794, "uuid": "7d8e2eb6-49d0-4c7a-a542-2b42f24eb69d", "comment": "Malware payload", "value": "e03f48fd5681562673161861ece33fad60a5eb1e6e8749e09a781e99c6b3de60", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253794, "uuid": "826f27d1-a86d-464e-92a2-50bd14130495", "comment": "Malware payload", "value": "6e65e0a11896ae83d244b923b52c3c321fe93879", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776253794, "uuid": "78448072-de6c-4e5e-abc5-aa9ba3eefb47", "comment": "Malware payload", "value": "4c592cdacef3c7c24b659c8a24628b7ec149efe688aaffb94f902bb9ac18064ee1de0692b5bfb8418c6ef92db7b14e45", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253794, "uuid": "d2fae9a1-ed72-4882-bd29-8cfa9a05b704", "value": "T104A52A0BADBD88ECC0E9E6788533B517BD657800073433E72AE126651F66BF0A5B9F11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253794, "uuid": "7a8b2f36-83e8-4de6-8db3-98c0a5f920fa", "value": "49152:+OH5EJpID/2zsZ1J/9eDaph55HeO+RpjU:+Ofb2+1Fuo+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776253794, "uuid": "dcf173b5-e919-49de-b388-98d03d85624e", "value": 2064384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776253794, "uuid": "06b8b37f-1e57-4284-9639-8d16d238601c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776253794, "uuid": "7306d8f0-ff68-42c7-9a78-0cacd6b0a281", "value": "file.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1f814d-3914-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776289615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776289615, "uuid": "c54383b5-0fb9-4035-9356-b14ec55da62b", "comment": "Malware payload", "value": "cae4007e50a1d4a0abcc4b915c925091", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776289615, "uuid": "6c1437aa-8c31-4477-8976-8709e120b827", "comment": "Malware payload", "value": "e046e42cacd98843ba100cc9c6b52cf83bce5894d7e98b03373937b7db263333", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776289615, "uuid": "9f4ac1c5-5212-4079-baa1-b5e09faf743a", "comment": "Malware payload", "value": "67d64ec680a68923acc3ec8d544516e9ea796bdd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776289615, "uuid": "c5aa95df-f7cb-4874-9331-990b85d84393", "comment": "Malware payload", "value": "c4c8e3e38c4cd9780202d9244662c1e4b65cb44c17d12a96421c401d7493aeed9ddd261191bd70a8412c73000dd8ba78", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776289615, "uuid": "3b83eacf-2f99-4491-a49d-a15cca039cbb", "value": "T10576CE07EC9419EDC4EDA23184B65606FBB3BC781B3263CB6A50BE742E76AC05D79704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776289615, "uuid": "77563565-78e8-47b7-9285-dab34cd4276d", "value": "4e2bd2c481372f7ab13b83b63b424e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776289615, "uuid": "d8375d97-2c77-41c1-967a-762692f14ea9", "value": "49152:6TbamUvP1PagLaLBOO8oIe8TwJYhqyc00pqlFIexhtB0rUm5UcSTH+LLwPUReGqR:6Tuf1yOaMvA0e9Sp0HALn2hM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776289615, "uuid": "da797c08-5b53-4df2-bf13-c65872fdcfe9", "value": 7585792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776289615, "uuid": "83120b51-31df-43e7-ab1c-34ef3616c00c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776289615, "uuid": "55c3a275-502e-4668-8abe-b53ed5e56653", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4faf9fce-38d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776261994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776261994, "uuid": "846ac4a2-118f-4f61-9ed7-8f7bd57abc99", "comment": "Malware payload", "value": "bc86cdccf85c343aafadff8931ac6011", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776261994, "uuid": "528f023c-aa78-4059-b401-46059e0a2579", "comment": "Malware payload", "value": "e1012dd49f4af7e0b707787fc681782a9f52c01f7004eaf59f5854ff44c06007", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776261994, "uuid": "146961dc-acc1-4d1e-90f2-84316c90a933", "comment": "Malware payload", "value": "5171ce2b0ad33a80ca324ee36184ee3d8d3499d0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776261994, "uuid": "c4521ce2-3445-466c-bd60-fe582967236a", "comment": "Malware payload", "value": "b4d447ad4638ab88fa0bf2bb2ffef2ada37286d1160dc451cbb56afeca0cfc751e68591667c055a6632d965c4aa33114", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776261994, "uuid": "eddba7dd-74bb-400a-a6d0-401b2a9092d8", "value": "T1AAF00269CB210AC2F777D3B9A7B6098E209322D44554DB00DC84DF110F323C8B9014F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776261994, "uuid": "3e43657f-78e2-4641-be71-1c31c212cc5f", "value": "12:5j2q3RPAIjXDPiGl56enAZ0PxwwKZd1lkc7EoRh26qhrU2VDLqPRPAIjPa8:9z3RIIjXR6eACPStZxkKEccU2V6PRIIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776261994, "uuid": "c2d37b4b-4bd8-4364-ab2b-94fb136b7db8", "value": 625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776261994, "uuid": "5ca79d66-10bc-45a7-901e-61d2b66bf09e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776261994, "uuid": "f691443f-f8a9-4dd4-91ae-ad0c647fd4cc", "value": "faktyra-850344.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b29ad43-38ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776259436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259436, "uuid": "c4ebe55b-0789-4788-8ef3-b8e188e09239", "comment": "Malware payload (Formbook)", "value": "4b863c7be268f87e12981204cb0ffc6e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259436, "uuid": "62287d3f-3a9f-43aa-b013-24ca60df5e81", "comment": "Malware payload (Formbook)", "value": "e1a3a8937909e56d86692fda412312603951a3ea20abf730d538d2e07fda06a3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259436, "uuid": "112ea76b-a4cf-4f44-88f3-c0823f81fd8a", "comment": "Malware payload (Formbook)", "value": "57bd49c5cacffb5fe9cb62972ed3ba4a97f26348", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259436, "uuid": "fde21a7b-6eb9-4aba-99f3-9b1170acb152", "comment": "Malware payload (Formbook)", "value": "da39e1a113924ecbbe0b84ba76485fde5057b185d4db9e580bcb2bcada0d247d35eb44224ded69a6c148e6e674ac3d69", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259436, "uuid": "c5c1c367-e8e6-42c6-b3af-8b36e2b12161", "value": "T1DC1387DD7FD6B2A5835170F36D2BE456F12E8C4073088412E5E6A4ECB92C714F16AABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259436, "uuid": "7c726abc-1d86-4141-98ea-e8ebb026a1ed", "value": "768:s6dqLrznabzKEOl+oNvyx1vpvSn2drIxo+hJ5ddFhSq5ObKKzZHa2wz6p/mPx:hdqL/nOXQ+kv/wQDfFhbezZH7w2p/mx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259436, "uuid": "1ae342dc-4a43-4090-9923-858e6bb19fa1", "value": 45316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259436, "uuid": "72070f10-c06f-46fc-99a9-359f0cba6e41", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259436, "uuid": "848428ed-eb87-4278-8989-e13dffed7ae5", "value": "BB MATE FATT.1-206.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7117d1d-38d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776262168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776262168, "uuid": "e53bce6a-45b1-4a6e-9baf-16a56e3d48ae", "comment": "Malware payload", "value": "4f349b1e6449f3ce9babd63c55b3c89d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776262168, "uuid": "6ca7dddb-d431-4ed4-93e8-5d88e6af6129", "comment": "Malware payload", "value": "e1abed5ed12dc8dcab70d3feec4206e5e82c77dc14dbd893368d1521383d47f2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776262168, "uuid": "624b45bf-6445-4782-a942-6dd8f9551687", "comment": "Malware payload", "value": "8fcc0f498e899e79607066223213eae22a39cccf", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776262168, "uuid": "90e12a14-0676-4941-923b-6f59e4ed4c6f", "comment": "Malware payload", "value": "7865ab6d33ab4a6a80145c8aace0b610e7eaa6d1e28fedd49a9448855c85180a78269cfe79c9c482eb66660a1a048dbb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776262168, "uuid": "0c8a2f24-a88e-49e4-80ab-e1f23a909863", "value": "T13F31E6616B6B89EAC80E3C37563B6138C0A0C6443850FB539739986BB28C5093F0EEE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776262168, "uuid": "303bec8b-1b6a-4b1c-9925-21cfa7b2b044", "value": "48:9KSoHatyphkP24jsenC86CE0V8LEwGJED2eY5bJtsEXs:8Snyd4IeCRGGXGJE6eY9JtsEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776262168, "uuid": "6966fc4d-1be2-4d9d-97fb-9c92a16d4c0b", "value": 1757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776262168, "uuid": "82e4be9d-2f61-473f-abc8-b6d24b545d22", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776262168, "uuid": "ea12ed8e-1810-4c09-880b-d3fb732769ad", "value": "FRA-ZCIN56.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa308a6-3908-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776284561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776284561, "uuid": "47e8d30f-fb94-4e29-9a61-49300b20b4b8", "comment": "Malware payload (Mirai)", "value": "910dd8984f06856483314dc1cd832a7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776284561, "uuid": "fa55c14c-8d6b-46ea-838f-cb5fd2e97e72", "comment": "Malware payload (Mirai)", "value": "e26180196a1b0993d10b6f36446eaee8f2e7c11153d42bdacca76128daf438ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776284561, "uuid": "c8d7f0e9-8af0-41b5-8bf3-d43cebd5ab3e", "comment": "Malware payload (Mirai)", "value": "343657d0c8e5fe078ab4fea9cdfc52329578d77d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776284561, "uuid": "f61c0ef9-38ed-411d-8a69-a8de5ead66fc", "comment": "Malware payload (Mirai)", "value": "2a0baba5c5775a1b029f8288a7fbc369bce545c7fc777909ceb409f664d3171126fcdbd7dc4765844a91d65bb27b432b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776284561, "uuid": "a7962055-3b79-4e4e-ae6e-b0268dc0879f", "value": "T1FCC31A45FC559B17CAC226BBFF4E438D7B2A0768D2EE720399156F30378B55A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776284561, "uuid": "bd169bf4-de63-4d9d-8a10-c27866fe590c", "value": "1536:+vz/v9F6Ayc/fwfTPJTyMeI3uOJ0x4dBIFNlejwyw1cj4lZorr+VbyPZpoR6cvF:+7/lF6qnwLJGMN24GGBPpqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776284561, "uuid": "3e88c042-2054-4e9e-aa27-9d8cb3b211d4", "value": 125472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776284561, "uuid": "a50d23ca-e59c-4c6c-83da-9555381875dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776284561, "uuid": "c1e2556b-d860-4a4f-a38d-0f2434b915e2", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62cbf6cb-38ee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776273193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776273193, "uuid": "4308bf65-8edf-4df0-ae2c-3d740a961902", "comment": "Malware payload (Mirai)", "value": "17b3c66230f5f799556fdb93733f9321", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776273193, "uuid": "9fba6741-6692-414a-9d8a-73d7affe3464", "comment": "Malware payload (Mirai)", "value": "e2aa11e81aab1a4b7c4dad49b36ac3b5d248c086781b2d59fbc7db50527748c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776273193, "uuid": "56359126-2597-4365-8ef9-ffac665d9b54", "comment": "Malware payload (Mirai)", "value": "ddf24b9bd1fc03cc48ff1f568eb9718822e90230", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776273193, "uuid": "88f345ce-273c-40f9-b160-2bd85dc39fc0", "comment": "Malware payload (Mirai)", "value": "215445c123b75b57a15f76c803b83a9bd559eb2c707e76edabeaad5cc6b7cc2ab7385bebe80eb603d577dd069b889317", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776273193, "uuid": "f14fdf41-9ac6-4728-9c3b-641367f2a102", "value": "T1E0C31945FC519B17CAC662BBFF4E428D7B2A0758D2EE720399156F30378B95A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776273193, "uuid": "7ea034b2-8f17-4040-9b31-11d436a15212", "value": "1536:OZA34EaWYd/rPA8Mi4Vl43rT7nVA+GOKvsKDZ9Gs/tl87wywvsjiN4yVaTSTuvGw:uQahprPN447/nyxDrxiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776273193, "uuid": "740aa8bc-dfae-4f0e-a559-bf6dc457dad2", "value": 125472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776273193, "uuid": "0928a88c-b50b-4da0-9cd2-2dde4ccf9764", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776273193, "uuid": "fbed2176-19d9-4dde-bf5a-3ff840404ce4", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a8ce46-3895-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776235082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776235082, "uuid": "5c77bc4e-e7fd-4002-bce6-68c07976f6a5", "comment": "Malware payload (NetSupport)", "value": "57c72a464486b61316efae8c99e8c3b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776235082, "uuid": "3a425421-de11-4668-a73d-40d02cae87b8", "comment": "Malware payload (NetSupport)", "value": "e3092dbc87128954d75f905985c3aeab2cdb9598775122c9266783008932bd3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776235082, "uuid": "41e968a8-9175-4ecd-bd49-6238a542844c", "comment": "Malware payload (NetSupport)", "value": "0a0a0078b5620dfa3eab7fc82a0433421c9033b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776235082, "uuid": "5b454b83-da00-4ead-ae76-20ed8c4e6ada", "comment": "Malware payload (NetSupport)", "value": "5657784e9863292d14ce6b9efea79190783f59c12005ba79bb035d6e3f63f3b7de60492e2ba86fc034f781c9699fd597", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776235082, "uuid": "18607348-8ee2-48d4-a7d3-db64ed1cd5af", "value": "T1EA468F12ED6809A9C992637A88335193BE3CB400571123E76AD9636C1F637F4D37AF2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776235082, "uuid": "3b27bbbf-38d0-4b13-9c5e-94cb44ab3091", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776235082, "uuid": "acb9f617-df40-4c63-b9f4-e514a7e5eedf", "value": "49152:5IgUBIC/OLBPpHJCcsqNbwdOTLFr6UQ1u9jk+QclqPNB04xFnii7cS+PdDwPgkU2:5IDmnHJPbBm95NX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776235082, "uuid": "300928bc-6299-4b75-a742-aeee37636887", "value": 5543386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776235082, "uuid": "a4b803c8-0c24-497c-92b8-b741ea7dd5da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776235082, "uuid": "76b6ad17-422e-4132-8f80-e2a370c0b966", "value": "SecuriteInfo.com.W64.Agent.ACA.tr.24202.2745", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f3ebe8-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (N-W0rm)", "timestamp": 1776239750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239750, "uuid": "d1cc7319-e293-4025-a7f8-5ba3ac54627c", "comment": "Malware payload (N-W0rm)", "value": "29db20d5b0a1c537d5540e4e27b222b8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239750, "uuid": "aa3f3853-9679-4062-828b-f0ba200796bc", "comment": "Malware payload (N-W0rm)", "value": "e463226cbb26f2a9248dc8f40434bfadd2e718b5477d000414e32bcecc6900eb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239750, "uuid": "d2b5791f-79dc-486e-8350-ac9a8069c98b", "comment": "Malware payload (N-W0rm)", "value": "eb01dda189bbd6c1802a28befe359e85f9e46875", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239750, "uuid": "5b7e2ee6-2009-4386-8123-c646cf3b6620", "comment": "Malware payload (N-W0rm)", "value": "9c897695e29383a39152074c8f0821262dd492d8bef376148e5556445dcbd22ac740ce3a628654c21f9b8a3df7a8a9d6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239750, "uuid": "8c04c127-2082-48ce-8eda-774d3519874c", "value": "T12803681625DFCB0861B216CA4A9F13300B9F799F1FBF8085418DEA894BD3A159C5A7F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239750, "uuid": "f87dd17e-b6fb-4307-a0b7-0d8f265b6fa9", "value": "384:+tCAz8KgRCdM6YuXw/ooCsGVdXcwXWD/0bwK9pjbZ8tBCU2DB1lsl:YCAzdXdMfgoC5zi/0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239750, "uuid": "7e10164d-5bf2-44cb-8f7e-a274513654e7", "value": 40786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239750, "uuid": "7746818b-c8e4-47ce-b53c-fcae10cb286d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239750, "uuid": "157e5d1d-0a0a-4b61-b898-f0b4c2a015d8", "value": "RFQ0318200881102-02115.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bdf8ea3-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (N-W0rm)", "timestamp": 1776239788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239788, "uuid": "8f4e88a3-5a62-44c2-97c7-74fe655e3230", "comment": "Malware payload (N-W0rm)", "value": "00dd3017d15a25e379d9371c91a96e40", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239788, "uuid": "999aedce-842b-4a8d-9cfc-038c8f730ebd", "comment": "Malware payload (N-W0rm)", "value": "e5090bf88e382f6a4db66fd00a5d730fa509b2279d4573bb54204c432ad619e7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239788, "uuid": "f089295c-ead0-41dd-83e7-f1ecf4acd442", "comment": "Malware payload (N-W0rm)", "value": "3a62aa9414c15d1bd7705bb8fd2da47c028a140d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239788, "uuid": "da7f81d8-9dbc-466a-abbd-87cc20e1a783", "comment": "Malware payload (N-W0rm)", "value": "34e9a6c57e8a5e651f865ef175294c3fdb141c000fb72de7245694ad52e5ee46b666f7fd7c79f4913fd7d85fe781c348", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239788, "uuid": "606a200c-b0ad-49b8-a6c4-115c550dbdea", "value": "T145036715399FCB0861B216CA469F03750BAFB65F0FBF80D5448DEE894FD3521889A7B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239788, "uuid": "badc300d-7f47-452c-9b13-2251bc41c00a", "value": "384:6KzA8KgRCdM6Y1YGnnls5VVxcmsWDd0bD:6KzAdXdM8QnlWsid0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239788, "uuid": "96b21e49-1342-48d0-95a5-de01b832c163", "value": 40978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239788, "uuid": "f591232e-c540-4f2f-b954-3dd006fe316f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239788, "uuid": "d8c4c9f8-9b97-49ee-bc08-5f2c7408ef34", "value": "IQ05520888211000-08211.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2bfde96-38b1-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776247128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776247128, "uuid": "b08879c8-b8e4-46d5-a207-240863e27b5a", "comment": "Malware payload (RemcosRAT)", "value": "f05b24421f103713fa11d3f35eb4e5f7", "object_relation": "md5", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776247128, "uuid": "f46376cf-8147-42d7-8938-3b7586124a24", "comment": "Malware payload (RemcosRAT)", "value": "e51cda74b6fa9eff2088d940c1db35754e1bb20255938050fc31cca2d850e18d", "object_relation": "sha256", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776247128, "uuid": "7aa29dca-f2df-4c80-a441-68e5ca97d67c", "comment": "Malware payload (RemcosRAT)", "value": "db9b1effd0ef7abc19450d79784a091fc3a65a37", "object_relation": "sha1", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776247128, "uuid": "bccfd8d9-2dd2-455e-9ae5-aa2e629c16f2", "comment": "Malware payload (RemcosRAT)", "value": "aa8880ae829697e3c549f266c8dd211403c2a7b95555ed8a6a63501bd9619dcdf016fee5999237aeb571632b0221c9a5", "object_relation": "sha3-384", "Tag": [ { "name": "172-245-95-9", "colour": "#5CAA7A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776247128, "uuid": "3ae5a852-728a-484e-851c-552e98cf3aab", "value": "T1FDD47D5563F441B4D277C234C9C28927E6B27C0165F0472F13E75E6B6F232A1A72EB2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776247128, "uuid": "49fd57a3-baa3-40d6-a9b3-430a59c74fb7", "value": "8b3e0763eddbb01367bd21396e110071", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776247128, "uuid": "a94805cc-1a45-4ccf-b173-f3be39f2d26d", "value": "12288:5aMwmp7scoHvln/+iB9PQoYYUPGmXYom5PrJW:Y7mScoHvln/+aPQoYDPGmXY/5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776247128, "uuid": "78a75f67-d18b-4faf-907e-4997b1e083f5", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776247128, "uuid": "03e885eb-1fb4-4f7a-b222-6c5161d4d3ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776247128, "uuid": "ac46d36c-b9eb-4b3f-82ad-d1b665370824", "value": "e51cda74b6fa9eff2088d940c1db35754e1bb20255938050fc31cca2d850e18d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "284830d2-389d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776238306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238306, "uuid": "fa1e921c-0d2c-4a0c-a542-b5dabdf48086", "comment": "Malware payload", "value": "51dfed1b859b7b4b963dcdb662e22c13", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "ZIPLINE", "colour": "#23165C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238306, "uuid": "53b3f8da-a5ae-4d17-b225-16e1f5a82a47", "comment": "Malware payload", "value": "e69d8b96b106816cb732190bc6f8c2693aecb6056b8f245e2c15841fcb48ff94", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "ZIPLINE", "colour": "#23165C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238306, "uuid": "d9a7f64a-01ff-47ba-abf2-06a3af469484", "comment": "Malware payload", "value": "dc44e95768516d0e3d5b6abea6086904c079af79", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "ZIPLINE", "colour": "#23165C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238306, "uuid": "d413a5d0-4a9d-49e3-9c0c-bd8784d1097f", "comment": "Malware payload", "value": "c5773baa9fc5188141f940be4c682fcc1847775fca07efd2e9af1f96c5e3017d5f59b62954072d50c80557391726b92c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "ZIPLINE", "colour": "#23165C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238306, "uuid": "118484a7-4f9f-4333-a4b5-e74c3a58228d", "value": "T13E542348F0EB0ED867CD64A3C4F0AB857AABDFE6069C5D93CCEA48C18C5162051DD67E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238306, "uuid": "c577ec24-db2d-4a99-be7d-a68be530e2c2", "value": "6144:Kq5xfw2CjULq4ovPbv1NQ2VAt7g+uX2d0Rm1psczO1S:T8Wxorv1NlAt7leTR2pscr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776238306, "uuid": "5aac95fb-0b2e-4e16-8b87-cbdbace4f627", "value": 287404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776238306, "uuid": "58abff6a-f47c-42db-a574-0ab065bd0e3c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238306, "uuid": "81998fcc-ff1d-429c-ad48-1da255df6af0", "value": "e69d8b96b106816cb732190bc6f8c2693aecb6056b8f245e2c15841fcb48ff94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b406ffd-3880-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776225909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225909, "uuid": "124c0408-1121-4729-85dc-96d613cdfa22", "comment": "Malware payload (Mirai)", "value": "49e7b63f7c6d09fcff11b01e6c94e5d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225909, "uuid": "0b6cc669-5f49-4c35-a9ff-3eb6f07940bc", "comment": "Malware payload (Mirai)", "value": "e6bea3f7b04f15f833770d089446843d932d9ddde988ff850d271085f3ab21a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225909, "uuid": "a454b973-549b-4b35-8029-68cf0a848198", "comment": "Malware payload (Mirai)", "value": "d1e25967b9af5c73c0d26c30b9072e162bb84570", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225909, "uuid": "a8e54d6a-a5cb-4edf-91e3-b8b4958dac23", "comment": "Malware payload (Mirai)", "value": "95a628f4516d965f338c209870ca1870f50c40fba4c7173251844861fa62852a016198b15b3a2ad5d96789ac18543da9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225909, "uuid": "d372076e-89f6-4932-9e61-9d7e1f0e9435", "value": "T14CC32A06B30C0947E1633EF43B3B27E1D3DFDA8121A4F640655FAA8991B2D32558ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225909, "uuid": "b7338b38-2217-49c9-b2d0-41ce9cbc1232", "value": "1536:dyd65mdLLhJxDxI+bYqKA2OGxIkEcbI/MvAeJuOARGaJH8QqMibsIo:dYS6LhJx2FrOGWkIpeCi3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776225909, "uuid": "ce253eeb-7d5a-43bd-aa0d-20c9ddf3e390", "value": 121508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776225909, "uuid": "91c603ec-102b-47bd-9c54-cd9c18e7fbdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225909, "uuid": "c75474d4-0fb9-4534-8454-a9083f373700", "value": ".Sassy.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3381f15c-38f2-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776274832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274832, "uuid": "2acbae3e-dfa7-4f2a-8289-6b13e56471c7", "comment": "Malware payload (ConnectWise)", "value": "d077cd37fd773c67ae31627e1df1ecc1", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274832, "uuid": "05a65302-612f-4c4d-9434-bdede947f2c1", "comment": "Malware payload (ConnectWise)", "value": "e6ce5228b21c8f65721a0ba05baa2c8033c124fef53c257f043f5a5c5d092e41", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274832, "uuid": "a75c7a0b-5fb4-43fe-aef3-a6c91c3e049e", "comment": "Malware payload (ConnectWise)", "value": "7cb5f9fdfa20d183e428d6970bf7f5fb7ab32a28", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274832, "uuid": "6aafc509-d527-4e0b-9047-b4385d024158", "comment": "Malware payload (ConnectWise)", "value": "bb33b5dd33c330b1a6b64a20319b347d426643acde41b158ac28e44240c3ff16a22e5a09a94296dcdbb9f5495b3fc2ad", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274832, "uuid": "d95331da-fe0d-4cfa-b3bb-695191f6ce75", "value": "T173A623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274832, "uuid": "55ed88ab-053c-43e4-b471-e374c7e62656", "value": "196608:YnCtVYqI5MvbWEpKkqRIJqKRnCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkqEnCtO:8CXvI5MvHxBJbCXvI5MvHx6CXvI5MvHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776274832, "uuid": "15bf6442-b6d6-4acb-9be3-306048649ea4", "value": 10190848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776274832, "uuid": "6699c026-9576-4d52-b654-e4a37260a419", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274832, "uuid": "f9e56576-2d47-47be-9bdf-cecb477a1a33", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883f696d-38ae-11f1-a769-42010a9c0008", "comment": "Malware payload (PureCrypter)", "timestamp": 1776245768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245768, "uuid": "4d8f7aaf-9263-4cc2-b32c-ff92ac768a26", "comment": "Malware payload (PureCrypter)", "value": "9a3df72a3fca31f350248435009a3fc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245768, "uuid": "a33ad7e5-0ea9-4106-afc0-5ded560b6bc5", "comment": "Malware payload (PureCrypter)", "value": "e794f8ac57d5781b90cc9875c5767101049fcd85007f145cfa3c5a318c53bdf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245768, "uuid": "c91f6230-21ec-4960-8677-c027d386dea6", "comment": "Malware payload (PureCrypter)", "value": "748106ba6f1da9b8153cd84afee93ffa97631b7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776245768, "uuid": "e7c1d65a-3bdb-4117-90cc-21fe98a9ba74", "comment": "Malware payload (PureCrypter)", "value": "cf022f11cef09eea88b48c84e021f05c334049ceddd5cb08557072c560a79c8e777008210eed2561892d924c606e3a3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245768, "uuid": "c4fec310-8092-4963-8c30-f2edb4ac7efb", "value": "T1F3F1E868A7D48777D9F7477EDCB382824378FB45D643CF6E2888120BDA123610A52B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245768, "uuid": "a4f7c318-3a5a-4309-ae74-a877a070f49e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245768, "uuid": "d753ecc6-7a84-4cde-8354-dc1abcc305c2", "value": "96:0Iz9WzEktcf+uEwh8qKsxBAnUGBihXEAYuy02eFOdxsrThs/TllwEzNt:05cfd+qrwPMhXEA6eusrTS7llV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776245768, "uuid": "5ab7805f-1f93-448c-81e6-5ab872771ddb", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776245768, "uuid": "5879d13e-a567-44cf-807b-3937b88b95d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776245768, "uuid": "e0c67ac0-570f-49d2-b822-dbe62e3e974b", "value": "SecuriteInfo.com.Variant.Jalapeno.20291.77524519", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d97d27-387e-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776225059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225059, "uuid": "6c7fc35f-8a8c-4c3a-9baa-351404af5248", "comment": "Malware payload (ValleyRAT)", "value": "0b8e76770a9e5803082153c2535053df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225059, "uuid": "3e56539a-349f-4c81-8b46-8fb31d49202a", "comment": "Malware payload (ValleyRAT)", "value": "e8e9df79257bea763a14fc5493e653f2201a579fb1d7d0e31a56310e41fc5126", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225059, "uuid": "d0d05eff-2a69-4e84-82a4-dafc2576f5b7", "comment": "Malware payload (ValleyRAT)", "value": "69606bf0e94ff870e72ac68441ec1be718d377c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776225059, "uuid": "7dc8cfe1-5e54-4034-971c-09ae6829526f", "comment": "Malware payload (ValleyRAT)", "value": "d98a5807089e5cfed6306c655617f0f6140637864a9af480a5e6693d5123a17ad660256049ab981350ac89c9a2197451", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225059, "uuid": "b679ae82-2473-4db8-9dce-b798575a2e7a", "value": "T1ADA5D023B2CBE43EE05D4B3B45B2A25494FBAB616523BD1797E4849CCF250602E3E747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225059, "uuid": "9e98274d-8dde-4c4b-90ad-492a7a6c8f63", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225059, "uuid": "cfbf8ca5-e616-459d-97b0-0c2a2ba59897", "value": "49152:++MRvHjHJzVmaxh67MZ2Z9ftchfudg87dqn7iMO:+rjmaxh+MYchXqdnMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776225059, "uuid": "4e2be5a2-657e-41fb-9c73-66e01d389d18", "value": 2190054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776225059, "uuid": "ab6484ac-5698-4b34-94cf-049a865e3454", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776225059, "uuid": "6dae908a-6816-46e3-9695-d6172035fa47", "value": "e8e9df79257bea763a14fc5493e653f2201a579fb1d7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4cad870-38df-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1776266861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776266861, "uuid": "a7e29a6c-55a6-4dbb-b14f-18930b350b3a", "comment": "Malware payload (DonutLoader)", "value": "53540c0763abc7f820614ddf6814b783", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776266861, "uuid": "38878fc0-ead5-4245-87d6-089cfba8031a", "comment": "Malware payload (DonutLoader)", "value": "eacf61c74998fc5e8ab1e429fb352ef66f8c017a1cf9841006d7711529b1bd69", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776266861, "uuid": "0a431904-1bee-4262-bc8f-181606ab327b", "comment": "Malware payload (DonutLoader)", "value": "ee48c74f21f188bf16a75965bcfd47b0208f385f", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776266861, "uuid": "ac06ef4e-5971-44d9-a93f-7808d91ae420", "comment": "Malware payload (DonutLoader)", "value": "a1ab316f75f715cf2c511651f58c891c95132a965614fd3b2debdcd006ef759a7d066abf100a11710d8f994fa2e20613", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776266861, "uuid": "39a4eeb2-392d-4c45-9cce-73662ac45274", "value": "T124E4F132BBD155FCD516C077C2414966BAB3B4860B21ADEF025802393F2ABED6F39B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776266861, "uuid": "0691ecb6-7801-479d-9e54-cbbf840f29f4", "value": "036efc1dcfe9fb28cdc51554d28f8958", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776266861, "uuid": "83dae48f-3933-4f22-951e-15e656780a7a", "value": "12288:S84W0u3NvJHtnWWLUZddxaFj3gQyDJaFcLuOAWrSYWJ5PmOg/X:j4W08RHUWEdTadkauLuOAWeLIOgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776266861, "uuid": "f7ae6d7c-39c4-4415-9c04-6916e861fec8", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776266861, "uuid": "ccb33526-d0f2-442b-bd96-feb1f3c5b0d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776266861, "uuid": "4579bfa8-e787-47be-9a14-a6f6a659bf3b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db9907c-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1776239684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239684, "uuid": "4b114771-4f86-4751-b206-b1131851a406", "comment": "Malware payload (VIPKeylogger)", "value": "9d14e543d5598ee696aef5fe0e2a173c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239684, "uuid": "f03b2e91-e595-4fb5-965a-e00a71807951", "comment": "Malware payload (VIPKeylogger)", "value": "eb74a1b4cb627e713adcf4ef871c2d0d1ce7be484d4c0a2b3be329bcababf5a0", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239684, "uuid": "c224631d-73b2-41f9-af6f-810dc579dbe5", "comment": "Malware payload (VIPKeylogger)", "value": "1f9f731c68dc3bf4ffb320cb37f98edc853119a3", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239684, "uuid": "e1a32039-89fc-4e27-a629-489fee3b3257", "comment": "Malware payload (VIPKeylogger)", "value": "f86cd634a285c20268c1737d23c60ac7b961fc0e92d74a86e7e82f7205334d71d91ab1e5e10ea27f5d726324bdedd3aa", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239684, "uuid": "6090a9de-a94c-47d9-b7e8-a197fc965a1f", "value": "T1CBB2403EC985DFF00B6A31E1A56F7A16A5140323B5386A4DBCCF81993B36650CBB14ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239684, "uuid": "f8324b65-96bf-44d6-9935-451a2c9174a3", "value": "384:KW8ZiUwt04Ms4sY9sWcTZ5DA6uiFhcn1cDl6jq0ikriDp8AQFjGYYszY39U/Rpd4:KW8ZiFRyuJ3EKGl4SIWQii55nWe3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239684, "uuid": "5df206c7-fd57-49c2-b772-24ee1daf317f", "value": 24119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239684, "uuid": "7554a77d-a202-423f-b74b-6e5a69914742", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239684, "uuid": "fe7d1939-7b86-4f43-86b7-638cc027f96e", "value": "\u0420\u0430\u0437\u043f\u0438\u0441\u043a\u0430 \u0437\u0430 \u043f\u043b\u0430\u0449\u0430\u043d\u0435_PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "926908a9-3921-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776295177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295177, "uuid": "05fdf544-fc6b-4317-9536-56d9162b20fc", "comment": "Malware payload (Mirai)", "value": "252401bb149447d91f17cbd6df4c3619", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295177, "uuid": "0dfac077-2d69-4939-8803-05f97cf009f3", "comment": "Malware payload (Mirai)", "value": "ecf3db15e6f1b63848133bf3bcbd2159e54469886c1088630d789cba08ddacca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295177, "uuid": "1a2afc9a-a6e8-4cec-8c3e-9216ee8ce08c", "comment": "Malware payload (Mirai)", "value": "e901acde6a1f05ee2468f34fb262bd4124ec7edc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776295177, "uuid": "17a6f4f5-e7c3-4219-b7f3-dd2aea77ff42", "comment": "Malware payload (Mirai)", "value": "c3068ef9c00c49a31eab6cf1483c779c34efc11b84e8c8e076963c58ae74c2303bf86f142ab3e8a44de2ee128dabcc80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776295177, "uuid": "88be432c-055d-4db7-a210-aa2a656d642b", "value": "T17523F183E0AEB2BCC83131375C4965C4E6266123F64F4B4F55D2A6F98858506EE32FBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776295177, "uuid": "84dfa74d-4c6b-47f4-8472-28c92b4e5feb", "value": "768:nxlSz4dn4BpO9fQZkcNlmfUWRafHe+PZhitgwVhwbDmnxCviGaznr557KOIWmfp8:xlSz4dn4BYiDNuUWRamo/wUPMxCpaznN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776295177, "uuid": "21f10924-31ae-42b2-bcc4-629e2345ec5a", "value": 47752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776295177, "uuid": "322ac8c8-c2be-4c70-b180-ccc383b0ba40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776295177, "uuid": "a9ae25b5-5888-461b-ad4d-68f258126e89", "value": ".Sassy.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af59724d-389e-11f1-a769-42010a9c0008", "comment": "Malware payload (Lazarus)", "timestamp": 1776238962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238962, "uuid": "ac549708-c643-4d80-a287-3562f3f9a703", "comment": "Malware payload (Lazarus)", "value": "118cfa75e386ed45bec297f8865de671", "object_relation": "md5", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238962, "uuid": "805d9763-6270-4b73-9a41-dd5d7d77d079", "comment": "Malware payload (Lazarus)", "value": "ed5fbefd61a72ec9f8a5ebd7fa7bcd632ec55f04bdd4a4e24686edccb0268e05", "object_relation": "sha256", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238962, "uuid": "bb93fe14-2f78-46bd-abce-0fb397916a51", "comment": "Malware payload (Lazarus)", "value": "43ef1dd0097da941dbcf64f00a790d6aae3a82f4", "object_relation": "sha1", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238962, "uuid": "37226483-c693-4eff-a065-061b86d4cced", "comment": "Malware payload (Lazarus)", "value": "c72f873c3297001b43200603669e73cc2117fdd5aeb9e723269142f99a1f11b1fbc1ec987bdfe1ad986bc9a497ee69e2", "object_relation": "sha3-384", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238962, "uuid": "12dde2df-e182-489a-9316-c0ab9136a097", "value": "T17FB47C8E711210DFC811DA75BAD2C01A43376CE97580E38D697212EDFF3265A1FA19FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238962, "uuid": "6eee62a0-622f-46fc-b9a2-f9a9b9d93a0f", "value": "920a18f4432c5fbd3cef843e34ac3311", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238962, "uuid": "e3749bbf-c3e6-43b5-becd-14baa1491459", "value": "6144:gqPtTs240pBu1IocVZrMBgMSOG9iO2RKz8CqwWR1jUbe9+d4k2H03:gqP5pAErMBgMS9UOIKz8/Hocs4xu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776238962, "uuid": "0c3eba33-65bc-4d22-8f49-7c72e8d89c6c", "value": 516802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776238962, "uuid": "e4560e66-7d8b-43c8-a73a-a41d25fb1631", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238962, "uuid": "8f2499c8-4782-4039-9c82-07a86e860161", "value": "ed5fbefd61a72ec9f8a5ebd7fa7bcd632ec55f04bdd4a4e24686edccb0268e05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "967901a7-38ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776259536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259536, "uuid": "b9d5ca2e-ae75-409c-aa0e-210d9a30101c", "comment": "Malware payload", "value": "2258e5561e950be720d4ff706d6cbe51", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259536, "uuid": "1f45d52b-f2e3-4000-bd06-48b3e137db4c", "comment": "Malware payload", "value": "ee334763f7c227564d010f03a50922b578a3e71e91e4815454d3aa4ae1fa9095", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259536, "uuid": "e2b3f780-7e86-4b95-97db-04ce300f2e14", "comment": "Malware payload", "value": "2328f1ad1ad7742657167650e3aea468a32e7f30", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259536, "uuid": "bea86642-1780-4969-9de8-e444fd664d37", "comment": "Malware payload", "value": "58113cbdddb3d7e9994fc6f8154b9b36c369fa676ba0a923e6b1ab99ac56e1080d9453e8a56ef99b69716467277a6efc", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259536, "uuid": "2a46b174-7aab-4feb-aea1-2031be40cee6", "value": "T1B2563331AE69181F02A4473AF0BB4F366EFC4E93854DD1E8885D7089358EBD5C66F86C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259536, "uuid": "5023f224-5a94-41f1-9a88-07160da90257", "value": "49152:0VLisu58alRu4agpKCr+Dd6vUJ4R/DcRnDgOsBx4bCWUYm10bjamUHk0gUF6UCml:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259536, "uuid": "86dd68b2-aa22-443b-b0b5-889b95b66069", "value": 5948226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259536, "uuid": "10a73395-eefd-4e7d-a895-13d927f1f3c5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259536, "uuid": "2d82ec07-ffef-499c-9514-2776fd9158b8", "value": "Conslt240QO_5986lpdsfYJSMVM2LSM724093-VNYB.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce55ed15-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776239873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239873, "uuid": "127bffc5-779a-48af-a857-0637b994b2a8", "comment": "Malware payload", "value": "5be83a314802ca028014e7b234cae554", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239873, "uuid": "3e57f28d-425f-401d-93a8-5413fa86321e", "comment": "Malware payload", "value": "ee3a36f7397e6ce371483cdbba4f55e6392ce10d5531e6ea62b3334d636f6258", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239873, "uuid": "e9169e16-b56c-47f9-95d2-17d14d7bfffd", "comment": "Malware payload", "value": "329171eda8cd57ad8a999bd2729b3b2b2ae51771", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239873, "uuid": "ea16566f-35ef-43a3-bdb0-938e65eaf703", "comment": "Malware payload", "value": "bd2790e734d8eca67d802a94b68d523124a0c92b906f19394829cfb242662298e2c6d464e81b7aae5389b526de7a5f30", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239873, "uuid": "bd7b0500-6bc8-48bb-acd1-f8080bd55961", "value": "T1125373F8494217E7B9A87750A444884F85D8B2BAFF97982677C438CEC1BDEF91D70428", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239873, "uuid": "9f097ddc-d0dc-40ab-a73e-d31c05eb6aae", "value": "1536:5sLw9CqV2hcCD1ac1z+eqw2WhXpf2ewFiXjy8ocmBYsSFE2onsiX5lAmpC98J40K:5sLw9CqV2hc+8c1Ceqw2WhXpf2JFiXjP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239873, "uuid": "73998ae8-5cb5-4ba1-b4c4-85a79109f6b9", "value": 62260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239873, "uuid": "22777618-e2a7-45b9-9cf5-6bdb02ba71e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239873, "uuid": "116e0132-609a-444c-8e6b-7c14f084f7e3", "value": "OC- 38734021125.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f6b164-38a6-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1776242436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242436, "uuid": "cf0aaff1-4214-49dc-ae6f-4d0ab6e3daf7", "comment": "Malware payload (SalatStealer)", "value": "3e87dc253d66c824da90b37af6453dcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242436, "uuid": "32f9de07-5123-4f78-a123-1e0ac5d2613c", "comment": "Malware payload (SalatStealer)", "value": "ee4e32b5bfad4a86152c042c6ee79edcc39b0be9cec1928d04a8268b09e8e8f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242436, "uuid": "29f12070-e6d7-4788-9643-9e522ca2806b", "comment": "Malware payload (SalatStealer)", "value": "d8f91fd292a64d5831676ce42143284a66b1dbf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776242436, "uuid": "298adb1d-7f40-43ee-b49e-b1ceb3fb936c", "comment": "Malware payload (SalatStealer)", "value": "1060c7a8c68727f0fac33ce51c4ecc1d29432272b4f2677b13da15102549def2cf1ccf3ed66fe72221f1f8512734aa09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242436, "uuid": "eded913c-dad6-48da-b218-1c3b5fc2f449", "value": "T1FCC65B01FACB58F6E9035831515BB23F63306C048B28CBE7EB587E6BF877691197A215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242436, "uuid": "eac89828-d360-433e-850a-b6efce8b996e", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242436, "uuid": "cf8cce8b-201a-49b6-8e1c-4c03ea1e7cf0", "value": "98304:yBWZQLW1L3w6kVk6YSmjXnvHljBlsbjk4TsyKYcwcgdvCEY:DQYp6YV/la4byKYcbgdvPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776242436, "uuid": "73b93765-7d8a-4b36-b6bc-d3baaa960206", "value": 12317184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776242436, "uuid": "dbace97c-01ba-4790-a0b9-c95412240982", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776242436, "uuid": "b1136897-7ea4-4fdc-9490-e8f31c4c383c", "value": "SecuriteInfo.com.Trojan.PWS.Salat.389.18514.14972", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8c9c44-3894-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776234555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234555, "uuid": "20d8c584-f8db-469a-99b2-43118aad6181", "comment": "Malware payload", "value": "141f0743076d0b4f057427005c5bfbe1", "object_relation": "md5", "Tag": [ { "name": "Dienstangebot-Klement", "colour": "#522A09", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234555, "uuid": "c3015c8b-157d-4011-b844-3896a7612d05", "comment": "Malware payload", "value": "ee6c8422e4e723fe408ef6bbacfa852ae372e99ddf79e2fe38920017ec5e7674", "object_relation": "sha256", "Tag": [ { "name": "Dienstangebot-Klement", "colour": "#522A09", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234555, "uuid": "c01284aa-7dca-4b42-9682-b7812e672152", "comment": "Malware payload", "value": "848e3a81c68a3e62b054bb10b2bc6c43f33d6280", "object_relation": "sha1", "Tag": [ { "name": "Dienstangebot-Klement", "colour": "#522A09", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234555, "uuid": "00a0b4a5-3a76-4fd2-95bc-be398fe35a22", "comment": "Malware payload", "value": "278ee0fc0b9aaccf908c3d8a4b6c1437c5f216bb0cbf19109c919e0a18fecab04ad2586075c465e5b3171b6deafb61bd", "object_relation": "sha3-384", "Tag": [ { "name": "Dienstangebot-Klement", "colour": "#522A09", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776234555, "uuid": "7abb6d5c-b847-4ca8-b42b-70458406ded2", "value": "T1F962C064C98B057BD203F7B9E0A5024BD118F0DBC104EA93619523D974DA7D49BBA57C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776234555, "uuid": "696ef95f-1a9a-4657-aefc-a82dcf5f59c5", "value": "384:YlfIPFPTToUr0eXNXI1G8MpgwDvoJkgs2uUbdHdAClQbpc:uQtPTbDXtd88DUbdak/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776234555, "uuid": "fcf9272e-62a3-4b74-86bb-872ff1832351", "value": 15878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776234555, "uuid": "3fccc38f-1d82-4d80-be17-37947c015461", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776234555, "uuid": "89d6383d-2fde-49e8-b0f9-abef455ec1b2", "value": "ROSSMANN_Kandidatenbrochure.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df9347c3-38c9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776257511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257511, "uuid": "1556224d-e6ad-494f-9e5f-97f75d8962a2", "comment": "Malware payload", "value": "b3e706ba673cfeb9d205fb97b0ac624c", "object_relation": "md5", "Tag": [ { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "livemap-back-ddns-net", "colour": "#E73106", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257511, "uuid": "72a386d5-ad33-4b56-b2ea-7b08a1c7ddbf", "comment": "Malware payload", "value": "ee90df061740b8cf0cdce8dba04ff34c205adf3271695e5310d04723dd9a2a47", "object_relation": "sha256", "Tag": [ { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "livemap-back-ddns-net", "colour": "#E73106", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257511, "uuid": "b808106d-8f98-4200-a3c0-b46b1dc9a7ba", "comment": "Malware payload", "value": "75411f2075bfd2259ccede39c3e559864c77e785", "object_relation": "sha1", "Tag": [ { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "livemap-back-ddns-net", "colour": "#E73106", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257511, "uuid": "44693a48-8606-4f43-8709-baa6764c0631", "comment": "Malware payload", "value": "0e765b6fca034324d7fc93a9eb91b282c0b59a22e3d8632ffe5dfa2b5a8489d37547e7080cbf8c30290fb28434a0267c", "object_relation": "sha3-384", "Tag": [ { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "livemap-back-ddns-net", "colour": "#E73106", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257511, "uuid": "a6c90acf-972e-4dec-a31c-a9ce6359d6ce", "value": "T126B6129AF758942FCC3750724DAA533162978D92CE83AB43394833AC68776C84F49BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257511, "uuid": "03fc247c-75ba-40d1-b6cd-702a40979dc2", "value": "196608:gomVWQ0EYHkolZzy8C5LozvbDfhoBboSUaurEC4nvwww:DmYQzqPlU19m/fhoBbaY7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776257511, "uuid": "d956759d-0572-408d-8da6-bb46389cbed1", "value": 11406381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776257511, "uuid": "f158c816-d2ea-4584-8643-7b3c29d7686f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257511, "uuid": "c0bdc232-05c3-4423-9ec8-a397e046140f", "value": "ee90df061740b8cf0cdce8dba04ff34c205adf3271695e5310d04723dd9a2a47.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c494c81-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776239708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239708, "uuid": "d59aff8a-af56-4dfe-8115-5e1ca1e4d588", "comment": "Malware payload (AsyncRAT)", "value": "c36263fd53f1e52caacd873c3b3aed9e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239708, "uuid": "2b0adbce-0c90-4ad5-b66e-6d4e7c3ddf9e", "comment": "Malware payload (AsyncRAT)", "value": "f0ac3f4ba5a01e0d066b935db2c2f1fe42078f8e0882c46f3eb1b9f03add3c39", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239708, "uuid": "bace4218-6801-40ca-bd44-7e8c799d79e8", "comment": "Malware payload (AsyncRAT)", "value": "46043625b0d07d6d8c560445b1c878d3c4274bb8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239708, "uuid": "bc0559ba-654a-49fd-85bc-60f41ecd985b", "comment": "Malware payload (AsyncRAT)", "value": "e81e43be319125d7a26d1deccfc33d4eaa1cf6d392b88c519b98ff8a8075745f2a133d701f8eaf0a282035f126ebf8f5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239708, "uuid": "6662411b-5048-4cef-912c-59f12f159aa0", "value": "T19BC513254855C0D4E9CC38A3D1194D3F5A8032F18EF0A6FA61496DB727B562EC6FCE3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239708, "uuid": "fd9bc87d-526c-494e-b016-fdf8839ff5ca", "value": "192:koPeYbh6bSBAzYCD7ihElRrlRDlPU+2VDg7iF0nsExJ4x1wbwi57sIue4lm49PUv:koPeYg8Hq1eY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239708, "uuid": "f10ac3c2-3469-45b2-a2f1-1a00627b5d72", "value": 2650105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239708, "uuid": "e7d630f1-ff06-4c04-8881-8e7ecc4561ee", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239708, "uuid": "a01df5be-5631-4f65-82bb-93b36d2ed881", "value": "Advance payment transfer BE374390.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4489da23-38ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776259398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259398, "uuid": "67e469bf-813a-4ec3-9258-8eb4a682218b", "comment": "Malware payload", "value": "10dde1542005e3513b023262323bbcf7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259398, "uuid": "8e23c026-3cf2-4ec4-a775-1f0ef14cad4e", "comment": "Malware payload", "value": "f159732013353821c68b98ccd1fed9cb78d182baed2f71f67ed0c3c53d59bb01", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259398, "uuid": "0dd01f5d-fab4-4d0b-ac7b-09cb0d783825", "comment": "Malware payload", "value": "a61fcf2e333a8004bab841f28f3c2e3c77330494", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259398, "uuid": "acd5dd6b-85c1-49d6-b253-987d61b28bc1", "comment": "Malware payload", "value": "72c4e50aa9882a83025735d8b7a8c5fe3c9b32aac83563a77939c2e634760d689a18af799d47787b251a2ea3bf4ad7d1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259398, "uuid": "2334a07e-8f5e-4a66-8649-d70dd80285a9", "value": "T1D072A54C77B6246F9B9D0BCF591EE4E888593212FC4371EE70AB0B96BBB01350A31356", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259398, "uuid": "fd2ad1e0-61a7-49ea-92e6-6a1a7800a58f", "value": "48:OMZEA5Rns9Fel3dlpBEsJUKlose+5QwTnFmUKgQlwC2b+UKHQRnUK2bXSm/NXKvH:fZTl0A7jgKFodox0AEYV2hE11YxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259398, "uuid": "c9ad1126-e52b-45dc-8116-2116d66836d8", "value": 16686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259398, "uuid": "edf2ec5c-a008-4fe9-8257-4da93ad28e6d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259398, "uuid": "f7999a36-d6d5-4c50-971b-1ea7301681c7", "value": "Tdes-\u0417\u0430\u043a\u0430\u04370010415026_PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c47f2425-390f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776287530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776287530, "uuid": "584418e1-8bd1-4c23-84c4-dfbfa1d0f1a3", "comment": "Malware payload", "value": "f897b018e6ee3a9c1f78377ae93480d2", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776287530, "uuid": "3ebbc7ec-1f3e-494e-861e-5cd902e92b02", "comment": "Malware payload", "value": "f1edff0290afc18596ec5caf5dc6dc6069f28639ef606824e3a6948beb60027b", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776287530, "uuid": "e35d46b8-19db-4527-aeed-1f20ffa16e95", "comment": "Malware payload", "value": "84ba75c985791117107a8b21b61a2b6ac3707a4a", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776287530, "uuid": "11fac9e7-b752-499d-a279-b5e90991e618", "comment": "Malware payload", "value": "67d99933bfd86ca2f7eab761e0eb525860f8611d309248289c3252aad0ba7b6859fc85e85e9af2639b4666f65cac1492", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776287530, "uuid": "3c7dd7e7-17a1-448c-8636-6d2f69cd978b", "value": "T16432657DD9E1FCC4036F72D0596E3F46209C4B23FAA56B6CF9C504A62824689DF3A19C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776287530, "uuid": "6e882937-3fb2-4e9b-87f9-7d8fda9ef02d", "value": "192:+wcgOcgMWBk4JOCxYhlQ8dajdyyN7fohhzLFUhAU3rgBiuTF1fQy9Gi0Ak:PchcbUFOKil5deUyN7ghhzLF+AU3rgBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776287530, "uuid": "df5fb473-2646-4946-9c17-16b82551c676", "value": 11428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776287530, "uuid": "c8dd8eda-0ad1-49be-8bf6-69a855e6a8ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776287530, "uuid": "25a94be3-8d65-4726-bead-3f0566607d2c", "value": "script.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc4d330-38bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776251948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251948, "uuid": "e17aaff8-9864-4edb-8f3e-f922b256a8f5", "comment": "Malware payload", "value": "9f0c8ae2bcc8bcef7e0ba43e991b49ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251948, "uuid": "8550bc7e-7e26-4604-87c0-365ed5b1d9c1", "comment": "Malware payload", "value": "f21d7f1ab25a6bc80468ca3ff7c6b650f26962fed154c566926e403bb44fadf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251948, "uuid": "92f4739c-295c-4701-8c80-2c4a2e6eb61a", "comment": "Malware payload", "value": "7ce6505cd3543649a7787f3a85f0fb0083a97cd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251948, "uuid": "25a5cf31-0561-4d81-96ee-c862c8819b62", "comment": "Malware payload", "value": "e9fbe7a1bcb9fb0e65c454083f836092d644a8ec3872b4ddb6441f74dc948a2675ebc13beede0732bdaa9b0cdd324718", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251948, "uuid": "25d13261-bab7-40b2-a0f2-e7d967e434c5", "value": "T1A254B7143BFA5418F1BBAF765BF475968E7FF6633A03854E0491034B0A32A81DD91B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251948, "uuid": "3c5fa8aa-e626-4547-9088-18bf178911ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251948, "uuid": "86b6ddcb-d603-40e7-b4eb-e325402aeda0", "value": "6144:XC0W/2rYnPg2+N3AERKgXj9UJb7Z75k6e/iBf:O/28Pg3RjXCld66e/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776251948, "uuid": "f20727e7-745b-45b9-81e8-31754b29ce8e", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776251948, "uuid": "b2e93c8e-61d7-4981-a977-bdb77e92068c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251948, "uuid": "8c06d374-47be-415e-8786-3c2591ba72a2", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c03cf19b-38bb-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1776251446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251446, "uuid": "7b45c0b5-e9c0-45c8-8d43-a05ffb039388", "comment": "Malware payload (SantaStealer)", "value": "4d35d2f07cbacdf559f55cd47911a0a6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251446, "uuid": "a1fb2604-35e9-41a1-b49f-21677b2bf792", "comment": "Malware payload (SantaStealer)", "value": "f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251446, "uuid": "96b51d32-ace3-460a-a970-d5fadc39b921", "comment": "Malware payload (SantaStealer)", "value": "51bc8a328390528342f677a184ff10ee2afa3027", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776251446, "uuid": "7168854a-1375-4c1d-9348-4ff1ef3591bf", "comment": "Malware payload (SantaStealer)", "value": "3e96e4dc4ec4e764c8497036a04ed0aab3d81d00d7f50ccc378b2bdcf88464f9299586eb58a4fe1591375a7393c8bc68", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251446, "uuid": "fc502a77-77f5-4ffe-8637-8e6806bfd5e1", "value": "T151269DA7E16A50E8C46BC0329757EA31FA30B85900347EAA0E96C7203F71D71AB5DF57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251446, "uuid": "d09e1faa-ed90-44e2-8963-f45e045cd599", "value": "ed6edba9ec77ed904b0920d79686675c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251446, "uuid": "28b1b33a-092a-41d9-94e0-2688ec8cfc4f", "value": "49152:17qvgQsBZJ69JtbivwA9qtnew8EJRddY0hLIbxRtnFD1WfHdsl2wzdroItxKj+be:1J69mv0newpZAh1W+PYXr1MTmNxMUB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776251446, "uuid": "aa546188-1bdb-4744-8712-ce1e28a2c7cd", "value": 4511744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776251446, "uuid": "8945e269-2610-4416-a724-2392aac4e4ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776251446, "uuid": "5f79a448-5d45-4f4c-b62f-c1efa0bed2ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f43859-391d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776293324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293324, "uuid": "ae7de36e-c96d-4959-8bb7-9aa12c8245d5", "comment": "Malware payload (Mirai)", "value": "4d4f3528885ce929fc7467c564e70573", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293324, "uuid": "e8fbad06-9af6-464a-8347-411a0d3f9aa6", "comment": "Malware payload (Mirai)", "value": "f2b3af70d6b9d39982c1187dafc32078c26957817cbb7c557fa5744d1e929ca6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293324, "uuid": "9c27649e-2d09-4a89-99a1-8ba94799deef", "comment": "Malware payload (Mirai)", "value": "ff8cc0c7977b537c48e2752f4299dbb7c9b0e909", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293324, "uuid": "267b1fda-afc6-420b-aeef-f890edf4c3ab", "comment": "Malware payload (Mirai)", "value": "47abb997f69bc180659fe764a4b117f815d40b188d7e6383bc8d476bf5329e616c179cdb7e7c81b41415bf4cb1136b4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293324, "uuid": "6772a09d-103a-4128-b5b0-564b12f2ed85", "value": "T10423F2D3D57FE2B1D6A15B75650A0BCC99046C223A0E2F1B07F1A7BA4CB3A041E79739", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293324, "uuid": "cb01ee75-bbcb-40e6-91f5-8cd01f0937cf", "value": "768:oweRiKMLXcFVczJKLpt/gflW1DcR9hiQC7cO/b9f29wX+NEZzi47oWZgpi4omNVu:ooLsHTtoficoQScOpeqTZua36h9S3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776293324, "uuid": "a8c583bd-cdc4-4817-99d4-369c34d495d8", "value": 49972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776293324, "uuid": "c39f713d-9b11-49b4-aa02-a5ad2f1324e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293324, "uuid": "92e7fb33-ad9a-49c0-a6b1-64ec3719170b", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6618b4cb-3913-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776289090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776289090, "uuid": "cb20cd51-f316-4345-91de-ae9f6e632f89", "comment": "Malware payload (ConnectWise)", "value": "29fc663e2b4dcfdb3bcb97af7388a924", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776289090, "uuid": "736cbcb3-f585-4a4e-8fc5-9d3662b3a20d", "comment": "Malware payload (ConnectWise)", "value": "f3419d6903670e26e8b9c9582d5621d85942abee0f431b1d619d3dcd66daded6", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776289090, "uuid": "8c21f3ef-6f90-4388-aa4d-e45a58b6bddf", "comment": "Malware payload (ConnectWise)", "value": "df09999887ec8b83312de79cdabd72715d7732ed", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776289090, "uuid": "bdc64303-c058-4476-a7ba-b14f20c96652", "comment": "Malware payload (ConnectWise)", "value": "a72d960c36bba2cb7ca40ec1b45bc3b791e3b92d0333e00e8d5de71a15f3194b2db4fc0b77984ab1355efaa5a53bf014", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776289090, "uuid": "56c01e26-9328-4027-9fb7-dfbb451267a3", "value": "T151D61211B3E595F6D0BF1678E87A92655631FC044722C2AF53A4B96E2C32BC08E32777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776289090, "uuid": "be0fecb2-f2b1-4477-8f21-10c9ec03785e", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776289090, "uuid": "0af5efda-3b1b-43e6-b7e8-a8ef1378b175", "value": "393216:2CXvI5MvHxjJECXvI5MvHx6CXvI5MvHxbCXvI5MvHxv:2Z6HxqZ6Hx6Z6HxbZ6Hxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776289090, "uuid": "f802e8cb-c447-4e12-96f5-b90dd015e6e5", "value": 12762168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776289090, "uuid": "a93e505e-d0a3-42c7-a640-bb7995dd4d51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776289090, "uuid": "e6fbb273-675e-4fdc-a63d-c2d07fe3259a", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ed84e0-3894-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776234792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234792, "uuid": "fc1ac991-02e4-4e26-953d-08d55d779a02", "comment": "Malware payload", "value": "f6e1c60f55d9afe43de2d6f5417e0973", "object_relation": "md5", "Tag": [ { "name": "45-92-1-242-8000", "colour": "#D264AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234792, "uuid": "097f0fe4-a59e-4b10-a135-e2ac0a9c0a1d", "comment": "Malware payload", "value": "f4c8e1cd4d83331154718d58cd6c217cef225f1d3d6c15fae3ba674240805cc5", "object_relation": "sha256", "Tag": [ { "name": "45-92-1-242-8000", "colour": "#D264AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234792, "uuid": "5a44523c-4ef8-4eff-adf6-3617919229fd", "comment": "Malware payload", "value": "f40e830b8e8cd1bf54fd7b6f5dd56dbfd4eea068", "object_relation": "sha1", "Tag": [ { "name": "45-92-1-242-8000", "colour": "#D264AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776234792, "uuid": "35952942-b1cb-4604-9e33-f2fbde20717f", "comment": "Malware payload", "value": "6a1c37b4b574ba6811e6227f3c3dc9040b43a3d3fdd7da8a5907047b521b540a652d78d78f5fce931e3074eec94536d5", "object_relation": "sha3-384", "Tag": [ { "name": "45-92-1-242-8000", "colour": "#D264AF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776234792, "uuid": "2fea12f0-0cf0-4c11-b5a1-02a58d7263a6", "value": "T133E6330BB24C17DEE5D641747A32D4359271BF130BA086AB72E4DA6E1D331EC1A2E7E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776234792, "uuid": "0609d058-64cb-470e-a542-5cf645d93f6a", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776234792, "uuid": "26dc93a7-26dd-41bf-a742-308435560e83", "value": "393216:O8JKWc02mfCS+ayCMw1M+8ADtAiVQpBN1GeBWBpDBC:JTc4aS+RCMw14gtAiVQPvGeUBlB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776234792, "uuid": "d8f735a7-c37d-4d4c-90da-ad31bb02efab", "value": 14778732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776234792, "uuid": "289d26e2-3178-49f4-9bb7-c2be141cc506", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776234792, "uuid": "46543804-3c5b-434c-8651-35bd44341efe", "value": "winreg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34eb4fc7-38bd-11f1-a769-42010a9c0008", "comment": "Malware payload (MacSync)", "timestamp": 1776252071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252071, "uuid": "0faf6ebb-4022-4e05-8eb8-66aa4c484473", "comment": "Malware payload (MacSync)", "value": "18c5bcbae0dc94147a15838fe8b4279c", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252071, "uuid": "252397b0-c87a-405a-824d-d5ab8ac4177c", "comment": "Malware payload (MacSync)", "value": "f5471a00bb6cdaf01e44311c04de2e66c6f92ccc4b8e42bbb1bcb4e48f86ef3e", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252071, "uuid": "2f242169-b4c1-4078-b45f-a77da5870728", "comment": "Malware payload (MacSync)", "value": "b168325461458120ffc8b5323ebd5972d81d4e3a", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252071, "uuid": "200fc606-3b6f-4efa-83d7-555ea9fbb1f0", "comment": "Malware payload (MacSync)", "value": "74df4f066a1f7d617ce52a924e11f12973455211f165832939ab39648072aa54ddb771379a0a970562d2abc1800054d2", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252071, "uuid": "7cdb8f0a-2be6-45a6-a2f8-9c8377c4ed95", "value": "T1A0333F3AAB0C4671D01D827982DF1B9A3776F6744ED2830F5781C8387F9576A2A61E0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252071, "uuid": "fb93aed9-a0e9-430d-a308-321ff56eb631", "value": "96:vju0EDRzEoHXv49v8J8pmKODnW23Xv4O8Z83d:vqPRzEwkvcym7rLHsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776252071, "uuid": "63168b23-b4eb-453e-a197-4b85ef792887", "value": 50320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776252071, "uuid": "e3548ed5-973d-40fb-a2b8-83eafe5f9dd2", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252071, "uuid": "78789334-6b6a-4e90-a82e-d4d2747a8e59", "value": "f5471a00bb6cdaf01e44311c04de2e66c6f92ccc4b8e42bbb1bcb4e48f86ef3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d48951d-38f2-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1776274848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274848, "uuid": "d796aa5c-ac74-4488-b710-ed1b66e5fbeb", "comment": "Malware payload (DattoRMM)", "value": "986af9a919c2aa068e6b9df61b63dd67", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274848, "uuid": "873bd8cd-b315-4203-b694-a834e68f269f", "comment": "Malware payload (DattoRMM)", "value": "f58cb609fb798117ad61bcfbcea69a7284d43468b61f1274cbf58759c3e366ab", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274848, "uuid": "5b4f0f9c-6162-46fb-bcc6-db79ac46f082", "comment": "Malware payload (DattoRMM)", "value": "bae91a247e6c9de559a2c22989888e854e0d6c3d", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274848, "uuid": "f2e8516e-b313-4241-ab90-b564b615ed91", "comment": "Malware payload (DattoRMM)", "value": "5e8a9e105ed8a176a695fe03aa59cd15b412c98d8fc80b3aea0a074771427b596cf7b86b8938b5e3bb3f3efa9c2b9d4e", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274848, "uuid": "7cfa0aa7-b22e-44a6-ad0c-f2d57d1fd07f", "value": "T1B6B63347D9778DF0CA330B3890D21A6B3305980E485BF4C9E509277ADAF35AADD2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274848, "uuid": "2b6bd62a-993f-4b9b-ae71-cc1d5c051103", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274848, "uuid": "6f8692bc-dcab-48da-ba13-ae74e1034dfb", "value": "196608:CaZk+wuP+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2Y:YnJmzZFw5S9pE7Asjp29qIT0jarlZr8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776274848, "uuid": "2f19cf13-cead-4df3-9cfa-2343f302db79", "value": 11054328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776274848, "uuid": "a2e24df0-f294-47e3-ae45-df4cd7660d62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274848, "uuid": "d7842e18-e3e5-4c81-93ae-ecc3e73e7025", "value": "TrueView.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "756fd7bd-3912-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776288686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288686, "uuid": "f37524e8-2c8e-4858-b549-ca956a0b7763", "comment": "Malware payload (Mirai)", "value": "91187440545b7d691115ac98089b6dc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288686, "uuid": "878fd748-4030-4d21-ac80-f9a894c08bac", "comment": "Malware payload (Mirai)", "value": "f625fb09f4e2b0f0293eaf262a7e9d19ef2973792249c8eec139876c73ac212f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288686, "uuid": "76d5efa1-d938-4b04-b0ff-04d42d0ca25e", "comment": "Malware payload (Mirai)", "value": "2508512ad7cdde5727a88a12ac1fa405fe05b627", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776288686, "uuid": "0e4937ab-021a-4525-9101-3ad8bbc74089", "comment": "Malware payload (Mirai)", "value": "2effa220f016753b8f4ba2a349d2178e57fb8b8152b9a64542c0e9be852c1536218ece8fb218541a78db900d3dd061f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288686, "uuid": "bf30c0da-e228-4f92-9f4b-9bdbc020aa93", "value": "T15EC31A8ABC418F11D5D666BAFE0F618D33134B78E3FA7103CE149F29678A85B0A3B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288686, "uuid": "e815f673-95f7-412b-8fe2-99ad55cdf0b3", "value": "3072:qSaMRO5/CCHEq1fD2iSssFNbEKfXtXDJnxE3tC9fmLP3NlE+u3n4w:EC2V2iSssFNbjXhJxE3tC9MP3Ny+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776288686, "uuid": "b4a2be64-edef-4b49-b1ec-1cd9467dcce7", "value": 120356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776288686, "uuid": "64c883a5-72ce-4a99-80f9-0f3a83e316eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776288686, "uuid": "81e66003-5c11-410a-aa2e-006727ff6387", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a52d2e15-38bd-11f1-a769-42010a9c0008", "comment": "Malware payload (MacSync)", "timestamp": 1776252259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252259, "uuid": "2d1edb3f-1a50-485e-9e03-6c7460f1aac2", "comment": "Malware payload (MacSync)", "value": "31aa8d08e52a8491dbe507e9b5ab6b0d", "object_relation": "md5", "Tag": [ { "name": "ALL", "colour": "#60623E", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zipped", "colour": "#BC8083", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252259, "uuid": "7c2a5b94-d646-4770-b64b-4c4e5d253fab", "comment": "Malware payload (MacSync)", "value": "f668ba1794464bcdb5a2428dfcc7230a3aaee208e917ef4b7d2a34e0d3ec3c22", "object_relation": "sha256", "Tag": [ { "name": "ALL", "colour": "#60623E", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zipped", "colour": "#BC8083", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252259, "uuid": "59b362e8-465d-4569-9db9-83e32b32836a", "comment": "Malware payload (MacSync)", "value": "9717c293d4908b58bfad964e28d73240b61441fa", "object_relation": "sha1", "Tag": [ { "name": "ALL", "colour": "#60623E", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zipped", "colour": "#BC8083", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252259, "uuid": "f142dfae-e53f-4ea5-8fb6-aca3e46afa1c", "comment": "Malware payload (MacSync)", "value": "621df0b35251808c4f1e253fc4d1063dae4c3ddce3275e83da2ca034f0a3225323ee5f89375fca32c428399f280f30f3", "object_relation": "sha3-384", "Tag": [ { "name": "ALL", "colour": "#60623E", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zipped", "colour": "#BC8083", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252259, "uuid": "b0a912ec-8266-4d8f-b381-e79861dcf341", "value": "T1B004222C52A56C1FD9F56FFB9FC927C2C1ACF436D62CC986300992901BC5CAE538662D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252259, "uuid": "a9fde06e-40f8-478a-a31f-36db3f358762", "value": "3072:6XOkeC5cz2Iq3dkiAmT1MdtesGkVisxEzi1la8NUoqRqlIfoN3HuITkX:6X95M2dBTpkVn9HtDqwN3HQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776252259, "uuid": "364a2615-db59-462a-99aa-5057450c645b", "value": 185287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776252259, "uuid": "344328c3-8ef7-415f-839f-fb7ebdf27899", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252259, "uuid": "14b80511-cc6f-4f6a-a4be-1c696b04134f", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c004065-38b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776249103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776249103, "uuid": "3f4c0bd7-59d7-4696-a8cb-441e386d8e4d", "comment": "Malware payload (Mirai)", "value": "d8ee333f651e8e8beabb7eda00cfc17f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776249103, "uuid": "b67cb0e5-d3fe-4ef9-8994-a7571ca49cd3", "comment": "Malware payload (Mirai)", "value": "f7faee988e389ac32f497785126e3f3a209724804b0f75ec14253e49d36c9b27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776249103, "uuid": "aa8ab13b-215c-4f96-9275-48568bcbcbaf", "comment": "Malware payload (Mirai)", "value": "6e93b3c25c7ab6a5aed4c18ecb8e597af86e9d40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776249103, "uuid": "b43df230-0cb0-49df-9f2f-8c1f26b54edf", "comment": "Malware payload (Mirai)", "value": "cf5c408ae47645aff704226f5c487fa4ec6dd7d47e25db7b757d78e5e4139455ca3aa5732938b23ea19113e8b90e2cd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776249103, "uuid": "8c9bb511-6ab8-4a8a-934d-89938640e1a4", "value": "T154143B45F8919F27C6D122BBFB6D418D331A27A8D2EE72078C255F21378B85B0E77642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776249103, "uuid": "651e873d-6a5c-40a8-95f5-cfaea649bc15", "value": "3072:e/s7Ywu6jsPURmsdV1a9nNp4eOw+7JSx0XBMoC4nCw:ws7nmURm2mNp4eg7UxwKoC4n3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776249103, "uuid": "5c867fc8-191a-413c-a8db-d428005c2889", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776249103, "uuid": "d1a2e8cf-192e-43e0-929c-52f412b31b41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776249103, "uuid": "b5fcdee5-89b1-4b43-a099-0b6a03fefe5f", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39800469-38bd-11f1-a769-42010a9c0008", "comment": "Malware payload (MacSync)", "timestamp": 1776252078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252078, "uuid": "25ca05b9-8022-4380-bda0-403b9371b1ab", "comment": "Malware payload (MacSync)", "value": "d79abf51b21fa607f2c463c309c144da", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252078, "uuid": "442bcc83-abff-43d5-b4f4-655d44a6cc27", "comment": "Malware payload (MacSync)", "value": "f80ff072316e2d62490df743cbd5363bfb6ec5459409cc162d0602f7a1c607bb", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252078, "uuid": "8409e216-4c89-4e87-aef5-cfd8410c971f", "comment": "Malware payload (MacSync)", "value": "fe776a0a5e62406438a0dec1f839b4b342bf340a", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776252078, "uuid": "5c3ba6f2-266e-4a90-a6f3-3464a16072da", "comment": "Malware payload (MacSync)", "value": "24dea302a76e47d3cfd2f7064f6856239958cb4735b61e51ce5a8506d0b939409cfa1aa73bb75cdc6086f4983aa43fbb", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSync-Stealer", "colour": "#ECADCC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252078, "uuid": "bff90e53-d1fa-4fbd-b71e-70e2d859ca67", "value": "T1F502FD26AB4C4730D11C827981CB1B9A37A5F6640AD2C70E6782C8383F9275A3A75F0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252078, "uuid": "5bb83d8b-c4ce-4bc9-89fe-a885e7f522bb", "value": "48:x+/0EDCvnIlMOeU2XkkQ1dXv4/l8m8fR8A6:xu0EDRzEoHXv49v8J8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776252078, "uuid": "185fa9e2-8745-47ed-bc4d-385fd3ad61f3", "value": 8936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776252078, "uuid": "4eb68839-b363-45ff-84a0-719c7052e897", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776252078, "uuid": "93c4bc63-7f16-42ae-95e4-2c2090de2a99", "value": "f80ff072316e2d62490df743cbd5363bfb6ec5459409cc162d0602f7a1c607bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2da8a18c-38ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776259360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259360, "uuid": "085269d6-5007-4ca4-b8e1-2d11ac7d769e", "comment": "Malware payload (Formbook)", "value": "802ae169c4c87f4119504fb81b45c6f5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259360, "uuid": "c63cf92d-7c24-4282-8400-215162d52f74", "comment": "Malware payload (Formbook)", "value": "f91b0a2e9b51f33f6fe1ed3d8f28620a1c10219f8a280ed8e5c321824a774166", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259360, "uuid": "05291a6a-7c98-421c-a71c-e108c5e1e9dc", "comment": "Malware payload (Formbook)", "value": "444c10a216f8dcb95abb0aa30c1fde917007fb92", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259360, "uuid": "cd33dfc0-980e-4a88-b61e-e946cc61cc3d", "comment": "Malware payload (Formbook)", "value": "d649d1f17010dd0f5c2188b765adc96645d6a8ca28904a967cbe45c596be0e749049e37c340f17760ec473315b0c107b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259360, "uuid": "e80e8233-3fd5-4a1f-ace1-8550671fb3a5", "value": "T1B695021189C43FB9CFAC161950BE150FA3F04A8E551A798EEB33BD4AEFE7A04520719D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259360, "uuid": "2752637d-38c2-45a7-9511-27fc49bbbf21", "value": "24576:S28uoJya61k8BDiuKDXKjIqNi5NX10wsEgDioIwTjEuc9xhEfBczqTHCjk3E17YG:SfyxkWJN8r10wsWXwfToOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259360, "uuid": "f1004e7f-68c0-42e5-9ce5-9035672e16d0", "value": 2012827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259360, "uuid": "7a1ed0b6-597b-4986-8046-da568282506d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259360, "uuid": "cc249e26-b1c7-4e98-b020-92decdbc111b", "value": "Order Request - CSR-204S095.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9afefd2-38fa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776278466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278466, "uuid": "0e28bde2-a442-4b15-a09e-21e008031818", "comment": "Malware payload (Mirai)", "value": "d458f8ec3893275bd3c08326d4fc7963", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278466, "uuid": "fb591c2c-6d46-46d4-b160-6dd6d33ab32e", "comment": "Malware payload (Mirai)", "value": "f97471ccab2827c00dd55db72c93ad97a1c01f9794e033180ea84e63d573ae44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278466, "uuid": "b4872ec3-6864-4e66-8142-9f1ad62ea78a", "comment": "Malware payload (Mirai)", "value": "1c52f61aaaf2f6bbda8e00eb090fb5a1d6b4efe5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776278466, "uuid": "53689fc6-71bb-4010-a3d8-05c243e609a9", "comment": "Malware payload (Mirai)", "value": "42661410f5118a9ea717e2fce38e498c1d1cffcbd12d1f453d5c3c4d9f6cd6f6fa2a95ae2cad7f476d7c4f1e42eeddc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278466, "uuid": "93cd1ef1-7221-4b75-bc07-5d9912639d06", "value": "T1B2632ADAF801DD7DF80FE6BA4417090AB93163D142830B3767ABFDA3BC721A55912E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278466, "uuid": "2e0182f2-b67f-43ff-94cc-45eea80d54cb", "value": "1536:52AyqkBwxq8ZoBsaIBmq2sY5SieciIJ0O:5AqYwx64m/sM9J0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776278466, "uuid": "70ed7c79-c6a4-47e4-8764-c8a1f88af156", "value": 69060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776278466, "uuid": "d8dbdc20-6681-4380-8468-a2665b73a765", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776278466, "uuid": "0b365263-d9c4-4457-b2be-bd4268a48682", "value": "FGx8SNCa4txePA.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "857484e5-391c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776293008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293008, "uuid": "a68695dc-abd8-4b99-a9b1-e381c2be783a", "comment": "Malware payload", "value": "eed5ee0a5d04e1b15267e68054d1c8be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293008, "uuid": "d82b284e-e544-4493-8907-628ce2daf597", "comment": "Malware payload", "value": "f98ead1adc036df4db2dc85d929868b1a2a4f928bc21f3289c62789638d8895a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293008, "uuid": "e2b5252d-34f9-449e-95d1-fff3dc5821ab", "comment": "Malware payload", "value": "c64a3505ec644357c6bb461dbcbcf0244fd48a12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776293008, "uuid": "3997a2d6-c1ab-4c20-bbbe-b7f12a83bc9e", "comment": "Malware payload", "value": "d30eb5107a98669ca313dea7752c14efd4f41418cc9a826289fe592f9b039d3ea7a7e37be9b2a08e7fc146a00b32c853", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293008, "uuid": "95600e04-3b4d-4e04-970f-a856a0b9df12", "value": "T153C32A06B30C0D47D1633EF43B3B27E1D3DFDA8121A4E640655FAA8991B2D32558AEDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293008, "uuid": "c32754bc-4029-47da-87d3-1994b9f1d436", "value": "1536:9M5Q65u1LzJhxDxI+z4Xyg7OG5QksMzwLcvAeJGOARmS5XsgqslzEuq+:9MWSqzJhxm9vOG2kQ9eClNq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776293008, "uuid": "d54d8a8a-2c5f-4f99-87be-9b3c30369b6b", "value": 121508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776293008, "uuid": "afcde9a1-78ea-4394-9128-7ed117becb7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776293008, "uuid": "aedb892b-76cd-4d43-aab0-60275766b671", "value": ".Sassy.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ebdb81-389d-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776238615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238615, "uuid": "18a446e5-ecb0-4dc3-ab63-2f009edd9d17", "comment": "Malware payload (AsyncRAT)", "value": "b9b3cf2be1f75eff8f75877148a6d89c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238615, "uuid": "1f350ade-c58b-4b87-9882-3397d0e1d320", "comment": "Malware payload (AsyncRAT)", "value": "fa940681c5cfc96d8553e27982b3faa92fcebc2f7656a4aed71511c0a93807bf", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238615, "uuid": "bd84e3cd-3f08-4f1d-b4a9-f3641065335f", "comment": "Malware payload (AsyncRAT)", "value": "ad330cbbdc7f8139f79423a25a90a2db4b2eca0e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776238615, "uuid": "f594120f-6198-4de1-a850-394f294dea97", "comment": "Malware payload (AsyncRAT)", "value": "fbb71017ac01910655fdeb51e37779484d224b985f33168d9fe4a59c933d72808e2e4d4cadf31e2a46ff20f66a665791", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238615, "uuid": "1ee08fa3-f189-4fc0-871c-793c5598cc14", "value": "T1F6232A003BE8812BF2BE4FB899F26145867EF2673603D64D1CC451DB5613BC68642AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238615, "uuid": "b47230fd-8ff1-4f37-8521-be9092ecbc81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238615, "uuid": "753641bf-05b6-4b8e-b532-23caae3d444e", "value": "768:VuAtPTgoRzbWUnd9rmo2qr2Ijp+l76JPIZzjbZgX3te0lwYRdvEoJBDZix:VuAtPTgG/2J6U76mZ3b2X9IYRdsoXdix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776238615, "uuid": "b7fb02a3-6d90-4d7e-b7b2-380ad8542c41", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776238615, "uuid": "dd70e7d4-ba30-44ea-ab07-64a8658222a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776238615, "uuid": "3ae1e65f-e82d-4b02-8a4b-a9fb44b47bc5", "value": "bet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e42ab2d-38f2-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776274796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274796, "uuid": "30c3b257-c304-4fa0-ab11-b515b38692cf", "comment": "Malware payload (ConnectWise)", "value": "6c7926b8d6003653936b593e86487c7f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274796, "uuid": "efcd4a31-8be2-4ca9-9eb0-15926eba4adb", "comment": "Malware payload (ConnectWise)", "value": "fb36523e7b737097d8bbe439c753915760e4c281f76975c18240802f2083758b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274796, "uuid": "0ad0818c-8e5f-4016-91b1-87b873b9550f", "comment": "Malware payload (ConnectWise)", "value": "879ee2c33be49a8f3d1c7651b9113aa516d17335", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776274796, "uuid": "b1c1ac66-18ed-40d9-887b-5171cbf57d44", "comment": "Malware payload (ConnectWise)", "value": "80bc26830ddcf8bf92f4197ab9956fd83ef98f4972244afc61323f3832944a3f4d67ecf57190c37f8f34d23e89cd2728", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274796, "uuid": "e0ec6723-d6a8-447e-b9ea-f8f3c46178cd", "value": "T185A623116BF8D278F1B22A39D876A0B1A5367D119E23D12E2324791E2C75EC0CA73777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274796, "uuid": "46f3d395-cc30-4c17-9c67-0c58b5e98d1c", "value": "196608:fHxcp9ym3nltDUJVJHxcp9ym3pHxcp9ym37Hxcp9ym36Hxcp9ym3:pGplpuGp7GpFGpIGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776274796, "uuid": "0ecedde2-f2fc-4d61-acc4-9a9b465aecc3", "value": 9957376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776274796, "uuid": "2cb7997b-c2dd-4348-a74b-e81f1b3c01ab", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776274796, "uuid": "7f7b4d06-32ba-4b4e-9ede-ec9f50c7fec7", "value": "ScreenConnect.ClientSetup4.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3be04beb-389b-11f1-a769-42010a9c0008", "comment": "Malware payload (LodaRAT)", "timestamp": 1776237480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776237480, "uuid": "5f54d10f-0be7-415f-89f2-eb7b3b76ad4e", "comment": "Malware payload (LodaRAT)", "value": "d5e57a6ae0b161970f96f1dc6476df35", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "LodaRAT", "colour": "#DEDEF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776237480, "uuid": "730bd86a-91f9-45f3-8193-fb840ddd8f1b", "comment": "Malware payload (LodaRAT)", "value": "fb87bc38265ab7c46f18e1088d3274ae06ade0eed871c34d4a659461116b6d58", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "LodaRAT", "colour": "#DEDEF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776237480, "uuid": "ffadc943-b6e0-47a6-b60e-9005a73411c6", "comment": "Malware payload (LodaRAT)", "value": "96d6006aa38d92918f358ec2d8ef3c02cf588eaa", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "LodaRAT", "colour": "#DEDEF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776237480, "uuid": "c4d9ed1c-ea28-4368-b7a7-a3edb56a4f4f", "comment": "Malware payload (LodaRAT)", "value": "f43341d59f664cc3a3d437afd3c00b7da4357cd28a6f20a59843c07643fd4e9c50cb7e22068972ba07b4edea5f10e7c5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "LodaRAT", "colour": "#DEDEF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776237480, "uuid": "da710e0b-11b4-47d2-9acc-b728bda5152e", "value": "T13114237BCE58621DC4DC1A3D095818B5C6B72977A083BDC936CA9E623D8D12793F1F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776237480, "uuid": "155895ed-6ad4-40c3-89e6-a01373e38110", "value": "3072:+IxBBzcoBn6q/OYaZZ6FGDIBuIl/ClodyZsPJ3OH6PzVuVe3GdP9KiE7qv13wxi:+ItLn6jZZuxC+d3U6PZ+eeP95Xv1qi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776237480, "uuid": "2a86d964-852a-4090-8922-9732b0e41ddb", "value": 192533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776237480, "uuid": "be7baa02-d9dc-4cfa-9676-19dfe3398959", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776237480, "uuid": "910be24e-590a-4241-8ae3-a3f48944d44c", "value": "Confirmaci\u00f3n de Reserva - 11 Hu\u00e9spedes - Informaci\u00f3n Confidencial.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a85b7b-3892-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776233823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776233823, "uuid": "59ce6129-96b5-47db-93c6-c0451c192d61", "comment": "Malware payload (AsyncRAT)", "value": "9f3e567108536c424e4c9b04461b4b41", "object_relation": "md5", "Tag": [ { "name": "81-163-111-127", "colour": "#EC8D2D", "exportable": true, "hide_tag": false }, { "name": "91-242-179-84", "colour": "#0FDD8F", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776233823, "uuid": "3709926d-037a-4ab5-bccf-60813b527a65", "comment": "Malware payload (AsyncRAT)", "value": "fbae574b2e4733c1560e760125619310d239041235306079e9d26f436c308cb1", "object_relation": "sha256", "Tag": [ { "name": "81-163-111-127", "colour": "#EC8D2D", "exportable": true, "hide_tag": false }, { "name": "91-242-179-84", "colour": "#0FDD8F", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776233823, "uuid": "667364f6-a4be-4deb-97d4-f2d57ac4f469", "comment": "Malware payload (AsyncRAT)", "value": "11e39fbf3ce60b2bbec6150bfa94e52c4b30878d", "object_relation": "sha1", "Tag": [ { "name": "81-163-111-127", "colour": "#EC8D2D", "exportable": true, "hide_tag": false }, { "name": "91-242-179-84", "colour": "#0FDD8F", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776233823, "uuid": "a30b4bb4-59cc-435b-9cb9-863a88e1bfcb", "comment": "Malware payload (AsyncRAT)", "value": "b5f2a7a27e434b853cde3b99fc88722a6d556ae9c03d8f4ad351154499a88780df0c8f1dcbb1ef7a9f6149317e0a0a04", "object_relation": "sha3-384", "Tag": [ { "name": "81-163-111-127", "colour": "#EC8D2D", "exportable": true, "hide_tag": false }, { "name": "91-242-179-84", "colour": "#0FDD8F", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776233823, "uuid": "2d0068c9-cf2d-49d3-9ab9-e0d06ab78de8", "value": "T1FE231B003BE9822BF2BE4F789CF26145857AF6633603D5492CC451DB5613FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776233823, "uuid": "ed6f5b44-e5b9-40c0-9fea-1490f9d7b672", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776233823, "uuid": "0ceb401f-2a3e-48af-8045-0146180d5024", "value": "768:6uKQ9TH4EjZWUR/ejmo2qrYKjPGaG6PIyzjbFgX3i/zMoLEVXfel3iBDZTx:6uKQ9THfe2BKTkDy3bCXS/zzLSetcdTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776233823, "uuid": "f6da583a-7718-42fa-a0fe-8042fe392008", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776233823, "uuid": "6b0c22d8-c0de-4d5e-8723-47196d888993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776233823, "uuid": "4d440953-fc48-4a15-9812-d90de41e860e", "value": "fbae574b2e4733c1560e760125619310d239041235306079e9d26f436c308cb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f3686e-38b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776249064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776249064, "uuid": "bc6173dc-ffa0-4179-821a-20467e0f72f6", "comment": "Malware payload (Mirai)", "value": "44c17b3ee2ebe21c09c212aabb470676", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776249064, "uuid": "6f6ad81a-9c30-456f-91f6-90ef46867baf", "comment": "Malware payload (Mirai)", "value": "fc38381eae0370afab4933713374775157e96f6921e126f8b71f10ed89cbc5b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776249064, "uuid": "b54f2da6-eb67-454c-ab94-2981b35549b2", "comment": "Malware payload (Mirai)", "value": "5795b86197d3c4bb986368c1578e072f8aa6714e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776249064, "uuid": "cebd3d36-371d-43bb-b0d2-6b4cc5458e3e", "comment": "Malware payload (Mirai)", "value": "0e732d0f08398355e0c689726b6104587ec8243b66a9f4eb9f463215a0f5f6c336b862a54245be6edc684ce255fff9f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776249064, "uuid": "c66eacee-b51e-48ad-8f52-35dcb97ddde8", "value": "T1AF63F2B0051E9652B2F0703BCA58EB4E3F9B37F59825396D371C4E307F8620A6976685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776249064, "uuid": "ce39b729-fb4c-434c-87da-1e11f0f4ba33", "value": "1536:YCtY6p0KaIjM7r6W6f6IL0J3vSh5OHuw8/XbpmlXzNQAmu9fzH:DtYMo9rN6f6Ia/2UHL2XNgpL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776249064, "uuid": "f2e92e41-db68-4608-a646-0b4ba6b3a50e", "value": 70176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776249064, "uuid": "cfee3b3f-8d17-47ca-81d8-0ba85d9e683f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776249064, "uuid": "95c3ce1b-0002-47da-8bfd-45049e643684", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74bef5ac-3920-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776294698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776294698, "uuid": "be516bb1-e058-40ce-953d-90fb8cebf2a4", "comment": "Malware payload", "value": "6e30cd5bab14a494bde08a480145a55d", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776294698, "uuid": "353adb16-59a9-4a0c-8132-9f96d42c8177", "comment": "Malware payload", "value": "fd297890fd8c7d4a22822d70d51748d94c362c3a8b5e9169e3c477c7446159b3", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776294698, "uuid": "5b26fda5-ed2d-45af-b080-e01c8a8be1f8", "comment": "Malware payload", "value": "e1047eb26d9089b8daba98d876b2b41bf6b17ecf", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776294698, "uuid": "841d60fd-dd71-4cb7-8db2-7961b987edbe", "comment": "Malware payload", "value": "fea9e9b9b26405f41f84df7cd24d916e0ef7091917c91a73f9af6b807da6291885e4001c812b33e485445337727d3878", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776294698, "uuid": "c1556898-2460-4a07-9c68-a474f8183c6d", "value": "T1261457B98A9907BB7327209CE1AF4C82EDC6A13B435D96CAFF4DF1A07B15344D0C6592", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776294698, "uuid": "f439bb42-a9be-47dc-a247-5c9273c5d698", "value": "768:6/X+1/oqqqAjmtk4Aq3JELaDI+7SavQdvCovqTYtlquOJ9fargvfGJf4t8GI+1U9:6ZqqqDndmavQdv5vgYquk9SkvOJw69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776294698, "uuid": "e865b75b-3179-4a7b-855e-5f1c60d85b21", "value": 201831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776294698, "uuid": "c1269db5-f733-4b6e-a05d-e9e7d55253e5", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776294698, "uuid": "e1b998e2-7e5c-4e41-a19c-06f22479f5a8", "value": "Quantum_Build_Europe_1084.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86835ae5-3917-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776290862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290862, "uuid": "48b3c9a6-088c-4775-a404-b55475f17346", "comment": "Malware payload", "value": "4bda2c992690b4dbd297c45a0f7c09f9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290862, "uuid": "eb472877-502f-4fb7-afa7-e6401d359570", "comment": "Malware payload", "value": "fd57efac4a5b16fef63d10eb1e8fcbd69d21c2f136d6c5b1de4b0b44455c87e6", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290862, "uuid": "f204187d-93bf-4b00-8aa6-ac7d2aae2436", "comment": "Malware payload", "value": "4514c5500e7f1ca273d6c5013150329da3efd7b1", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776290862, "uuid": "173b29ab-b866-4d7e-9359-ab0b3127d20c", "comment": "Malware payload", "value": "28247f180a884d94ebe919b63b250d2cbf5c9aa0dbdefda2481a4ac61b85d9fb5eacdc25867b3b0f73a96d54bc27bb77", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290862, "uuid": "01a444a1-e79f-49d9-82d2-a0042e7e11f9", "value": "T117A302E76F54EC27DD2E8CB68C74E57BAFB2532291A1DB471A06E0103A654F80EE441F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290862, "uuid": "f3369c4e-7b49-44fa-b6ac-acfe0a5d90e2", "value": "1536:S4k4zNs+1UtUwBx84E4uAXQlcWrZvS00eV688DANSct9eIoMjEiogZiZ48cw3Q:TO2wBMAghNZV68C69/oMjJ648ZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776290862, "uuid": "7d13c224-2ac2-4cba-a477-7d73ac992c27", "value": 107399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776290862, "uuid": "544adf22-08ab-4d60-a58a-5f6426f6724e", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776290862, "uuid": "8f65bd45-8944-4afe-a350-9bb66eb43f62", "value": "GooglePlayClientPlay.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e48dcdc-391a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776292164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776292164, "uuid": "142fb763-7db0-450b-b880-9a0e090e9ca4", "comment": "Malware payload (Mirai)", "value": "e9d863c1bdbe3af05cbfc3aed6d50366", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776292164, "uuid": "074c296e-d425-4b13-bb24-3f9b314be7aa", "comment": "Malware payload (Mirai)", "value": "fd8c86b3ee999a51467c36b753cc65fe1c5dea314c04ff5669cc04600682277d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776292164, "uuid": "bf20611b-1b47-4f65-b8ce-fbb964196991", "comment": "Malware payload (Mirai)", "value": "84df3cea23002eea26b552ee92549341285fb53a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776292164, "uuid": "c448fbcd-44ca-44e4-a24b-b9cb95d24632", "comment": "Malware payload (Mirai)", "value": "b7ecaab3244957da411a78854619d2ee4b3d07aa7cc45dd2cc7d80a492a109f7f351ca632f4c13e2191d3086b45a9ebf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776292164, "uuid": "9b71203d-1d78-4f51-bc6a-7b115be8dc71", "value": "T183F3C71A9F910EFBDC6FDD3301A90B0635CCA51722A53B7636B4C528F54A94F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776292164, "uuid": "7622280c-a681-4fb1-bb23-a03c6cb9ea53", "value": "1536:GX1m3u0bFVDRjXJ99TFwaz4NXHQqi/xZo55NHWHHZKFC5apa3yTkxjZLvv9y4Hb:X3uGP1CNXwhXMPpa3hxlLvVl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776292164, "uuid": "d6d8390b-ad42-4453-9d42-66fe4c5448b0", "value": 169028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776292164, "uuid": "2a098447-6267-42f8-b4ff-d8eeca265cb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776292164, "uuid": "63332be1-7c0b-45e5-954d-466d5d64f322", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0d1faf-38ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776259570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259570, "uuid": "92378eab-5bac-44eb-af54-913f7f42d4d4", "comment": "Malware payload", "value": "3830c54187ce8c196662e50c5b9e4c57", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259570, "uuid": "5492222f-63ff-4866-bc43-8cfe96230808", "comment": "Malware payload", "value": "fddee78c0a1f4ed249fc7a2d163f297db6e84d7e58d6d47bfbdf1be393afe435", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259570, "uuid": "4dbba9a9-0299-49bf-b004-30fbd19ddbe5", "comment": "Malware payload", "value": "0d66a1ea60756bec78948f8bf248db49aed67198", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259570, "uuid": "f941c960-c764-489b-abcd-23afff720f9f", "comment": "Malware payload", "value": "20dcf321cb4670fe03393b9b0424aad0acdd24b3cccea4e6074ffe392e39133e67959457b4c1a969787ea86a889f6639", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259570, "uuid": "c39e5d87-bfc0-478f-8987-8288cf922b60", "value": "T148B5B754257F3C3A1842D873537319CB566800F691A28B3A3B20FD69B279C1DD8B6BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259570, "uuid": "91c05634-df1e-4ade-9d38-d11bb7550523", "value": "96:IpJwvZfAsgGF8bbG5pZBLFtZM/N61+NFlDouNNaWvwzStiW85zc3Le08Nu8Py+NG:IpJwvZsjy5nzLbH7p+fk9pI00NDTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259570, "uuid": "3c1b35cf-9b46-4965-ac47-4eb79013fb32", "value": 2433668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259570, "uuid": "bf9374b4-ee21-4bdc-83da-f4bd5d28dd7c", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259570, "uuid": "9aa97362-f66d-4e64-bafe-3e955f5872e8", "value": "purchase order.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be33f8a-38c8-11f1-a769-42010a9c0008", "comment": "Malware payload (Bifrose)", "timestamp": 1776256887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776256887, "uuid": "240bac55-8180-4a33-9eaa-20d6c2303137", "comment": "Malware payload (Bifrose)", "value": "4577d44da29a4e6df7a1c56b651a0199", "object_relation": "md5", "Tag": [ { "name": "aso-ddns-net", "colour": "#C9F308", "exportable": true, "hide_tag": false }, { "name": "Bifrose", "colour": "#35415A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776256887, "uuid": "b076fd5e-8144-403e-8517-287c852df5b0", "comment": "Malware payload (Bifrose)", "value": "fdfc6320673afaf42fb7161e75814d9dc98c77057456bb375b1afdaf55e9bcb9", "object_relation": "sha256", "Tag": [ { "name": "aso-ddns-net", "colour": "#C9F308", "exportable": true, "hide_tag": false }, { "name": "Bifrose", "colour": "#35415A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776256887, "uuid": "962d0069-1a11-462d-b86b-96cc0d1374d8", "comment": "Malware payload (Bifrose)", "value": "45ac470b2be39c7a3c19f7d4fa0b3592da7e60e6", "object_relation": "sha1", "Tag": [ { "name": "aso-ddns-net", "colour": "#C9F308", "exportable": true, "hide_tag": false }, { "name": "Bifrose", "colour": "#35415A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776256887, "uuid": "cd7aabba-12fa-460c-a04f-ee4c98c2729c", "comment": "Malware payload (Bifrose)", "value": "a872fdf3a3e5a12ece41f63ad63c0ed33102864afa23c0e4dc3e8ce88eadec57c2bdd90594305234d7cb24cfba62f379", "object_relation": "sha3-384", "Tag": [ { "name": "aso-ddns-net", "colour": "#C9F308", "exportable": true, "hide_tag": false }, { "name": "Bifrose", "colour": "#35415A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776256887, "uuid": "e260bcd7-4262-4af9-9cbe-f6e43a8e2296", "value": "T122E2D08901CB1CC0E5A3FA7D89ED0EE591A54A369F67130B93FEA0FD5B20A47249D0CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776256887, "uuid": "5a931930-5eec-4157-8f3a-34e956780a72", "value": "8afbf9211984274dc7a21b630ecae242", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776256887, "uuid": "7f124d78-b50d-4a4a-802d-650b7db4321a", "value": "768:Z+h7TzTBziifTeiZSVWihwEknh0L7OTLeNfQfj:kZ/nEkh8OTKNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776256887, "uuid": "40f38340-8483-4def-9819-1008c28d168a", "value": 32637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776256887, "uuid": "447690d3-9f8a-4964-91b2-1127d7cf2c3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776256887, "uuid": "03737b81-d2c1-4ed8-b181-203bbfd7be18", "value": "fdfc6320673afaf42fb7161e75814d9dc98c77057456bb375b1afdaf55e9bcb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db6cad5d-38a0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776239895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239895, "uuid": "33e16de3-2002-4c8b-89a0-4ace6e61f212", "comment": "Malware payload (AgentTesla)", "value": "705b3114cb15fa7bf4446348960658e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239895, "uuid": "b6b34fab-d01e-4eb2-aab1-2fb07a4eedc6", "comment": "Malware payload (AgentTesla)", "value": "fe5195961a44ebda2fb50661a60552ca264c8bc14000e5a8846f1f8ee0eb3db9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239895, "uuid": "c57f2ad8-f868-4f7a-95b6-29ae5ed5caca", "comment": "Malware payload (AgentTesla)", "value": "4d39a5884c85b44b34810a9064018f3cbb0b0f43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776239895, "uuid": "a3714229-8d4b-422d-ab6a-4040823968ce", "comment": "Malware payload (AgentTesla)", "value": "b8277c58f2bfcdf0a2c3773596c19f0a80d6575d53cd7be5e20ade77a3c2d860d5e7cfdb6c5ea47655745ff612d3d188", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239895, "uuid": "88c270e4-2f51-402c-beb4-87e95a46e60c", "value": "T10C5694CCC0A4700998C2CF5FF562D9B1888E797A2E1D9AB2641FD4BC1D95F93A8105EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239895, "uuid": "7e2ae17d-4ca2-4237-9a44-4443b6e9c2ee", "value": "98304:2fMdqFsESeNyu8mvm132AvlesD61fZcyEhXY1GUrnv4d0tdmFKStiwWEcwTsEQCh:2f4qFsESNulmgAYs2ZczhXYbnvZ7mFX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776239895, "uuid": "796f2877-41ad-4cbe-891e-8f377a459fc5", "value": 6027834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776239895, "uuid": "ffba05ad-e608-4f0a-b019-6f8af5239bd7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776239895, "uuid": "9af0e6a9-e0c8-40d6-b5e9-4e7641692643", "value": "PO-012447.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8361ccde-38ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776259504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259504, "uuid": "33e3da96-22af-48ae-b32a-219417460ad8", "comment": "Malware payload (Formbook)", "value": "f3a71a39cf413a36dcd0cc935820319d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259504, "uuid": "6a7a665d-b78e-42fe-adbb-d8006f9f518d", "comment": "Malware payload (Formbook)", "value": "ff21a907e02f5ac9e58543c9ddd8f259f1c5f5f4298a1df45aa6c93dff471462", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259504, "uuid": "13c42172-30fb-4b56-96da-a6df7e4750d8", "comment": "Malware payload (Formbook)", "value": "1ef81c538117b743c111e78902905994d06eb4d1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776259504, "uuid": "aabee7bb-6afc-44af-afe0-ed8822ac3cdb", "comment": "Malware payload (Formbook)", "value": "80e68dd1b671ac98ab9a879616ee3c4bbb7bfcdc9f0ec98e3133605a6229b108064fca6e5e7b60ad9a19ca4641989cfb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259504, "uuid": "6d34c8b6-949f-427c-965d-5aeda6bb3da2", "value": "T13595021189C86FB9DFAC561C40FE160E53E04E8A5426B98EFB33FD46AFE7904520B1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259504, "uuid": "8ad6ffa4-8194-4860-b7b8-511286f5b83a", "value": "24576:4wZ6pMeeGeJcs6vRdzbP02GivMgb/Q0eHlH4bxJZ7CFa+k2jpMdRSFRVZRlNasXO:1QpMNJYzKAD64nZOFaFdMvjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776259504, "uuid": "d84ef02b-01ee-424c-bcd5-4a5d5949e7ca", "value": 1975857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776259504, "uuid": "369bf27a-e06e-403d-9fcb-8332a2909384", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776259504, "uuid": "e10dcbbf-2338-4df9-a985-5d99c38426f4", "value": "U prilogu 879-0982-4326-pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71767887-3883-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776227262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776227262, "uuid": "c218db38-14af-4a61-811d-212f301fa072", "comment": "Malware payload", "value": "4db4780db78d0997cc3d8a200111412c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776227262, "uuid": "d19656af-7684-4aa3-b64e-a6c94588d2b3", "comment": "Malware payload", "value": "ff4ac6fb5ccb661678f8073535e04e3616a82fe7f8086acf5e768afe75ed9d0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776227262, "uuid": "962a1c43-9fbf-4f07-9d3a-35545c158722", "comment": "Malware payload", "value": "415819586d90848a59f6f10a96907697e01a47cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776227262, "uuid": "30f53ac6-92f0-46c1-ba17-e3c46b457113", "comment": "Malware payload", "value": "c526701f9dd2767f147eee79136860b2ee72b78f2cab427f1828230de2fc498c81e4c9f7ebd6294d0baf7f770764bb6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776227262, "uuid": "08a443a0-d11d-45dc-8105-6f82ba6a37e4", "value": "T1E0469016EDA805A9C592637A883351537E38B800572133D76AD9636C2F637F4D3BAF2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776227262, "uuid": "fffd0f98-c071-4d41-8479-676e3720cfa5", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776227262, "uuid": "8ed59d91-fdf2-442a-9414-0e8db115002d", "value": "49152:L9yh+eWVLwugzTCR1FEFLyNOsH1BEjGQclvEq2FBDUDOk7VhbvbV5ZS+/ZqqxSlS:L9RZw6qsH1EWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776227262, "uuid": "b2006f14-574c-4bf4-9568-7c462a5752f2", "value": 5632865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776227262, "uuid": "85ca0b04-9e50-44e8-8495-bbf8257d1dcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776227262, "uuid": "2d5dda72-d012-4580-8c68-e8743aaa385c", "value": "SecuriteInfo.com.Variant.Midie.178032.83551299", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ecdee6-3918-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776291423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776291423, "uuid": "a9d9129b-13e2-4587-be79-8be57d6b6d8f", "comment": "Malware payload", "value": "34813b1dfef4cadc47baa27890b15f95", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776291423, "uuid": "14edef26-a162-4832-b904-4bf5ce5c60c8", "comment": "Malware payload", "value": "ff7c2c0010db56e20ba0f454c749f5beaeb3cdcf575217f0215f1e6210da619b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776291423, "uuid": "d753efb2-3f3b-4857-a813-d036cf72b674", "comment": "Malware payload", "value": "e5e1a990e19ea682776516e4bfcfb469af600110", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776291423, "uuid": "11f71aa4-63f8-4def-8af6-0fbf7486e5fb", "comment": "Malware payload", "value": "547f0efdb892650f1f4bbdf6a75db0fffad93ceee76e8f98ea5d6b92eabb67bd4deeb1042d0ecb6e8f1fdd661c71c773", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776291423, "uuid": "d201dbc3-0e52-4ac9-91b8-1c5c11b2b069", "value": "T16475491BBCD008F6C0AA9332896665917BB1BC450F3127D72EA0B37C2F726E49D79758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776291423, "uuid": "0a7bf6c7-f35a-4c6a-a8d7-7453d34f7ce7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776291423, "uuid": "b0757e25-d7d1-4547-ab8f-0248b403ad19", "value": "24576:mpJKZErA3J9w4zYmGRjzFv/QBele5zKD9/no13V0buWjZun:mpAZQA3I40mGm2A13tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776291423, "uuid": "927e5a4a-69ae-4c29-9749-282dff01cf0e", "value": 1640448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776291423, "uuid": "7c3b576a-ad11-455a-9ce8-acf2302835f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776291423, "uuid": "4d99a37c-59e1-4d55-a71c-2ff77d84d025", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f769c43f-38c9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776257551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257551, "uuid": "38c6629f-86e5-42f2-bfe9-b6684a28b5b6", "comment": "Malware payload", "value": "e54de017a7a93487d1ce50cb89676556", "object_relation": "md5", "Tag": [ { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "livemap-back-ddns-net", "colour": "#E73106", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257551, "uuid": "1c72e1f3-686f-49a7-a62b-019b934a23be", "comment": "Malware payload", "value": "ffcfee12bd160dc67f9b0fbd4462e46e5932840297c611ad2646139295ea019c", "object_relation": "sha256", "Tag": [ { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "livemap-back-ddns-net", "colour": "#E73106", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257551, "uuid": "0224c644-27dc-47b9-8063-2cc10b42a5a7", "comment": "Malware payload", "value": "cceb2ecb340e343ca878bdf65d67bebdc9d4d1ba", "object_relation": "sha1", "Tag": [ { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "livemap-back-ddns-net", "colour": "#E73106", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776257551, "uuid": "5b451cd2-fa0f-4f2d-8cdd-9635b76f2ca2", "comment": "Malware payload", "value": "906a4953e202c117c33f162a9d561105eb0607d3d760c73426251409f23faedda1056478f9f5dfdcf7b50bee0f9d5812", "object_relation": "sha3-384", "Tag": [ { "name": "45-74-4-179", "colour": "#0F446C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "livemap-back-ddns-net", "colour": "#E73106", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257551, "uuid": "8854a155-7a37-44e6-b481-b4da07d9577e", "value": "T1A318E147F6428CA7CDE55470A55ED277B3223D6CC352A213AA44B7287EBB7D44F2A380", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257551, "uuid": "9421e310-1aa9-4cb7-9066-8458a10366ca", "value": "786432:Qx8hpRVAgfsVI0mke75jT0ZfR7LzfvfWyYEL9aoW56k1mApPfjO72Qm/fvpJu:jf9R5fyYLT1Y72QsJu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776257551, "uuid": "caafe35a-7d32-4870-8dac-97785ec78d48", "value": 87819084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776257551, "uuid": "d3202657-ea65-4ff1-80f3-efcbb4bdfa4a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776257551, "uuid": "850932f0-ecdc-49f1-bc37-27984fabc26b", "value": "ffcfee12bd160dc67f9b0fbd4462e46e5932840297c611ad2646139295ea019c.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }